Cross-Border Data Transfers Under the DPDP Act: What Businesses Need to Know

Hero Summary

India's Digital Personal Data Protection (DPDP) Act, 2023 takes a permissive approach to transferring personal data outside India: transfers are allowed except to countries or territories the Central Government restricts by notification. Two points make this less simple than it sounds. First, existing laws that already require stricter treatment — such as sector rules requiring certain data to be stored in India — continue to apply. Second, the Government of India's explainer on the DPDP Rules notes that significant data fiduciaries may have to follow government directions on restricted categories of data, including local storage where needed. Businesses should map their international data flows now.

Executive Summary

Many Indian organizations send personal data abroad every day: cloud hosting, global SaaS tools, offshore support, group companies, and payment and analytics providers. Under the DPDP framework, the question is not whether transfers are permitted in principle, but whether a specific destination or data category is restricted, and whether another law adds requirements. This guide explains the Act's approach, what else may apply, how cross-border flows should be documented and secured, and a practical set of steps. The Act and the Rules are the authoritative sources, and further notifications may change which destinations are restricted, so confirm the current position before relying on any summary.

The DPDP Act's approach {#approach}

Section 16 of the DPDP Act allows a data fiduciary to transfer personal data outside India for processing, except to countries or territories that the Central Government has restricted by notification. This is sometimes described as a "negative list" or "blacklist" approach, in contrast to regimes that permit transfers only to destinations deemed adequate or only with specific safeguards. It is more flexible than a general ban, but it also means the position can change when the Government notifies restrictions.

What the "negative list" means {#negative-list}

Under a negative-list model, transfers to any destination are permitted by default, and the Government may later restrict specific countries or territories. For businesses, this has two practical implications:

• You need to know where your data goes. If a destination is later restricted, you must be able to identify which systems, vendors, and data categories are affected — and move or stop the transfer.
• Being permitted under DPDP is not the end of the analysis. Other laws and contracts may impose their own conditions.

Other laws that still apply {#other-laws}

The Act states that its provisions do not override existing laws that provide a higher degree of protection or restriction on transfer. In practice, sector regulators and other laws may continue to impose requirements, for example:

• Payments and financial data. Reserve Bank of India requirements for payment system data and other regulatory requirements on regulated entities. See Banking Compliance Guide.
• Securities and insurance regulators and other sector rules on outsourcing and data storage.
• Government and public-sector contracts that require data to stay in India.
• Foreign laws that apply to your overseas partners or customers, such as the EU's GDPR where you serve people in the EU.

An Indian business that sells globally may therefore face the DPDP Act, sector rules, and foreign privacy laws at the same time.

Significant data fiduciaries {#sdf}

According to the Government of India's explainer on the DPDP Rules, Significant Data Fiduciaries face stronger duties and, in some cases, must follow government directions on restricted categories of data, including local storage where needed. If your organization might be designated, treat localisation as a possibility to plan for. See Significant Data Fiduciary Under DPDP.

Mapping your cross-border flows {#mapping}

For each flow of personal data outside India, record:

Item	Question to answer
Data	What categories of personal data are transferred, and about whom?
Purpose	Why is it transferred and what lawful basis supports it?
Recipient	Which vendor, group company, or partner receives it?
Destination	In which country or countries is it stored and accessed, including by support staff?
Mechanism	How does it move — API, file transfer, cloud replication?
Controls	What encryption, access control, and contractual protections apply?
Legal overlay	Do any sector rules or foreign laws also apply?

Remember that access from abroad can count as a transfer even when data is stored in India — for example, offshore support teams viewing records.

Practical steps {#steps}

1. Build a data inventory that includes where each system is hosted and which vendors access it. See Data Mapping and Records of Processing Under DPDP.
2. Identify transfers to other countries, including cloud regions, SaaS tools, and support access.
3. Check sector and contractual requirements for each data category.
4. Watch for notifications that restrict destinations, and build the ability to relocate or stop transfers.
5. Prefer architectures that allow regional choice — such as selecting an Indian cloud region — where the cost and risk justify it.
6. Review vendor contracts to ensure you know where processing happens and can require changes.
7. Document decisions so you can show why each transfer was lawful.

Contracts and security {#contracts}

Because the data fiduciary remains responsible for personal data processed on its behalf, contracts with foreign processors should require them to apply security safeguards equivalent to your own, to notify you of breaches, to delete data on request, and to disclose sub-processors and processing locations. Encrypt personal data in transit and at rest, limit access, and keep logs. See Third-Party and Vendor Risk Management Under DPDP.

How Threat ResQ fits {#threat-resq-fit}

PrivacyIQ, Threat ResQ's privacy management platform, provides a data inventory covering data assets, processing activities, and data flows, plus vendor governance and technical discovery — for example, observing what a website exposes to third parties. It is a platform that supports a privacy programme: it is not a certifying authority and does not grant or imply a "DPDP compliant" status. Threat ResQ's Compliance Consulting service supports regulatory readiness.

FAQ {#faq}

Does the DPDP Act allow transferring personal data outside India? Yes, except to countries or territories that the Central Government restricts by notification.

Does India require personal data to be stored locally? The DPDP Act does not impose a general localisation requirement, but other laws and sector regulations — for example, certain financial-sector requirements — may require storage in India, and the Government may direct some significant data fiduciaries to keep certain categories of data in India.

What is a negative list for data transfers? An approach under which transfers are permitted to any destination except those specifically restricted by the Government.

Does remote access from abroad count as a transfer? It can. Offshore teams that view or process personal data may be treated as receiving it, even when it is stored in India, so include access in your data-flow mapping.

What should I do now about cross-border transfers? Map every flow of personal data outside India, identify any sector or contractual requirements, review vendor contracts and processing locations, and build the ability to relocate or stop a transfer if a destination is restricted.