Cross-Border Data Transfer Under the DPDP Act: A Comprehensive 2026 Compliance Guide

Cross-border data transfer under the DPDP Act is one of the most critical — and most complex — compliance areas that Indian organizations must master. The Digital Personal Data Protection Act (DPDPA), 2023 represents a paradigm shift in how India regulates data protection, and its provisions on transferring personal data outside India sit at the heart of that shift.

This guide is written for compliance officers, legal teams, IT heads, and business leaders whose organizations move Indian personal data across borders — whether to a parent company abroad, a global cloud provider, or an overseas processor. You will learn what Section 6 of the Act actually restricts, how the three-tier transfer framework works, what contractual safeguards you need, and how to implement a phased compliance program.

As organizations increasingly operate on a global scale, understanding the nuances of cross-border data movement is essential for both legal compliance and operational efficiency. If you are new to the law itself, start with our overview of what the DPDP Act is and who it applies to, then return here for the transfer-specific rules.

What Are the Cross-Border Data Transfer Restrictions Under the DPDP Act?

Section 6 of the DPDPA, 2023 establishes the foundational principle that personal data shall not be transferred outside India, except to notified jurisdictions. This represents a significant departure from the pre-DPDPA landscape, where organizations enjoyed relatively greater flexibility. The Act’s approach is data-centric rather than organization-centric, meaning the restriction applies regardless of where the organization is headquartered.

Key Principle: The DPDPA operates on a territorial data protection model. If personal data originates from India, it is governed by the DPDP Act regardless of where the fiduciary or processor is located.

The Three-Tier Framework for International Data Transfers

The DPDP Act’s data transfer rules establish three distinct categories for cross-border data transfers:

• Tier 1 — Notified Jurisdictions: Countries where the Ministry of Electronics and Information Technology has issued a formal notification confirming adequacy of data protection. Currently, no countries have been formally notified under Section 6(2), though this is anticipated to change.
• Tier 2 — Transfer with Contractual Safeguards: Data can be transferred to non-notified jurisdictions if appropriate contractual safeguards are in place. These contracts must ensure that the data subject’s rights and fiduciary obligations are maintained.
• Tier 3 — Restricted Jurisdictions: Some jurisdictions may be explicitly restricted due to national security concerns or inadequate data protection frameworks.

Standard Contractual Clauses Equivalent: India’s Answer to GDPR SCCs

While the DPDP Act does not prescribe specific standard contractual clause formats like the EU’s GDPR, the legislative intent is clear that organizations must develop contractual frameworks that:

• Ensure the receiving jurisdiction respects the data subject’s rights as defined under the DPDPA (privacy, correction, erasure, portability)
• Establish clear processor-fiduciary relationships with defined responsibilities
• Include provisions for data breach notification to the fiduciary and data principal
• Allow for audit and monitoring mechanisms
• Include termination clauses ensuring data deletion upon contract termination
• Comply with Indian contract law principles of consideration and enforceability

For a deeper look at how India’s transfer regime differs from the EU and US models, see our comparison of GDPR, the DPDP Act, and CCPA.

Relevant Jurisprudence: Shreya Singhal v. Union of India (2013) 12 SCC 73 established the principle that intermediary liability must be balanced against freedom of expression. While this case predates the DPDPA, its principle of proportionate regulation informs the current cross-border transfer framework. The Supreme Court’s emphasis on determining when an intermediary becomes liable for data-related harms applies to cross-border processors operating within Indian data transfer chains.

Philosophical Underpinning: Rawlsian Veil of Ignorance in Data Transfer Rules

John Rawls’ “veil of ignorance” concept provides an interesting philosophical lens for understanding the DPDP Act’s cross-border transfer restrictions. Imagine a policy architect designing cross-border data transfer rules without knowing whether they would become a data subject, a fiduciary, or a processor in a foreign jurisdiction. What rules would they design?

Rawls would argue that fair data transfer rules should be those that:

• Protect the most vulnerable data subjects (those whose data is transferred to countries with weaker protections)
• Ensure proportionate burdens on organizations (not impossible to comply with, yet sufficiently protective)
• Allow for legitimate business operations while maintaining fundamental data rights
• Prevent race-to-the-bottom scenarios where fiduciaries choose jurisdictions with minimal data protections

The DPDPA’s cross-border framework, with its requirement for contractual safeguards even when formal adequacy hasn’t been established, reflects this Rawlsian approach: it prioritizes the data subject’s position behind the veil of ignorance.

Cross-Border Data Transfer Compliance Checklist: Step-by-Step Implementation

The phases below cover the transfer-specific workstream. For an organization-wide view of your obligations, pair this with our full DPDP Act compliance checklist for Indian businesses.

Phase 1: Assessment and Classification (Month 1–2)

Phase 2: Contractual Framework Development (Month 2–3)

Critical Requirement: Do NOT proceed with data transfers until contractual safeguards are in place. Unauthorized cross-border transfers can attract penalties up to Rs. 2 crores for significant data fiduciaries and Rs. 50 lakhs for others.

