Cross-Border Data Transfers Under India's DPDP Act

Introduction

An Indian business sending personal data to a Singapore cloud region or a Frankfurt AI vendor wants one answer: is it allowed? Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), usually yes. The work lies in the exceptions: countries the government may close, a duty for designated businesses, and sector rules the Act leaves standing.

A data fiduciary decides why and how personal data is processed; a data processor processes it on the fiduciary's behalf. A significant data fiduciary (SDF) is a fiduciary the Central Government designates for heavier duties, considering factors such as the volume and sensitivity of its data.

Trayambic's checklist on vendor contracts for SaaS and GCCs and its GCC study cover contract clauses and the section 17(1)(d) non-resident exemption; neither is repeated here.

The legal position

Section 16: open unless closed

Section 16(1) allows the Central Government, by notification, to "restrict the transfer of personal data by a Data Fiduciary for processing" to a country or territory outside India. India does not approve destinations; it can only bar them. We found no such notification.

Section 16(2) preserves any Indian law that provides a higher degree of protection for, or restriction on, transfer of personal data outside India "in relation to any personal data or Data Fiduciary or class thereof". Section 38(1) keeps the Act additional to other laws. Section 16 commences on 13 May 2027.

Rule 15: foreign-State access

Rule 15 of the DPDP Rules, 2025 confirms that personal data may be transferred abroad, subject to any requirements the Central Government sets by general or special order about making it available to a foreign State, an entity it controls or its agency. The concern is the recipient's exposure to its own government, not the destination's privacy law. We found no such order.

Rule 13(4): the SDF exception

Rule 13(4) requires an SDF to ensure that personal data specified by the Central Government, on a committee's recommendation, is processed on condition that the data and the traffic data about its flow are not transferred outside India. The committee, under Rule 13(5), includes MeitY officials. This is the DPDP framework's only true localisation duty, and it is dormant: as far as we could find, no SDF has been designated, no committee constituted and no data specified. A law firm has reported that at a stakeholder meeting on 23 January 2026 MeitY proposed bringing the SDF transfer restriction into force early; nothing was notified, and we could not confirm the proposal from any MeitY document.

Reach: section 3(b)

Section 3(b) applies the Act to processing outside India that "is in connection with any activity related to offering of goods or services to Data Principals within the territory of India". A data principal is the person the data is about. A foreign vendor working for an Indian business is inside that reach, and under section 8(1) the fiduciary stays responsible for it.

Sector rules preserved by section 16(2)

These rules bind the regulated entity and reach its vendors by contract; Trayambic's telecom and SaaS studies cover them in detail. Trade law adds nothing yet: the India–UK Comprehensive Economic and Trade Agreement, in force since 15 July 2026, places no immediate data-flow obligation on India.

Analysis

What counts as a transfer

The Act does not define "transfer", but section 2(x) defines processing to include "disclosure by transmission, dissemination or otherwise making available". In our view a foreign engineer's remote access to a database hosted in Mumbai is therefore a transfer for processing abroad, though the disks never leave India. Likewise, a processor's onward transfer to its sub-processors is made on the fiduciary's behalf and counts as the fiduciary's. Neither point bites until a country is notified.

Do you need SCCs to send data out of India?

Indian companies receiving European data sign standard contractual clauses (SCCs) as importers, and many ask whether Indian data leaving India needs the same. In our view it does not, for four reasons.

1. 1.The DPDP Act has no transfer tool. Section 16 contains no adequacy finding, approved clauses, binding corporate rules or transfer consent. If the destination is not notified and no Rule 15 order applies, the Act asks nothing more of the transfer.
2. 2.Accountability stays in India. Section 8(1) keeps the fiduciary responsible for its processors, section 8(2) requires a contract, section 8(5) and Rule 6 require safeguards including processor contract terms, and section 3(b) reaches the vendor abroad. A data principal's remedies, grievance redressal under section 13 and then the Data Protection Board, run against the Indian fiduciary. SCCs give people rights against a foreign importer beyond the GDPR's reach; the DPDP Act instead keeps liability at home.
3. 3.GDPR transfer rules bind GDPR exporters. Article 44 places the Chapter V conditions on the controller and processor, and Decision (EU) 2021/914 defines the exporter as one whose processing is "subject to" the GDPR. An Indian fiduciary serving Indian patients is not, so sending their data to Europe is not a GDPR transfer from its side.
4. 4.The return leg is the vendor's concern. The European Data Protection Board's Guidelines 05/2021 treat an EU processor's re-transmission of data to a controller outside the EU as a transfer (Example 10). An EU vendor may therefore ask its Indian client to sign Module Four of the SCCs (processor to controller). Signing costs little, but it serves the vendor's GDPR position and does not replace the section 8(2) contract.

The answer changes where the Indian business is itself subject to the GDPR, for example under Article 3(2) because it serves people in the EU; that data needs a Chapter V basis when it moves on.

Finally, a section 16(1) notification, Rule 15 order or Rule 13 specification could each close a route without Parliament.

Practical implications

Worked example: a diagnostics chain

A diagnostics chain with three laboratories and about 60 collection centres (figures illustrative) moves its laboratory system and image archive to a foreign cloud provider's Mumbai region, with disaster recovery in Singapore. An AI reporting vendor in Germany reads its chest X-rays and CT scans on servers rented in the United States and returns draft reports for the chain's radiologists to sign. No RBI, IRDAI or DoT rule covers patient-care data, so the DPDP Act and contracts do most of the work.

• Hidden transfers. The cloud provider's support engineers abroad can reach the Mumbai systems. In our view that is a transfer, so it goes into the register and the contract.
• Onward transfers. The German vendor's US hosting is a sub-processor. The chain approves it in writing and flows its own terms down.
• Sector rules that still bite. The chain's accounting ledger runs on a foreign software service, so a daily back-up sits in India. Security logs feed a monitoring tool in Singapore, but a complete 180-day set stays in Mumbai.
• Future switches. Singapore, Germany and the United States are not notified, no Rule 15 order exists and the chain is not an SDF. Its exit plan shows the Singapore copy and the AI workload could be brought home.
• Contracts. Both vendors work under section 8(2) contracts with Rule 6 terms, incident notice within hours, deletion at the end and no model training on the chain's images without approval (Trayambic's article on AI training covers this).
• GDPR. The German vendor asks for Module Four SCCs for returning reports, and the chain signs. Nothing similar is needed for the cloud provider.

Transfer decision table

Key takeaways

The DPDP Act is the least restrictive layer of Indian transfer law; today's limits come from sector rules that section 16(2) keeps alive. In our view, Indian businesses do not need GDPR-style clauses to send data out, because the Act keeps accountability with the fiduciary in India. They need a dataset register, processor contracts that work abroad, and the ability to bring data home if the government closes a route.

• Section 16(1) is a negative list: transfers abroad are allowed unless the Centre notifies a country, and none was notified as of October 2026.
• Rule 15 lets the Centre set requirements on data reaching foreign States, and Rule 13(4) can keep committee-specified data of SDFs in India; neither had been used as of October 2026.
• Section 16(2) preserves stricter sector rules, including RBI payments and outsourcing, IRDAI hosting, the telecom licence, CERT-In logs, the Companies (Accounts) Rules and MeitY empanelment; SEBI's CSCRF localisation is in abeyance.
• In our view remote access from abroad and processors' onward transfers count as transfers, so they belong in the transfer register.
• In our view Indian fiduciaries need no SCCs to send data abroad, because the DPDP Act keeps accountability with them; an EU vendor may still ask for Module Four SCCs for its own GDPR compliance.