Does DPDP apply to data of foreign clients' customers?

Short answer: Mostly exempt for offshore data; security still applies

Mostly not. Section 17(1)(d) exempts processing of personal data of people outside India when you do it under a contract with a party outside India. Security safeguards and responsibility for your processors still apply. The exemption does not cover your Indian staff, Indian customers, or Indian data mixed into the same work.

What the law says

Section 17(1)(d) sets the exemption. Section 8(5) and 8(1) still apply.

Section 17(1)(d): When an organisation in India processes personal data of people outside India under a contract with a party outside India, most of the Act does not apply. The duty of security safeguards and the responsibility for processors still apply.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.

Steps

Tag each project by where the people live.
Find mixed projects with Indian data.
Keep security controls the same for all.
Record which contracts rely on the exemption.
Review when projects change.

Evidence to keep

Project tagging
Contract list

Common mistakes

Assuming all client work is exempt
Lower security for exempt data
Missing Indian data in global data sets

From each seat

DPO / Privacy lead: Own the project tagging.
CEO / MD: Do not market lower standards for exempt work.
Legal & compliance: Check contract parties are outside India for the exemption.
Delivery head: Tell the DPO when a project starts handling Indian data.

What a good answer from management sounds like

“Every project is tagged. Mixed projects follow full DPDP for the Indian data, and security is the same everywhere.” Effort and time: Light · 2 to 4 weeks.