For each destination jurisdiction, develop contracts containing:

• Data Processing Terms: Clear definitions of what the data processor can and cannot do with the data
• Security Standards: Minimum encryption, access control, and incident response requirements compliant with DPDPA standards
• Data Principal Rights Clause: The processor must facilitate the exercise of rights including access, correction, and erasure
• Audit Provisions: The fiduciary retains the right to audit the processor’s compliance with data protection obligations
• Sub-processor Clause: Any onward transfers to sub-processors must be explicitly approved and similarly protected
• Termination and Return: Upon contract termination, all personal data must be returned or securely deleted within specified timelines
• Liability and Indemnification: Clear allocation of liability for data breaches and unauthorized processing

Phase 3: Technical and Organizational Measures (Month 3–4)

Implement the technical infrastructure to support compliant cross-border transfers:

• Encryption in Transit: All data transferred across borders must use TLS 1.2 or higher encryption
• Encryption at Rest: Data stored in foreign jurisdictions should be encrypted with keys controlled by the Indian fiduciary
• Access Controls: Implement role-based access control limiting processor employees’ access to Indian personal data
• Data Masking: Consider pseudonymization or anonymization where data utility permits
• Logging and Monitoring: Maintain detailed logs of all access to transferred data for audit purposes
• Incident Response: Establish procedures for breach notification within specified timelines

Phase 4: Documentation and Auditing (Month 4–6)

Maintain comprehensive documentation proving compliance:

• Records of all contracts in place for cross-border transfers
• Adequacy assessment documentation
• Data processing agreements with processors
• Audit reports from both internal compliance teams and external auditors
• Incident response records
• Data subject consent and opt-out records (where applicable)
• Regular updates to the Data Processing Register

Real-World Compliance Scenarios for Transferring Personal Data Outside India

Scenario 1: Multinational Corporation with India Operations

Situation: TechCorp Inc., a US-based software company, operates in India and maintains customer databases with Indian personal data (customers’ names, contact information, purchase history). Their parent company in the US uses this data for analytics, marketing, and customer support.

Compliance Approach:

• Execute a Data Processing Agreement between TechCorp India (fiduciary) and TechCorp USA (processor) under Indian law, complying with DPDPA requirements
• Implement technical measures: all transferred data is encrypted with keys held by TechCorp India
• Establish a policy that US employees can access Indian customer data only for specific purposes with audit logging
• Create mechanisms for Indian customers to exercise their rights (accessing or deleting their data) regardless of where it’s stored
• Include sub-processor notification mechanisms for any onward transfers (e.g., to cloud services like AWS)
• Conduct annual audits of the US processor’s compliance with contractual obligations

Scenario 2: Cloud Hosting and Third-Party Service Providers

Situation: An Indian healthcare startup uses AWS data centers in multiple regions including Ireland and Singapore to host patient data. Personal data includes patient names, medical histories, and billing information.

Compliance Approach:

• Obtain confirmation from AWS regarding which data centers are being used and what safeguards exist
• Execute a Data Processing Addendum (DPA) with AWS that specifically addresses DPDPA compliance requirements
• Configure AWS to use only Indian data center regions (Asia Pacific Mumbai — ap-south-1) for personal data storage
• If cross-border transfer to other regions is operationally necessary, execute additional contractual safeguards
• Implement client-side encryption before data reaches AWS infrastructure, with encryption keys managed by the startup
• Ensure AWS contractually guarantees sub-processor compliance (for any downstream services AWS uses)
• Maintain the right to audit AWS compliance with DPDPA obligations

Restricted Jurisdictions: Which Countries Are Off-Limits?

While the DPDPA hasn’t explicitly published a list of restricted countries, the regulatory intent suggests certain jurisdictions with known surveillance concerns may face restrictions. These might include countries known for:

• Mass surveillance programs or weak data protection legal frameworks
• Absence of judicial review mechanisms for government data access requests
• Lack of due process protections for data subjects
• Political instability or conflict affecting data security

Organizations should monitor Ministry of Electronics and Information Technology announcements regarding adequacy determinations and restricted jurisdictions.

Data Localisation in India vs. Cross-Border Transfer: Balancing Innovation and Protection

A common misconception is that the DPDP Act requires complete data localisation. This is incorrect. The DPDPA permits cross-border transfers with appropriate safeguards. However, it does mandate that:

• A copy of sensitive personal data remains in India
• The decision to transfer data is made with data protection as a priority, not merely operational convenience
• Contractual safeguards ensure the receiving jurisdiction respects Indian data protection standards

This balanced approach allows organizations to:

• Maintain global operations and benefit from international talent and infrastructure
• Comply with data protection requirements of other jurisdictions (e.g., GDPR)
• Implement cost-effective global infrastructure solutions
• Protect Indian data subjects’ fundamental rights

How Do DPDP Act Data Transfer Rules Interact With GDPR and Other Frameworks?

