--- title: "Cross-Border Data Processing in India: Legal and Contractual Considerations for SaaS, Cloud and Outsourcing Arrangements" date: 2026-11-11 author: "Dhruv Kaushal" url: https://ksandk.com/data-protection-and-data-privacy/cross-border-data-processing-saas-cloud-dpdp/ --- ## Introduction Most businesses now process personal data across borders, through global cloud infrastructure, Software-as-a-Service (SaaS) platforms and offshore outsourcing. Indian businesses routinely engage overseas technology vendors for cloud hosting, customer relationship management, payroll management, analytics, data storage and business process outsourcing. Similarly, Indian service providers frequently process personal data on behalf of overseas clients using infrastructure and subcontractors located across multiple jurisdictions. ### Are you a Significant Data Fiduciary? Answer 25 questions to see your DPDPA risk level and whether the DPO obligation applies to you — free, instant, with a branded PDF. [Check your compliance score →](https://ksandk.com/privacy-review/scorecard) These arrangements raise questions about the allocation of data protection responsibilities, contractual safeguards, data security and compliance with applicable [cross-border transfer restrictions](https://ksandk.com/data-protection-and-data-privacy/cross-border-data-transfers-dpdp-act-india/). The Digital Personal Data Protection Act, 2023 (DPDP Act), together with the Digital Personal Data Protection Rules, 2025 (DPDP Rules), establishes a framework designed to allow international data flows while preserving the Central Government’s power to impose transfer restrictions. However, the substantive cross-border transfer provisions are scheduled to come into force on 13 May 2027. Until then, businesses must continue to assess international data transfers under the legal and regulatory requirements currently applicable to them, while preparing their contractual and operational arrangements for the incoming framework. For organisations relying on international SaaS providers, cloud service providers and outsourcing partners, these requirements shape both their regulatory exposure and the terms of their [data processing agreements](https://ksandk.com/data-protection-and-data-privacy/data-processing-agreement-under-dpdp-act/). ## The Regulatory Framework for Cross-Border Data Processing Section 16 of the DPDP Act provides the statutory framework for transferring personal data outside India. Under Section 16(1), the Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to specified countries or territories. Unlike the European Union’s General Data Protection Regulation (GDPR), which regulates international transfers through mechanisms such as adequacy decisions and appropriate safeguards, including Standard Contractual Clauses and Binding Corporate Rules, the DPDP Act adopts a negative-list approach. Under this framework, international transfers are generally permitted unless the Central Government notifies restrictions on transfers to specified jurisdictions. Rule 15 of the DPDP Rules supplements Section 16 by permitting the transfer of personal data outside India, subject to requirements that the Central Government may specify through general or special orders concerning the availability of such data to a foreign State, or to any person or entity under the control of or acting as an agency of such a State. This framework does not prescribe GDPR-style Standard Contractual Clauses, Binding Corporate Rules or mandatory transfer impact assessments as general preconditions for international transfers. Contractual safeguards are still needed, especially where overseas vendors process personal data on behalf of Indian businesses. Notification is not the same as commencement. Although the DPDP Act and Rules have been notified, Section 16 and Rule 15 are scheduled to become operational in May 2027. Businesses should therefore not treat the negative-list model as the presently operative basis for permitting international transfers. ## Data Fiduciary and Data Processor Responsibilities in Outsourcing Arrangements In cross-border outsourcing, the first step is identifying the respective roles of the parties involved in processing personal data. Under the DPDP Act, a Data Fiduciary determines the purpose and means of processing personal data, while a Data Processor processes such data on behalf of a Data Fiduciary. For example, where an Indian company engages an overseas cloud service provider to host its customer database, the Indian company would ordinarily act as the Data Fiduciary, while the cloud service provider may act as its Data Processor, depending on the actual nature of their respective functions and decision-making responsibilities. Section 8(2) of the DPDP Act requires a Data Fiduciary engaging a Data Processor to undertake such processing activities under a valid contract. Further, Section 8(1) retains responsibility with the Data Fiduciary for processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary. For Indian businesses outsourcing data processing to overseas service providers, this means that delegating the processing does not, by itself, transfer the Data Fiduciary’s statutory responsibility to the vendor. A service provider may also occupy both roles depending on the processing activity. An IT services company processing customer information on behalf of a foreign client may act as a Data Processor for that engagement, while acting as a Data Fiduciary when processing its own employees’ or customers’ personal data. Roles should therefore be assessed for each processing activity, not assigned once to an organisation across all its activities. ## Contractual Safeguards in SaaS and Cloud Service Agreements For businesses relying on overseas SaaS platforms, cloud infrastructure and outsourced data management services, contracts do much of the work of [data protection