Cross-Border Transfer of Data
Cross-border data transfers under the DPDP Act 2023 are governed by Section 16 � a single, powerful provision that gives the Central Government the right to restrict transfers to specific countries by notification. Unlike GDPR's adequacy approach, DPDP uses a blacklist approach � transfers are allowed by default unless restricted. This guide explains Section 16, the government's power, comparison with GDPR, sectoral localisation, and real-world scenarios.
Important: DPDP Uses a Blacklist, Not a Whitelist
The DPDP Act does NOT require "adequate protection" or "standard contractual clauses" or "Board approval" for every transfer. Instead, transfers are allowed by default, unless the government restricts them. This is a significantly simpler approach than GDPR.
Key Concepts at a Glance
Section 16: The Core Provision
Section 16 of the DPDP Act empowers the Central Government to restrict the transfer of personal data to specific countries or territories by notification. By default, transfers are allowed unless restricted.
Blacklist Approach
Unlike GDPR's "adequacy" approach (whitelist), DPDP uses a "blacklist" approach. Transfers are allowed by default, unless the government specifically restricts them.
Government Discretion
The government can restrict transfers based on factors like national security, public interest, and risk to Data Principals. The first list of restricted countries has not yet been notified.
Sectoral Localisation
The DPDP Act does not override sectoral localisation requirements. RBI, IRDAI, SEBI, and other regulators can still mandate data localisation for specific sectors.
Consent & Notice
If processing is based on consent, the notice must mention that data may be transferred outside India. The consent must cover this. If based on legitimate use, consent is not required.
Penalties for Violation
Transferring data to a restricted country is a violation of the DPDP Act. It can attract penalties up to ?50 crore for general non-compliance, plus remedial directions.
1. Section 16 � The Core Provision
Section 16 of the DPDP Act is deceptively short � a single sub-section. But it is one of the most consequential provisions in the Act. It gives the Central Government the power to restrict transfers of personal data to specific countries or territories by notification.
Crucially, the provision is enabling, not prohibitive. By default, transfers are allowed. The government can restrict them if it considers it necessary � for national security, public interest, or protection of Data Principals. This is a significant departure from GDPR's restrictive approach.
Power to Restrict
The Central Government may, by notification, restrict the transfer of personal data to specific countries or territories.
Conditions on Transfer
The government may also impose conditions on transfers, such as requiring adequacy assessments or contractual safeguards.
Default Allowance
By default, transfers are allowed. The restriction is an exception, not the rule. This is a significant departure from GDPR.
Factors for Restriction
The government can consider factors like national security, public interest, risk to Data Principals, and reciprocity.
Notification Process
Restrictions must be imposed by notification, which is a formal legal instrument published in the Official Gazette.
No Judicial Review Bar
Notifications can be challenged in court on grounds of arbitrariness or violation of fundamental rights. Judicial review is not barred.
2. DPDP vs. GDPR on Cross-Border Transfers
Understanding the difference between DPDP and GDPR is essential for multinational companies operating in both jurisdictions:
| Aspect | DPDP | GDPR |
|---|---|---|
| Approach | Blacklist (allowed unless restricted) | Whitelist (restricted unless adequate) |
| Default Position | Transfers allowed by default | Transfers restricted by default |
| Mechanism | Government notification restricting specific countries | Adequacy decision by EU Commission; SCCs; BCRs |
| Localisation | No general localisation mandate, but sectoral laws apply | No general localisation mandate (GDPR prohibits it) |
| Discretion | Broad government discretion | Structured, rule-based framework |
| Certainty | Less certainty until list is notified | High certainty due to adequacy decisions |
Bottom line: DPDP is simpler and more permissive than GDPR, but it gives the government broad discretion to restrict transfers. For now, most transfers are allowed. The situation will evolve once the restricted countries list is notified.
3. Sectoral Localisation Requirements
The DPDP Act does not override sectoral localisation requirements. Specific regulators continue to mandate local storage for specific data types:
RBI Payment Data
RBI mandates that payment system data be stored only in India. This applies to all payment system operators, including foreign companies operating in India.
IRDAI Insurance Data
IRDAI requires insurers to maintain insurance data in India. This covers policyholder data, claims data, and related records.
SEBI Securities Data
SEBI requires securities market data to be maintained in India. This includes trading data, KYC records, and investor data.
Telecom Data
Department of Telecommunications (DoT) regulations require telecom data to be maintained in India, subject to certain exceptions.
Health Data
The Health Data Management Policy (under ABDM) and other health regulations impose data localisation requirements for health data.
Government Data
Government departments and public sector entities may have specific data localisation requirements for classified or sensitive data.
4. Real-World Scenarios
To make this concrete, here are six scenarios illustrating what is and is not allowed:
Scenario A: SaaS Company Using US Cloud
Allowed (likely)An Indian SaaS company stores customer data on AWS US servers. Under DPDP, this is allowed by default (unless the US is on the restricted list). The company must ensure the notice mentions cross-border transfer, and the customer consent covers it.
