Does the Act apply to companies based outside India?

Yes, in defined circumstances. The Act applies to processing of digital personal data within India, and also to processing outside India where it relates to offering goods or services to individuals within India. So a foreign company with Indian users generally falls within scope. It does not apply to personal data of individuals outside India that is processed in India purely under a contract with a foreign entity, which protects India's outsourcing and IT services sector.