compliance](https://ksandk.com/privacy-review/). Section 8(2) of the DPDP Act expressly requires processing undertaken through a Data Processor to be governed by a valid contract. Rule 6 of the DPDP Rules further requires appropriate provisions in the contract between the Data Fiduciary and Data Processor for implementing reasonable security safeguards. Accordingly, businesses should review their existing SaaS agreements, cloud service agreements, outsourcing contracts and data processing agreements and check that they cover the following: ### A. Purpose and scope of processing The agreement should clearly identify the categories of personal data being processed, the purposes of processing, the nature of the services and the permitted use of the data. The Data Processor should not use the information for purposes beyond the scope of the authorised engagement. ### B. Data security obligations Contracts should specify the technical and organisational safeguards that the service provider is required to implement. These may include encryption, access controls, authentication mechanisms, data masking, security monitoring and appropriate backup arrangements. ### C. Subcontracting and onward transfers Where a SaaS provider or outsourcing partner engages additional service providers or subcontractors, the agreement should address the circumstances in which such engagement is permitted, the applicable approval or notification requirements and the responsibility for ensuring appropriate data protection safeguards throughout the processing chain. ### D. Personal data breach reporting The agreement should establish clear incident reporting procedures, including timelines for notifying the Data Fiduciary, cooperation in investigating incidents, preservation of relevant records and assistance with regulatory reporting obligations. ### E. Data retention and deletion The parties should specify the circumstances in which personal data may be retained, the applicable retention periods and the process for securely deleting or returning data upon completion or termination of the engagement, subject to applicable legal retention requirements. ### F. Audit and compliance rights The Data Fiduciary should consider incorporating appropriate audit, inspection and compliance verification rights to assess whether the service provider is adhering to its contractual and statutory obligations. ### G. Business continuity and data portability Cloud and outsourcing agreements should address data availability, backup arrangements, disaster recovery, business continuity and the ability to retrieve or migrate personal data if the service provider discontinues its services or the contractual relationship is terminated. These provisions matter most where a business’s operations depend on a single overseas cloud provider or technology platform. A well-drafted agreement can reduce operational disruption and provide contractual recourse where the service provider fails to meet its obligations. ## Data Security and Breach Management in Offshore Processing The geographical location of a Data Processor does not reduce the Data Fiduciary’s data security obligations. Section 8(5) of the DPDP Act requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. This responsibility extends to processing undertaken on their behalf by Data Processors. Rule 6 of the DPDP Rules elaborates on these safeguards and identifies measures including: - Encryption, obfuscation, masking or tokenisation of personal data; - Appropriate access controls for computer resources used by the Data Fiduciary or Data Processor; - Logs, monitoring and review mechanisms to detect unauthorised access; - Backup arrangements to ensure continued processing where data availability is compromised; - Retention of relevant logs and personal data for one year, subject to other applicable legal requirements; and - Appropriate contractual provisions requiring Data Processors to implement reasonable security safeguards. Rule 7 further establishes the framework for intimating personal data breaches to affected Data Principals and the Data Protection Board of India. For organisations using offshore service providers, contractual incident reporting timelines, escalation mechanisms and cooperation obligations need to match the Data Fiduciary’s statutory responsibilities. Businesses should therefore assess whether their overseas vendors can promptly identify, investigate and report security incidents and provide the information required for regulatory compliance. ## Sector-Specific Data Localisation and Transfer Restrictions The DPDP Act does not impose a blanket requirement that all personal data of Indian individuals must be stored within India. However, Section 16(2) expressly preserves the applicability of other Indian laws that provide a higher degree of protection or impose additional restrictions on transfers of personal data outside India. This matters most in regulated sectors. - **Banking and payments:** The Reserve Bank of India’s directions on storage of payment system data require payment system operators to store the entire payment system data in systems located in India, subject to the treatment prescribed for the foreign leg of cross-border transactions. Businesses involved in payment processing must therefore examine these requirements independently of the DPDP framework. - **Telecommunications:** The telecommunications regulatory framework includes specific requirements concerning the handling and storage of subscriber and network-related information. The applicable obligations must be assessed based on the nature of the entity, the information involved and the relevant regulatory directions. - **Insurance and financial services:** Regulated entities may be subject to additional requirements governing information security, outsourcing, confidentiality and data management. These obligations may affect the extent to which particular processing