Cross-Border Data Transfers Under the DPDP Act

The negative-list model

The DPDP Act empowers the Central Government to restrict the transfer of personal data to certain countries or territories by notification. The structure is a negative list: transfers are generally permitted, and only those to specifically restricted destinations are prohibited.

This is the inverse of a positive-list or adequacy model, where transfers are blocked by default and only permitted to approved destinations. Under the DPDP approach, the default is openness, with targeted restrictions layered on top.

For most businesses, this means routine transfers to common destinations remain permissible unless and until a specific country is restricted, which is a significant simplification compared with stricter regimes.

This design choice signals a broader policy stance: India wants to protect personal data without cutting its digital economy off from the world. For businesses, that intent translates into workable rules rather than a localisation straitjacket.

What the model permits in practice

In practice, the negative-list model lets organisations continue using global infrastructure and vendors located outside India, provided the destination is not on a restricted list. Cloud hosting, SaaS tools and offshore support arrangements generally remain workable.

This pragmatism reflects the reality of a globalised digital economy, in which insisting on full localisation would impose heavy costs and cut Indian businesses off from global services and markets.

The freedom is not unconditional, though: the Act's other duties — security, purpose limitation, processor contracts — travel with the data, so an overseas transfer still has to be secured and contracted properly.

It is still worth confirming, for each major destination and vendor, that no restriction applies and that your contracts and security are in order. The freedom the model grants is best exercised with a clear record of where your data actually goes.

Other obligations still apply

A common misreading is that, because transfers are broadly allowed, overseas processing is unregulated. That is wrong. Wherever your data goes, you remain the accountable fiduciary, and the full set of obligations continues to apply.

This means overseas processors must be engaged under valid contracts, must apply appropriate security, and must support your breach-reporting and rights obligations. The transfer being permitted does not dilute your accountability for what happens after it.

In effect, the negative list governs whether you may transfer, while the rest of the Act governs how the data must be handled once transferred.

In other words, 'allowed to transfer' and 'free from obligations' are entirely different things. The most common compliance failure here is assuming the former implies the latter and neglecting the security and contractual duties that travel with the data.

Sectoral rules can be stricter

The DPDP Act's permissiveness does not override sector-specific requirements. Regulators in areas such as banking and payments have their own localisation rules — for example, requirements that certain payment data be stored in India — which continue to apply.

So an organisation in a regulated sector may face stricter transfer or localisation obligations than the DPDP Act alone would impose. The Act sets a baseline; sectoral law can add to it.

Mapping which sectoral rules apply to you is therefore essential before assuming the negative-list model gives you a free hand to transfer.

Reconciling DPDP with sectoral rules is therefore a mapping exercise: identify the regulators that govern you, list their localisation or transfer requirements, and ensure your architecture satisfies the strictest applicable rule, not just the Act's baseline.

Significant data fiduciaries and special restrictions

The Government retains the ability to impose additional measures on Significant Data Fiduciaries, which could include restrictions on transferring certain categories of personal data outside India.

Large, data-intensive organisations should therefore watch for any such measures and design their architecture so that, if specific data must be localised, they can accommodate it without wholesale re-engineering.

Building flexibility into where data is stored — the ability to keep certain categories in India if required — is prudent contingency planning for organisations likely to be designated SDFs.

Designing in the ability to localise specific categories on demand is cheap insurance. An architecture that can, if required, pin certain data to Indian regions without a wholesale rebuild leaves you ready for any future restriction without over-engineering today.

Comparison with the GDPR

Compared to the GDPR, the DPDP Act's transfer regime is markedly lighter. The GDPR restricts transfers by default, permitting them only to countries deemed adequate or under specific safeguards such as standard contractual clauses.

The DPDP Act inverts this: openness by default, with targeted restrictions. For multinationals, this generally makes Indian transfer compliance simpler than GDPR transfer compliance, though the two must still be reconciled in a global programme.

The practical upshot is that organisations already managing GDPR transfers will usually find the DPDP requirements easier, not harder, to satisfy.

For multinationals, the practical win is that a mature GDPR transfer programme already supplies most of what India expects. Mapping your existing safeguards onto the DPDP regime is usually a reconciliation exercise rather than a fresh build, which keeps the marginal compliance effort low.

Documenting your transfers

Whatever the destination, good practice is to document your cross-border flows: what data goes where, to which processors, under what contracts, and with what safeguards. This record supports both compliance and the due-diligence questions customers increasingly ask.

A clear transfer map also lets you respond quickly if the Government restricts a destination, because you will know immediately which flows are affected and can act rather than scramble.

Documentation turns a permissive regime into a managed one: you exercise the freedom the Act allows, but with the visibility to adapt if the rules tighten.

Practical guidance for transfers

The practical posture is straightforward: treat transfers as generally allowed, but handle the data with the same care wherever it sits. Contract properly with overseas processors, secure the data, check for sectoral localisation rules, and keep a clear map of your flows.

Monitor for any country restrictions or SDF-specific measures, and design your architecture with enough flexibility to localise specific data if you are ever required to.

Handled this way, cross-border transfer is rarely a barrier under the DPDP Act — and keeping your transfers documented, contracted and secured is simply part of well-run dpdp compliance.