Cross-Border Data Transfers Under India’s DPDP Act: Rules, Restrictions and Compliance Roadmap for 2027

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a relatively permissive framework for the cross-border transfer of personal data from India. Unlike the European Union’s GDPR, which relies extensively on adequacy decisions and prescribed transfer safeguards, the DPDP framework adopts a negative-list approach: international transfers are generally permitted, subject to restrictions that may be notified by the Central Government.

However, an important distinction is necessary. As of September 2026, the DPDP Act’s substantive cross-border transfer provisions are not yet operational. Section 16 of the DPDP Act and Rule 15 of the Digital Personal Data Protection Rules, 2025 (DPDP Rules) are part of the 18-month commencement phase and are expected to become operative on 13 May 2027, based on the commencement notifications issued in November 2025.

This distinction is particularly important for businesses using global cloud infrastructure, overseas data processors, multinational group companies, global capability centres (GCCs), SaaS platforms and international outsourcing arrangements.

What Does the DPDP Act Say About Cross-Border Data Transfers?

Section 16 of the DPDP Act is the principal provision governing the transfer of personal data outside India. Under Section 16(1), the Central Government may, by notification, restrict a Data Fiduciary from transferring personal data for processing to a specified country or territory outside India. In other words, the Act does not establish a general prohibition on transferring personal data overseas. Instead, it enables the Government to identify jurisdictions to which transfers may be restricted.

This represents a significant departure from a conventional whitelist or adequacy-based model. The framework can therefore be understood as: Transfer permitted by default → Government may subsequently restrict specified destinations.

Section 16(2), however, preserves stricter requirements contained in other Indian laws. Consequently, the DPDP Act should not be read as overriding sector-specific data localisation or transfer requirements imposed by regulators such as the Reserve Bank of India (RBI) or other statutory authorities.

What Does Rule 15 of the DPDP Rules, 2025 Provide?

Rule 15 of the DPDP Rules, 2025 provides the operational framework for transfer of personal data outside India. It permits personal data processed by a Data Fiduciary under the Act to be transferred outside India, subject to requirements that the Central Government may specify through a general or special order concerning making such personal data available to:

• a foreign State;
• a person or entity under the control of a foreign State; or
• an agency of such a foreign State.

Importantly, Rule 15 does not establish a fixed list of approved countries. It also does not prescribe Standard Contractual Clauses (SCCs), binding corporate rules or a mandatory adequacy assessment as prerequisites for international transfers. The provision nevertheless gives the Government considerable flexibility to respond to concerns relating to foreign government access, national security, sovereignty and strategic interests.

Is Cross-Border Data Transfer Currently Allowed Under the DPDP Act?

This question requires careful qualification. As of September 2026, Section 16 of the DPDP Act and Rule 15 of the DPDP Rules have not yet commenced. The commencement notification issued in November 2025 places Sections 11-17, which includes Section 16, within the 18-month commencement phase. Similarly, Rules 3 and 5–16, which includes Rule 15, are scheduled for commencement in the corresponding 18-month phase.

Accordingly, it would be inaccurate to state that the DPDP Act’s negative-list regime is already governing cross-border transfers in September 2026. Instead, businesses must continue to assess international transfers against the laws and sector-specific regulatory requirements presently applicable to them, while simultaneously preparing for the DPDP framework that is expected to become operational from May 2027.

For example, the existing Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 contain provisions dealing with the transfer of sensitive personal data or information outside India. Rule 7 permits such transfers where the recipient ensures the same level of data protection and the transfer is necessary for performance of a lawful contract or is undertaken with the individual’s consent. Therefore, organisations should not treat the DPDP Act as though it has already replaced the existing compliance framework.

The May 2027 DPDP Compliance Milestone

The final DPDP Rules were notified on 13 November 2025. The Government adopted a phased commencement structure rather than bringing the entire framework into force immediately. The key milestones relevant to businesses are:

The 13 May 2027 date is particularly significant because organisations need to prepare before, rather than after, the substantive obligations become operational. There has been industry and media discussion regarding whether the Government may shorten some of the implementation timelines. However, as of September 2026, the notified commencement framework remains the relevant legal position; businesses should therefore avoid treating reported proposals as enacted amendments unless and until an official notification changes the position.

Will India Have a List of Countries Where Personal Data Cannot Be Transferred?

The DPDP Act gives the Central Government the power to notify countries or territories to which transfers may be restricted. This is commonly described as a negative-list or blacklist approach. The significance of this approach is that businesses will not necessarily need to demonstrate, for every transfer, that the destination country has been recognised as providing an adequate level of protection.

Instead, the regulatory architecture starts from the proposition that international transfers can occur, unless the Government imposes a restriction. As of September 2026, however, no such restricted-country list has been notified under Section 16.

This means businesses should avoid building compliance programmes around an assumed list of prohibited countries. Instead, they should build systems capable of responding quickly if the Government subsequently identifies particular jurisdictions or imposes additional conditions.

Can the Government Impose Restrictions Beyond a Country List?

Yes. Rule 15 is broader than simply identifying countries. The Rule enables the Central Government to specify requirements concerning making personal data available to foreign States or persons and entities controlled by, or acting as agencies of, such States.

This could become particularly relevant for organisations whose overseas infrastructure, cloud providers, processors or group entities may be subject to foreign government access laws. Consequently, a cross-border data-transfer assessment under the DPDP framework should not focus exclusively on the physical location of servers. Businesses may also need to consider:

• who can access the data;
• where the processor is incorporated;
• whether the processor is controlled by a foreign government or entity;
• whether data may be subject to foreign governmental access requirements;
• whether the organisation can segregate Indian personal data;
• whether contractual and technical controls can limit unauthorised access.