activities can be undertaken through overseas service providers. A business therefore cannot rely solely on the general transfer framework under Section 16 when evaluating whether a particular international processing arrangement is permissible. The applicable sector-specific regulatory requirements must also be examined. ## Additional Considerations for Significant Data Fiduciaries The DPDP Act imposes additional obligations on entities notified as Significant Data Fiduciaries (SDFs) under Section 10. Rule 13 of the DPDP Rules requires SDFs to undertake periodic Data Protection Impact Assessments and audits, along with other specified compliance measures. Rule 13(4) also requires an SDF to implement measures ensuring that personal data specified by the Central Government, based on the recommendations of a committee constituted for this purpose, is processed subject to a restriction that the specified personal data and the traffic data pertaining to its flow are not transferred outside India. This introduces the possibility of targeted data localisation obligations for specified categories of personal data processed by SDFs, rather than a general localisation requirement applicable to every Data Fiduciary. For large technology companies, digital platforms and other businesses that may be notified as SDFs, data architecture and vendor selection therefore become compliance decisions. Organisations should maintain sufficient visibility over the location of their data, the infrastructure used for processing and the access arrangements available to overseas service providers. ## Preparing for the DPDP Framework: Practical Steps for Businesses With the substantive provisions of the DPDP Act and Rules scheduled to become operational in May 2027, businesses have time to review their existing data processing arrangements before the new framework takes effect. Organisations engaging overseas SaaS vendors, cloud service providers and outsourcing partners should consider the following measures: 1. **Map cross-border data flows:** Identify the categories of personal data collected, the purposes for which it is processed, the countries in which it is stored and the locations from which it can be accessed. 2. **Review existing vendor agreements:** Examine SaaS contracts, cloud service agreements, outsourcing arrangements and data processing agreements to identify gaps in security, confidentiality, breach reporting, subcontracting and deletion obligations. 3. **Assess sector-specific requirements:** Determine whether RBI, telecommunications, insurance or other applicable regulatory requirements impose additional restrictions on the proposed processing arrangement. 4. **Strengthen vendor due diligence:** Evaluate the security practices, data management policies, subcontracting arrangements and business continuity capabilities of overseas service providers. 5. **Establish breach response mechanisms:** Ensure that overseas vendors can promptly notify the Indian Data Fiduciary of incidents and cooperate with investigations and regulatory reporting. 6. **Plan for potential transfer restrictions:** Maintain the ability to identify and segregate personal data processed in different jurisdictions and evaluate alternative hosting or service arrangements where necessary. 7. **Review contractual exit mechanisms:** Ensure that agreements provide for data retrieval, migration, deletion and continued access to critical business information upon termination or disruption of services. These steps prepare organisations for the new framework and tighten the contracts and operations behind their existing international processing arrangements. ## Conclusion Cross-border data processing is routine for digital businesses, especially those relying on global SaaS platforms, cloud infrastructure and international outsourcing arrangements. India’s DPDP framework adopts a relatively permissive approach to international data transfers, but it does not remove the responsibilities that come with lawful processing, data security, vendor oversight and compliance with sector-specific restrictions. For Indian businesses, the question is not only whether personal data can leave the country. They also need to ensure that overseas service providers operate within clearly defined contractual boundaries and that the Data Fiduciary retains sufficient oversight over the processing activities undertaken on its behalf. A review of data processing agreements, cloud service contracts and outsourcing arrangements, supported by appropriate legal due diligence, can help businesses manage cross-border data protection risks and prepare for the implementation of the DPDP framework. ### Explore KSK Data Privacy Hub Free compliance tools and expert guidance covering 75+ jurisdictions. [Global Regulation Finder](/privacy-review/map/)[DPDPA Scorecard](/privacy-review/scorecard/)[DPDPA Guide](/privacy-review/guides/dpdpa/)[GDPR Guide](/privacy-review/guides/gdpr/)[Cross-Border Transfers](/privacy-review/guides/cross-border/) --- ## Office Locations - [New Delhi](https://ksandk.com/locations/top-corporate-law-firm-in-delhi/) (HQ): +91-11-41318190 | info@ksandk.com - [Mumbai](https://ksandk.com/locations/top-corporate-law-firm-in-mumbai/): 3 offices (Nariman Point, Lower Parel, Andheri) | mumbai@ksandk.com - [Bangalore](https://ksandk.com/locations/top-corporate-law-firm-in-bangalore/): bangalore@ksandk.com - [Chennai](https://ksandk.com/locations/chennai/): chennai@ksandk.com - [Hyderabad](https://ksandk.com/locations/hyderabad/): hyderabad@ksandk.com - [Pune](https://ksandk.com/locations/pune/): pune@ksandk.com - [Kochi](https://ksandk.com/locations/kochi/): kochi@ksandk.com ## Contact - [Contact Page](https://ksandk.com/contact-us/) - General: info@ksandk.com | +91-11-41318190 - WhatsApp: +91-7428567444 - [Privacy Statement](https://ksandk.com/privacy-statement/) - [Terms of Use](https://ksandk.com/terms-of-use/)