Cross-Border Data Transfers Under DPDPA

Unlike GDPR's adequacy-based framework requiring positive determination before transfers, DPDPA adopts a negative list approach—transfers are permitted except to jurisdictions specifically restricted. This article examines the transfer framework, sectoral localisation requirements, and contractual safeguards.

Section 17 inverts the GDPR model. Rather than requiring positive adequacy determination, DPDPA permits transfers unless restricted by Central Government notification. As of current date, no countries appear on the restricted list. However, this permissive position may evolve based on geopolitical considerations, bilateral arrangements, and reciprocity assessments.

DPDPA operates alongside existing sectoral requirements. RBI Payment Data Localisation Circular mandates storing payment system data in India. IRDAI imposes insurance data restrictions. SEBI requires securities data localisation. Telecom licensing conditions impose additional constraints. Organisations must map all applicable regimes before approving international transfers.

Absent restrictions, prudent organisations implement contractual safeguards regardless. Standard Contractual Clauses adapted from GDPR templates, binding corporate rules for intra-group transfers, and processing agreements with third-party recipients establish baseline protections against future regulatory tightening.

The Government retains discretion to impose additional conditions including localisation for sensitive categories and periodic audit rights over foreign processors. Organisations should architect systems permitting rapid data repatriation if transfer restrictions materialise. Cloud infrastructure contracts should address regulatory change scenarios.