Unlike GDPR's adequacy requirement, India permits cross border flow to ALL jurisdictions unless specifically restricted by Central Government notification.

Restricted Jurisdictions (Expected)

Jurisdictions with inadequate rule of law, history of surveillance, or no data protection framework may be notified on the negative list.

Counsel's Note

Organizations must maintain transfer impact assessments (TIAs) and implement appropriate safeguards even for permitted jurisdictions. The negative list may be updated without prior notice.

Transfer Mechanism Comparison

Jurisdiction	Statute	Transfer Stance	Primary Mechanism	Key Friction	Action
🇮🇳India	DPDPA 2023	Negative-List Sovereignty	Section 16 Notification	Flow permitted unless specifically restricted. Consent Artifact required.	View
🇪🇺European Union	GDPR Art. 45	Rights-Based Adequacy	Adequacy Decisions / SCC 2.0	Requires "Essential Equivalence" in fundamental rights protection.	View
🇸🇦Saudi Arabia	PDPL	Infrastructure Dominant	SDAIA Audit License	Localized residency for national security datasets.	View
🇦🇪UAE	Federal Law 45	Dual-Track (Onshore/DIFC)	UAE Data Office / BCR	DIFC offers GDPR-aligned common law framework.	View
🇬🇧United Kingdom	UK GDPR	Pro-Innovation Contextual	IDTA / Adequacy Bridge	EU adequacy valid until 2025. Own adequacy list maintained.	View
🇸🇬Singapore	PDPA	Interoperable Hub	APEC CBPR / ASEAN MCCs	Trusted Partner certification for regional mutual recognition.	View

Ready to Map Your Cross-Border Compliance?

Access our comprehensive DPDPA + Rules mapping for detailed section-by-section guidance.

Access DPDPA Codex