Cross-Border Data Transfers Under DPDP: Where Your Data Can Go
TL;DR
The DPDP Act takes a permissive, negative-list approach to transfers: personal data may go outside India unless the government restricts a specific country (Section 16). Rule 15 lets the government set requirements on making data available to foreign states. But stricter sector rules still apply, including RBI's payment data localisation, and Significant Data Fiduciaries may face specified localisation. Know where every vendor stores and accesses your data.
Who this is for: legal, procurement and engineering teams working with cloud providers, global SaaS tools, offshore support and group companies abroad.
Few Indian businesses keep all their data in India. Cloud regions abroad, global SaaS platforms, offshore support teams and group companies all move personal data across borders, often without anyone deciding to. Here the DPDP Act is notably more permissive than the GDPR, but other Indian rules are not.
Section 16: the negative list
Section 16(1) allows the central government to restrict the transfer of personal data to any country or territory it notifies. Everything not restricted is permitted. This is the opposite of the GDPR, which permits transfers only to approved countries or under safeguards. See DPDP vs GDPR.
No restricted countries had been notified at the time of writing.
Rule 15: requirements on foreign access
Rule 15 provides that personal data processed in India, or outside India in connection with offering goods or services to people in India, may be transferred abroad subject to requirements the government specifies by general or special order regarding making that data available to a foreign state or entities under its control. Watch for such orders, especially if you use providers subject to foreign government access laws.
Sector rules still apply
Section 16(2) preserves any law that provides a higher degree of protection or restriction on transfers. Examples relevant to many businesses:
| Rule | Effect |
| RBI direction on storage of payment system data (2018) | Payment system data stored only in India |
| RBI digital lending rules | Lending data stored in India |
| Insurance record-maintenance regulations | Insurance records held in India |
| SEBI cloud and cyber frameworks for regulated entities | Data localisation and location controls |
| CERT-In Directions (2022) | ICT system logs maintained within India for 180 days |
| Telecom licence conditions | Restrictions on transferring subscriber information abroad |
Check the current requirements of your regulator; these change regularly.
Significant Data Fiduciaries
Under Rule 13, the government can, on the recommendation of a committee, specify personal data that a Significant Data Fiduciary must process subject to the restriction that it, and related traffic data, is not transferred outside India. Likely SDFs should know where such data sits now. See Significant Data Fiduciary.
You remain responsible
Wherever data goes, Section 8(1) keeps you responsible. A vendor storing your data in another country must still meet your security, breach and erasure obligations. Write locations, transfer approvals and sub-processor locations into your data processing agreements.
A transfer checklist
A transfer checklist
- Map where each system and vendor stores and accesses personal data, including support access
- Check every location against Section 16 notifications
- Check sector localisation rules for each data type
- Contract locations, transfer approvals and sub-processor locations
- Monitor MeitY for Section 16 and Rule 15 orders
- Assess SDF localisation exposure
How ConsentifyAI helps
ConsentifyAI records storage and access locations for every system and vendor in your ROPA, flags data types subject to localisation, and lets you see quickly which processing would be affected if a country is restricted.
Sources & references
- DPDP Act, 2023 — Section 16(1), 16(2)
- DPDP Act, 2023 — Section 8(1), 8(2)
- DPDP Rules, 2025 — Rule 13, Rule 15
- RBI — Storage of Payment System Data (2018)
- CERT-In Directions — Log maintenance within India (2022)
Frequently asked questions
Can personal data be transferred outside India under DPDP?
Yes, unless the central government has restricted transfers to that country under Section 16(1), or a sector law imposes stricter rules.
Has the government published a restricted country list?
No restrictions had been notified at the time of writing. Monitor MeitY notifications.
Do RBI and other sector localisation rules still apply?
Yes. Section 16(2) preserves laws that provide a higher degree of protection or restriction on transfers, such as RBI's 2018 direction on storage of payment system data.
Do we need standard contractual clauses like under GDPR?
The DPDP Act does not require them. You still need a valid contract with processors under Section 8(2), which should cover locations and transfers.
Are SDFs subject to localisation?
Rule 13 allows the government, on a committee's recommendation, to specify personal data that Significant Data Fiduciaries must not transfer outside India.
Related reading
Third-Party Vendor Risk Under DPDP: Your Vendor's Breach Is Your Breach
Under Section 8(1) of the DPDP Act, a Data Fiduciary is responsible for compliance even when a vendor does the processing. Processors may only be engaged under a valid contract (Section 8(2)), and Rule 6 requires security safeguards to be written into it. Withdrawals, erasure and breaches all have to flow through your vendors on time. Effective vendor risk management means knowing every vendor, tiering them by risk, contracting properly, and monitoring continuously, not just at onboarding.
ReadDPDP vs GDPR: The Differences That Catch Global Companies Out
The DPDP Act shares the GDPR's principles but differs in ways that break a copied programme. It has no legitimate interests basis, no sensitive-data category, no portability or objection rights, and no breach-reporting threshold. Children are anyone under 18, tracking and targeted ads to them are banned, and penalties are fixed rupee amounts per instance rather than a share of turnover. A GDPR programme is a strong starting point, not a finished one.
ReadData Processing Agreement in India: 10 Clauses You Can't Skip
Under Section 8(2) of the DPDP Act, a Data Fiduciary may engage a processor only under a valid contract, and Rule 6 requires that contract to include security safeguards. Because the fiduciary stays liable for its processors, the contract is where you make vendors meet your obligations. A DPDP-ready data processing agreement covers instructions, security, breach notification, rights support, sub-processors, transfers, deletion, audit, regulatory cooperation and liability.
Read