Scenario B: Fintech Using Payment Data
Not allowed (RBI)A fintech company processes payment data and wants to store it in Singapore. Under RBI regulations, payment data must be stored in India. DPDP does not override this � the fintech must comply with RBI rules.
Scenario C: Transfer to Restricted Country
Not allowedAn e-commerce company transfers customer data to a country that has been notified as restricted by the government. This is a violation of Section 16 and can attract penalties up to ?50 crore.
Scenario D: Healthcare Data to EU
Allowed (likely)A hospital transfers patient data to a EU-based research partner. This is allowed under DPDP by default, provided consent covers it and the EU is not on the restricted list. GDPR applies to the EU partner.
Scenario E: HR Data to Global Payroll
Allowed (likely)A multinational company processes employee data for global payroll on a US-based system. This is a legitimate use under Section 7(f) (employment), and is allowed unless the US is restricted.
Scenario F: Marketing Data to Unknown Vendor
RiskyA company transfers marketing data to an offshore vendor without checking the restricted list. If the vendor is in a restricted country, this is a violation. Consent alone does not save it.
5. 10-Point Compliance Checklist
If your organisation transfers personal data outside India, here is a practical checklist:
6. What's Next for Cross-Border Transfers?
The DPDP Act's cross-border framework is still evolving. The restricted countries list has not been notified. The Rules under the Act are being finalised. Once notified, the framework will become more concrete.
The government has indicated that it will adopt a calibrated approach � restricting transfers only where necessary for national security, public interest, or protection of Data Principals. This suggests that most transfers will continue to be allowed, but the government retains the right to restrict specific countries.
For businesses, this means building flexibility into their data architecture. Do not assume that a specific country will always be allowed. Monitor government notifications, conduct periodic reviews, and be ready to adapt if restrictions change.
For multinational companies, the key is to layer DPDP compliance on top of GDPR compliance. If you are already GDPR-compliant, you have most of the safeguards in place. DPDP adds a layer of government discretion � monitor it closely.
Shilpi Kulshrestha
Founder, BusinezExcellence | Corporate Law & Company Secretary Expert
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy governance, and AI compliance.
Frequently Asked Questions
What is Section 16 of the DPDP Act 2023?+
Section 16 deals with cross-border data transfers. It empowers the Central Government to restrict the transfer of personal data to specific countries or territories by notification. By default, transfers are allowed unless restricted.
Is data localisation mandatory under the DPDP Act?+
No, the DPDP Act does not mandate general data localisation. However, the government can restrict transfers to specific countries (a "negative list" or "blacklist" approach). Specific sectoral laws (like RBI regulations) may still require localisation.
How is DPDP different from GDPR on cross-border transfers?+
GDPR uses an "adequacy" approach � transfers are allowed only to countries deemed adequate by the EU Commission, or with safeguards like SCCs. DPDP uses a "blacklist" approach � transfers are allowed by default unless the government restricts them. DPDP is simpler but gives the government broad discretion.
Can the government ban transfers to specific countries?+
Yes. Section 16 empowers the Central Government to restrict transfers to specific countries or territories by notification. The government can also impose conditions on transfers. The first list of restricted countries has not yet been notified.
What happens if I transfer data to a restricted country?+
Transferring data to a restricted country is a violation of the DPDP Act. It can attract penalties under the Schedule � up to ?50 crore for general non-compliance. The Data Protection Board can also issue directions and order remedial measures.
Do I need consent for cross-border transfers?+
Yes, if the processing is based on consent, the notice must mention that the data may be transferred outside India. The consent must cover this. If the processing is based on a legitimate use under Section 7, consent is not required, but the transfer still must comply with Section 16.
What about sectoral localisation requirements?+
The DPDP Act does not override sectoral localisation requirements. For example, RBI's mandate to store payment data in India, IRDAI's insurance data rules, and SEBI's regulations for securities data continue to apply.
When will the restricted countries list be notified?+
The government has not yet notified the list of restricted countries. The Rules under the DPDP Act are still being finalised, and the list is expected to be published once the Rules are notified. The government has indicated that it will adopt a calibrated approach.
Related Topics
Key Provisions
Chapter-wise overview of the Act.
Obligations of Data Fiduciaries
What businesses must do to comply.
Penalties & Offences
Penalties for unlawful transfers.
Country Explorer
Compare data protection laws globally.
GDPR vs DPDP
Detailed comparison of the two laws.
DPDPA Complete Guide
End-to-end guide to the Act.
Transferring data outside India?
Our compliance experts can help you assess your cross-border transfer risks, design a defensible data architecture, and prepare for potential government notifications.
Disclaimer: This page is for educational and informational purposes only. It is not legal advice. The restricted countries list has not yet been notified, and the framework will evolve. For advice on your specific situation, consult a qualified legal professional.