Organizations operating under both the DPDPA and GDPR face complex compliance scenarios. Key considerations:

Future Developments: Awaiting Adequacy Decisions and Notified Jurisdictions

The DPDPA ecosystem is still evolving. Organizations should anticipate:

• Adequacy Notifications: The Ministry of Electronics and Information Technology is expected to notify jurisdictions with adequate data protection frameworks. Recent announcements suggest focus on major trade partners like UK, Japan, Singapore, and potentially the EU.
• Model Contractual Clauses: While not mandatory, the government may issue guidance on minimum contractual safeguards, similar to how the European Commission issued SCCs.
• Bilateral Data Transfer Agreements: India may enter into bilateral data sharing agreements with other countries, similar to EU adequacy decisions.
• Regulatory Guidance: The Data Protection Board will issue guidance on “appropriate safeguards” as enforcement cases emerge.

Risk Management and Incident Response for Cross-Border Transfers

Even with robust safeguards in place, risks remain. Organizations should:

• Conduct Regular Data Protection Impact Assessments (DPIA): For each cross-border transfer arrangement, assess potential risks to data subjects’ rights
• Maintain Cyber Insurance: Obtain coverage that specifically addresses data breach liability in cross-border scenarios
• Develop Incident Response Plans: If cross-border data is compromised, simultaneously notify the Data Protection Board, affected data subjects, and cooperating regulators
• Implement Data Minimization: Transfer only necessary personal data. Avoid unnecessary geographic redundancy
• Regular Audits: Conduct internal and external audits of cross-border data handling at least annually

Conclusion: Navigating the DPDP Act’s Cross-Border Framework

Cross-border data transfers under the DPDP Act require a balanced approach combining legal compliance, technical safeguards, and organizational commitment to data protection. While the regulatory framework is still maturing, organizations that implement robust contractual frameworks, technical measures, and monitoring systems today will be well-positioned for compliance.

The philosophy underlying the DPDPA’s cross-border regime — protecting the most vulnerable stakeholders (data subjects) while enabling legitimate business operations — reflects a mature approach to international data governance. By understanding and implementing these principles, organizations can build trust with customers, meet regulatory expectations, and contribute to India’s emergence as a responsible digital economy.

Remember: The absence of adequacy determinations should not paralyze organizations. Develop comprehensive contractual frameworks now, implement technical safeguards, and maintain detailed compliance documentation. This proactive approach demonstrates good faith compliance and significantly reduces regulatory risk.

Frequently Asked Questions

Can personal data be transferred outside India under the DPDP Act?

Yes — the DPDP Act permits transferring personal data outside India, but only within its framework. Section 6 restricts transfers to notified jurisdictions, while transfers to non-notified countries require appropriate contractual safeguards that preserve data principals’ rights. Complete data localisation is not required, though a copy of sensitive personal data must remain in India.

Which countries are notified jurisdictions under the DPDP Act?

Currently, no countries have been formally notified under Section 6(2) of the DPDP Act. The Ministry of Electronics and Information Technology is expected to issue adequacy notifications, with recent announcements suggesting a focus on major trade partners like the UK, Japan, Singapore, and potentially the EU. Organizations should monitor MeitY announcements for updates.

What is the penalty for unauthorized cross-border data transfer under the DPDP Act?

Unauthorized cross-border transfers can attract penalties of up to Rs. 2 crores for significant data fiduciaries and Rs. 50 lakhs for other organizations. This is why contractual safeguards must be in place before any transfer proceeds. Maintaining detailed compliance documentation demonstrates good faith and reduces regulatory risk.

Does the DPDP Act prescribe standard contractual clauses like GDPR SCCs?

No — unlike the EU’s GDPR, the DPDP Act does not prescribe specific standard contractual clause formats. Organizations must develop their own contractual frameworks that ensure the receiving jurisdiction respects data principals’ rights, define processor-fiduciary responsibilities, include breach notification and audit provisions, and provide for data deletion on termination.

Does the DPDP Act require data localisation in India?

No, complete data localisation is a common misconception. The DPDP Act permits cross-border transfers with appropriate safeguards, but mandates that a copy of sensitive personal data remains in India and that contractual safeguards ensure the receiving jurisdiction respects Indian data protection standards.

Key Takeaways

• Section 6 of the DPDP Act bars transfers of personal data outside India except to notified jurisdictions, and no country has yet been notified under Section 6(2).
• The transfer framework is data-centric: Indian personal data stays governed by the DPDPA no matter where the fiduciary or processor sits.
• Transfers to non-notified jurisdictions are possible with robust contractual safeguards covering rights, security, audits, sub-processors, and deletion.
• Unauthorized cross-border transfers risk penalties up to Rs. 2 crores for significant data fiduciaries and Rs. 50 lakhs for others.
• The DPDP Act does not mandate full data localisation, but a copy of sensitive personal data must remain in India.
• Start now: a four-phase program — assessment, contracts, technical measures, documentation — positions you for compliance before adequacy decisions arrive.