This makes vendor due diligence and data architecture increasingly important components of DPDP compliance.

Does the DPDP Act Require Data Localisation in India?

Not as a general rule. One of the most important misconceptions surrounding the DPDP Act is that India has introduced blanket data localisation for all personal data. The statutory framework does not impose universal localisation. However, there is a potentially significant localisation mechanism for Significant Data Fiduciaries (SDFs).

Rule 13 of the final DPDP Rules imposes additional obligations on SDFs, including annual Data Protection Impact Assessments and audits. It also provides that an SDF must undertake measures to ensure that personal data specified by the Central Government, based on the recommendations of a committee, is processed subject to a restriction that the relevant personal data and traffic data relating to its flow are not transferred outside India.

Thus, the framework leaves open the possibility of targeted or sector/category-specific localisation, rather than imposing a blanket requirement on every Data Fiduciary. As of September 2026, the relevant categories have not been notified.

Sector-Specific Data Localisation Rules Continue to Matter

The DPDP Act is not the only source of Indian data-transfer obligations. Section 16(2) expressly preserves laws providing a higher degree of protection or additional restrictions on the transfer of personal data outside India. This is particularly important for regulated industries.

Banking and Payments

The RBI’s Storage of Payment System Data framework requires payment system operators to store the entire payment system data in systems located in India, subject to specified treatment of the foreign leg of cross-border transactions. RBI guidance also clarifies that payment transactions may, in specified circumstances, be processed outside India, but the relevant payment data must be brought back to India within the prescribed period and stored in India.

Financial Services and Other Regulated Sectors

Businesses operating in financial services, securities, insurance, telecommunications and other regulated sectors must separately review applicable regulatory requirements. Accordingly, the compliance question should not simply be:

“Does the DPDP Act permit this transfer?”

It should be:

“Does the transfer comply with the DPDP framework, applicable sectoral regulations, contractual obligations and any other Indian law governing the particular category of data?”

Global Cloud Computing and Overseas Data Processors

The DPDP framework has particular significance for organisations using:

• Amazon Web Services and other cloud infrastructure;
• international SaaS platforms;
• overseas HR and payroll platforms;
• global CRM systems;
• international customer-support providers;
• multinational group companies;
• offshore analytics providers;
• global capability centres;
• outsourced business-process operations.

A company may technically have its primary database in India while allowing an overseas processor, support team or group entity to access personal data. Therefore, data localisation cannot be assessed merely by identifying the location of the primary server. Businesses should map the complete data lifecycle, including: Collection → storage → access → processing → support → backup → disaster recovery → analytics → deletion.

The exercise should identify every jurisdiction through which personal data may be transferred or made accessible.

What Should Businesses Do Before May 2027?

The transition period provides an opportunity for organisations to conduct a structured DPDP cross-border data transfer assessment.

A. Create a cross-border data map

Identify:

• categories of personal data;
• Data Fiduciaries and Data Processors;
• countries receiving the data;
• cloud and SaaS providers;
• remote-access locations;
• purposes of processing;
• retention periods;
• contractual arrangements;
• applicable sectoral restrictions.

B. Review processor and intra-group agreements

Contracts with overseas processors and group entities should clearly address:

• permitted processing purposes;
• security requirements;
• confidentiality;
• sub-processing;
• access controls;
• breach response;
• deletion and return of data;
• assistance with Data Principal rights;
• regulatory cooperation; and
• restrictions on onward transfers.

C. Conduct vendor due diligence

Organisations should identify whether overseas vendors are subject to foreign government access regimes and whether they can provide adequate transparency concerning governmental requests.

D. Build data-transfer contingency plans

Because Section 16 permits the Government to impose destination-specific restrictions, organisations should consider whether their systems can quickly:

• identify affected records;
• suspend transfers;
• redirect processing;
• segregate Indian personal data;
• migrate workloads;
• localise specific datasets.

E. Review sectoral requirements separately

DPDP compliance should be mapped against RBI, SEBI, IRDAI, telecom and other applicable regulatory requirements.

F. Prepare for Significant Data Fiduciary obligations

Organisations that may potentially be designated as SDFs should evaluate their readiness for:

• Data Protection Impact Assessments;
• periodic audits;
• algorithmic risk assessments;
• enhanced governance;
• possible localisation requirements.

DPDP Act vs GDPR: A Different Approach to International Data Transfers

The DPDP Act’s approach differs materially from the GDPR. The GDPR generally requires an appropriate transfer mechanism for transfers to third countries, including adequacy decisions, appropriate safeguards or specific derogations. The DPDP Act instead adopts a Government-controlled negative-list model.

The comparison demonstrates why multinational businesses should not simply import their GDPR transfer compliance model into India without adapting it to the DPDP framework.

Conclusion

The DPDP Act does not introduce blanket data localisation in India. Instead, it creates a framework in which cross-border transfers are intended to remain possible, subject to restrictions that may subsequently be imposed by the Central Government. For businesses, the principal challenge is therefore not simply determining whether data can leave India. It is understanding where personal data travels, who can access it, which laws apply to the transfer, what contractual protections exist and how quickly the organisation can adapt if regulatory restrictions change.

With the major DPDP compliance phase approaching in May 2027, organisations should use the intervening period to establish a comprehensive cross-border data transfer governance framework, review overseas processors and cloud arrangements, assess sector-specific localisation requirements, and build technical capabilities for data segregation and localisation where required.

For multinational businesses and Indian companies with global operations, these measures can significantly reduce compliance disruption when the DPDP cross-border transfer regime becomes operational.

Frequently Asked Questions