Cross-Border Data Transfer Under the DPDP Act

In a global economy, most businesses transfer data across countries. This may be either to a cloud provider, to a vendor who processes it for you, or to another Data Fiduciary you have a partnership with. 

The DPDP Act will soon regulate the cross border transfer of personal data. In this blog we cover the DPDP obligations around cross border transfer of data including:

• when the DPDP Act applies to personal data processed outside India
• what the Act and the DPDP Rules, 2025 say about transferring personal data out of India
• the difference between DPDP and GDPR regulations around cross border transfers
• what your business should do before the obligations commence

Does the DPDP Act apply to personal data processed outside India?

Yes, it does. It applies to:

• Personal data processed in India (Section 3(a))
  
• Personal data processed outside India if the processing is related to offering goods or services to Data Principals in India (Section 3(b))

Outsourcing exception: If the personal data of Data Principals outside India is processed in India under a contract with an overseas client, the obligations under the DPDP Act don’t apply. (Section 17(1)(d)) For example, an IT services company in Pune processing customer personal data for German customers of a German bank, the DPDP Act obligations don’t apply to them. 

Can I transfer personal data outside India?

You can transfer personal data to any country outside India unless the country is notified as restricted by the Central Government. (Section 16(1))

The DPDP Act adopts a blacklist approach:

This means that transfer is permitted unless notified by the Central Government. This is the opposite of a whitelist, where transfer would be permitted only to approved countries.

No country has been notified so far. Transfer to a restricted country attracts a penalty of up to ₹50 crore. 

However if there is any other law like sectoral laws in India which restrict the transfer of data outside India or have data localisation requirements, that law will continue to apply. 

Certain restrictions on Significant Data Fiduciaries:

The Central Government may require a Significant Data Fiduciary to keep specified personal data, and the traffic data about its flow, inside India. (Rules 13(4) and 13(5) of the DPDP Rules)

No SDF or type of data has been notified so far. A breach attracts a penalty of up to ₹150 crore.

Data sharing with a foreign government or agency 

Under Rule 15 of the DPDP Rules the Central Government can specify requirements for sending personal data to a foreign government or agency. 

What did earlier versions of the law say?

Earlier versions of India’s data privacy law were far stricter on cross-border transfers:

• 2018 draft Bill (Srikrishna Committee): one serving copy of all personal data had to be stored in India. Critical personal data could be processed only in India.
• Personal Data Protection Bill, 2019: sensitive personal data could be transferred abroad, but had to continue to be stored in India. Critical personal data could be processed only in India.
• Digital Personal Data Protection Bill, 2022: Transfer was permitted only to countries notified by the Central Government i.e. a whitelist approach.
• DPDP Act, 2023: The whitelist approach was replaced with the blacklist approach.

What about other regulations that restrict cross-border data transfer in India?

If there is any law in India that provides for a higher degree of protection or restriction on the transfer of personal data outside India, that will continue to apply as per Section 16(2).

For example, if RBI requires the entire data relating to payment systems to be stored only in India, the Data Fiduciary cannot send it outside India even if the country is not on a restricted list as the RBI requirement will not be overridden.

DPDP Act vs GDPR

The GDPR regulates cross-border transfers differently from the DPDP Act.

• Assessing a country: The GDPR allows transfers to countries where there is an ‘adequate level of data protection’ as per the European Commission (Article 45). The DPDP Act has no adequacy concept and a transfer out of India is permitted unless the country has been notified as restricted. The DPDP also doesn’t set out any criteria for notifying a restricted country.
• Contractual route: If there is no adequacy decision, the GDPR allows transfer under some routes like: standard contractual clauses and binding corporate rules (Articles 46 and 47). The DPDP Act has no equivalent mechanism as there is no overarching restriction.
• Localisation: The GDPR has no localisation requirement. Under the DPDP Rules, the Central Government may require a Significant Data Fiduciary to keep specified personal data inside India (Rule 13(4)).

What should you do before the Act comes into force?

1. Map your data locations: identify every country where personal data is stored, processed or backed up, including by your Data Processors and their sub-processors.
2. Maintain this list: keep it current so that a notification can be actioned quickly.
3. Check whether the outsourcing exception applies: if you process the data of Data Principals outside India under a contract with an overseas client the obligations under the Act will not apply to that processing
4. Identify your sectoral requirements: For a regulated entity, the RBI, IRDAI, SEBI and other sectoral laws will continue to apply.

FAQs

What is cross-border data transfer under the DPDP Act?
It is the transfer of personal data by a Data Fiduciary for processing to a country outside India. The Act permits it, subject to the Central Government’s power to restrict transfers to notified countries.

Is cross-border data transfer allowed in India?
Yes. Transfer is permitted to any country unless the Central Government has notified it as restricted. No country has been notified. Sectoral regulations may still restrict the transfer.

Which countries are restricted for cross-border data transfer under the DPDP Act?
None. No notification has been issued under Section 16(1).

Does the DPDP Act require data localisation?
Currently the Act does not but the Central Government may require a Significant Data Fiduciary to keep specified personal data in India.

Does the DPDP Act apply to a company outside India?
Yes, if the processing is related to offering goods or services to Data Principals in India.

What is the penalty for an unlawful cross-border transfer?
Up to ₹50 crore for a transfer to a restricted country. Up to ₹150 crore for a breach of a localisation requirement by a Significant Data Fiduciary.

When do the DPDP cross-border provisions come into force?
13 May 2027.

‍