Back to Module
2 of 3|Cross Border Data Transfer
reading 15 min•Transfer Rules
Cloud Storage
Storing Indian data on foreign cloud servers.
🎯 Learning Objectives
- ▸ Understand how cloud storage interacts with the DPDPA
- ▸ Analyze the risks of foreign cloud servers
The Cloud Reality
If an Indian startup uses AWS US-East-1 to store customer data, that is a cross-border transfer. Under the DPDPA, this is permissible by default. However, the startup must ensure it has a valid Data Processing Agreement (DPA) with AWS and that the data is encrypted.
Even if data is stored in the cloud, the Data Fiduciary remains fully responsible for it. If AWS suffers a breach, the Indian company will face the consequences under the DPDPA.
📖 Glossary
- Cloud Server
- A virtual server hosted by a cloud provider that can be located anywhere in the world.
- AWS US-East-1
- One of the primary data centers of Amazon Web Services, located in Virginia, USA.
🔑 Key Takeaways
- You can use foreign cloud servers unless the country is restricted.
- You remain liable for the data, even if it is stored abroad.
- You must ensure the cloud provider has adequate security.
📚 Further Reading
- DPDPA Section 16 — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...