Cross-Border Restriction Committee (R.15)

Rule 15 of the DPDP Rules sets out the factors and criteria the Central Government must consider when restricting cross-border transfers. Rule 15 itself empowers the Central Government to notify restrictions; it does not formally establish the structure of a committee within the rule. The 'Committee' is an advisory body referenced in Rule 13 (for SDF assessment) and operates as an internal MeitY mechanism. The final decision to restrict transfers rests with the Central Government, supported by the criteria laid down in Rule 15.

When evaluating jurisdictions, the following factors are considered: (a) the legal framework of the recipient country for data protection; (b) international agreements and arrangements; (c) security of data in transit and at rest in the recipient country; (d) the nature and sensitivity of data being transferred; (e) Reciprocity - whether the foreign state allows data flow to India (a primary Rule 15(1) factor); and (f) any other factors deemed relevant. This multi-factor assessment ensures that restrictions are evidence-based and consider both legal and practical aspects of data protection in recipient jurisdictions.

A critical feature of R.15 is its extended scope. Restrictions apply not only to Data Fiduciaries but also to Consent Managers and Data Processors. This means that even if a Data Processor is processing data on behalf of a foreign entity, transfers to restricted jurisdictions would be prohibited. This extension addresses potential circumvention through processor chains and ensures comprehensive coverage of cross-border data flows.

Rule 15 comes into force 18 months after the notification of the Rules (~May 14, 2027). The actual restriction notifications may follow at any time after R.15 becomes operative. Organisations should begin preparing by: (a) mapping all cross-border data flows; (b) identifying jurisdictions to which data is transferred; (c) assessing contractual arrangements with overseas processors; and (d) establishing mechanisms to quickly redirect data flows if restrictions are imposed.