Cross-Border Data Transfer

Section 16 of the DPDPA adopts a "negative list" approach to cross-border data transfers - personal data may be transferred to any country or territory that has not been specifically restricted by the Central Government through notification. This is fundamentally different from the GDPR's "positive list" (adequacy) approach, where transfers are restricted by default and permitted only to countries deemed adequate or through specific transfer mechanisms. The DPDPA presumes permissibility and restricts only where necessary.

Under Section 16(1), the Central Government may, by notification, restrict the transfer of personal data to specific countries or territories. Until such notifications are issued, transfers are permitted to all jurisdictions. As of the current date, no countries have been placed on the restricted list. This means cross-border transfers are currently unrestricted under the DPDPA, though this could change as the Government exercises its notification powers. The DPDP Rules (R.15) establish a committee-based framework for evaluating and recommending restrictions, providing a structured process for the Government's decision-making.

The final notified Rule 15 (2025) is titled 'Transfer of personal data outside the territory of India' and lists the evaluative criteria the Central Government must consider before notifying a restriction, rather than establishing a static 'committee framework.' The 'Committee' is an internal advisory mechanism, not a separate regulatory framework defined in Rule 15. Key criteria the Central Government considers include: • Evaluating the data protection standards of other jurisdictions • Assessing geopolitical and national security considerations • Considering trade and economic implications • Reciprocity - whether the other country allows data to flow back to India • Recommending specific countries or territories for restriction This criteria-based approach provides a degree of procedural rigour, while the final decision rests with the Central Government.

The current permissive regime means organisations can continue cross-border data flows without specific transfer mechanisms. However, prudent compliance requires: 1. Monitoring government notifications for any new restrictions 2. Maintaining contractual safeguards with overseas processors 3. Ensuring the Data Fiduciary's obligations (security, breach notification, erasure) extend to overseas processing 4. Documenting cross-border transfer decisions as part of accountability Organisations should not assume the current permissive regime will continue indefinitely. Building in contractual protections now provides resilience against future restrictions.

The GDPR provides multiple transfer mechanisms: • Adequacy decisions (Article 45) • Standard Contractual Clauses (Article 46(2)(c)) • Binding Corporate Rules (Article 47) • Derogations for specific situations (Article 49) The DPDPA's approach is simpler but less granular. While the DPDPA does not mandate SCCs, BCRs, or formal adequacy assessments, Section 8 of the Act requires every Data Fiduciary to ensure that the Data Processor (even those abroad) provides the same level of protection as the Act. In addition, Rule 14 and Rule 15 (as well as Section 16(2) of the Act) clarify that other Indian laws (e.g., RBI/SEBI localisation) take precedence and are not overridden by the DPDPA. For organisations subject to both GDPR and DPDPA, maintaining GDPR-compliant transfer mechanisms will satisfy the more relaxed DPDPA requirements.