Yes. The Act applies to processing outside India if it is connected with offering goods or services to people located in India. A foreign website or app that targets Indian users must follow the Act. Separately, an Indian outsourcing firm that processes the data of people outside India under a contract with a foreign company is exempt from most provisions (the outsourcing exemption).