The current regime
Section 16 of the DPDP Act is — by international standards — permissive. It says the Central Government may, by notification, restrict the transfer of personal data outside India to specified countries or territories. Default position: transfer is permitted. Restriction requires a specific notification.
This is materially different from the 2019 PDP Bill, which contained extensive cross-border restrictions. The Act, as enacted, makes restriction the exception.
The future regime
Several factors point toward future restrictions:
- Reciprocity considerations — countries with restrictive regimes (China) may attract Indian restrictions
- Sovereign-interest data categories (defence, critical infrastructure)
- SDF-specific obligations under Rule 13(4) — the Government can require certain personal data of SDFs to remain in India
Entities should plan on the assumption that some categories of data, for some classes of fiduciary, will be subject to localisation or transfer restriction at some future date.
The mapping exercise
Whatever the current regime, you need a complete map of your cross-border personal data flows. The map should record:
- Source system (which application, in which country, generates the data)
- Destination system (which application, in which country, receives the data)
- Categories of personal data transferred
- Purpose of transfer
- Data Fiduciary at source, Processor / Data Fiduciary at destination
- Legal basis for the transfer (consent, contract, legal obligation)
- Volumes (records per quarter)
Quick wins
While you're mapping, address the obvious risks:
- SaaS tools storing Indian customer data in non-Indian regions where an Indian region is offered — switch to the Indian region
- Analytics platforms aggregating Indian user behavioural data into global instances — investigate region restrictions or anonymise pre-transfer
- Backup destinations outside India — assess and document
The processor question
Many cross-border 'transfers' are actually processor-to-processor. The Data Fiduciary remains in India; the Processor (e.g., a cloud provider's US-based analytics service) processes outside. Section 16 still applies to this. Your DPA must address it.