Businesses increasingly depend on global cloud infrastructure, international group companies, overseas vendors and remote service providers. As a result, cross-border data transfers have become an important legal and operational issue for organisations operating in India. Personal data may move from an Indian customer to a cloud server overseas, from an Indian subsidiary to its foreign parent company, or from an Indian business to an international analytics or support provider.

India's regulatory framework is evolving through the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The framework generally permits international transfers, while giving the Central Government power to restrict transfers to specified countries or territories. However, this does not mean businesses can ignore sector specific localisation rules, contractual obligations, security requirements or foreign privacy laws.

Understanding these overlapping requirements is essential for organisations managing international data flows.

What Are Cross Border Data Transfers?

A cross border data transfer occurs when personal data is transferred, accessed, stored or otherwise processed across national boundaries. The concept can cover more than simply sending a database from India to another country. For example, an Indian company may use a cloud provider whose servers are located overseas. An Indian subsidiary may allow its parent company in another country to access employee information. A software provider may send customer information to an overseas support centre. Even remote access by an overseas service team can create an international data flow depending on the circumstances and applicable law. The legal assessment therefore needs to examine the complete data journey rather than only the physical location of the primary database.

India's Legal Framework for International Data Transfers

The principal framework is the Digital Personal Data Protection Act, 2023, commonly referred to as the DPDP Act. The Act was enacted on 11 August 2023 and establishes India's general framework for processing digital personal data. Section 16 is particularly important for international transfers. It adopts a relatively permissive model. A Data Fiduciary may transfer personal data outside India unless the Central Government restricts transfer to a particular country or territory through notification.

This approach differs from the European Union model, where transfers to third countries are governed by a more structured adequacy and safeguards framework. The DPDP Rules, 2025 provide additional detail. Rule 15 permits personal data processed under the Act to be transferred outside India, subject to requirements the Central Government may specify concerning making such data available to a foreign State or an entity under the control of, or an agency of, such State. Businesses should therefore avoid treating international transfer as automatically unrestricted. The general position is permissive, but restrictions and other legal requirements may apply.

Is Cross Border Data Transfer Permitted Under the DPDP Act?

Yes. The DPDP Act does not impose a blanket prohibition on transferring personal data outside India. Its approach is commonly described as a negative list model. Instead of requiring every destination to be approved before a transfer can occur, the law allows transfers unless the Central Government restricts a destination. This is an important distinction for multinational companies. The DPDP Act does not currently create a general requirement for organisations to use Standard Contractual Clauses merely because personal data leaves India. However, Section 16 also preserves the operation of other Indian laws offering a higher degree of protection or imposing greater restrictions on international transfers. Consequently, compliance cannot stop with checking the DPDP Act.

Current Enforcement Position in India

A critical point for businesses is the phased commencement of the DPDP framework. The DPDP Act was enacted in 2023, while the final DPDP Rules were notified in November 2025. MeitY has published the Rules together with the official enforcement timeline. The substantive provisions relating to international transfers are part of the eighteen month implementation phase. Section 16 and Rule 15 are expected to become operational in May 2027 based on the commencement notifications issued in November 2025. Current legal commentary identifies 13 May 2027 as the relevant date. This phased approach should not be misunderstood as a reason to delay compliance planning. Businesses with international data flows need time to identify destinations, review vendors, update agreements, assess sector specific requirements and establish internal controls.

Does India Require Data Localisation?

The DPDP framework should not be confused with a universal data localisation requirement. The general DPDP position allows international transfers unless the Government restricts particular destinations. It does not require every category of personal data to remain physically stored in India. However, localisation requirements can arise from other Indian laws and regulatory frameworks. The Reserve Bank of India provides an important example. Its Storage of Payment System Data direction requires payment system providers to store the entire payment system data in systems located in India. The RBI also provides specific treatment for the foreign component of cross border transactions. Therefore, an organisation should never ask only whether the DPDP Act permits an overseas transfer. It should also ask whether a sector specific regulator imposes a separate storage, access or processing requirement. This distinction is especially relevant to financial services, payments, insurance, telecommunications, healthcare and other regulated industries.

How Sector Specific Laws Affect International Transfers

Section 16 operates alongside other applicable Indian legislation and regulatory requirements. For example, payment businesses need to consider RBI requirements concerning payment data. The RBI has clarified that while certain payment processing may occur outside India, prescribed payment data must continue to be stored in India. An organisation operating in a regulated sector may therefore face a layered compliance structure. The DPDP Act may permit an international transfer while another regulation restricts where particular information can be stored or processed. This makes a data flow assessment more useful than a simple country based checklist.

What Businesses Should Check Before Transferring Data Overseas

The first step is to identify the data being transferred. Organisations should determine whether the information constitutes personal data under the applicable framework and identify the individuals concerned. The next step is to establish the purpose of the transfer. A transfer for payroll administration, customer support, cloud hosting, fraud monitoring and international analytics may each involve different recipients and different legal risks. Businesses should then identify the destination country, recipient organisation, processing location and any onward transfer arrangements. Vendor contracts deserve particular attention. Where an overseas service provider processes personal data on behalf of an Indian Data Fiduciary, the agreement should clearly define the processing relationship, permitted purposes, confidentiality obligations, security measures, assistance requirements and incident handling responsibilities. The organisation should also understand whether the overseas provider can appoint sub processors and whether data may be transferred to additional jurisdictions.

Why Data Mapping Matters

A strong cross border compliance programme begins with accurate data mapping. Many organisations know which software platforms they use but do not know precisely where personal data travels within those systems. A customer relationship management platform may involve servers in several countries. An international payroll provider may allow access from multiple jurisdictions. A cloud backup may replicate information automatically. A data map should therefore record the source of the information, categories of personal data, purpose of processing, recipient, destination country, storage location, access location, retention period and applicable legal restrictions. This information creates an evidence trail for compliance decisions and helps organisations respond quickly when laws or government restrictions change.

Contractual Safeguards for Overseas Vendors

Indian law should be considered alongside the contractual framework governing an international relationship. A data processing agreement can establish practical controls even where Indian law does not prescribe a specific transfer instrument. The agreement can address confidentiality, security, permitted processing, deletion, breach reporting, audit rights, subcontracting and assistance with individual rights. For multinational organisations subject to the GDPR or another foreign privacy regime, additional transfer mechanisms may be necessary. Standard Contractual Clauses, Binding Corporate Rules or other recognised mechanisms may become relevant under the law governing the outbound transfer. These mechanisms should not be described as mandatory DPDP transfer tools. Their relevance usually comes from another applicable legal regime.

GDPR and Indian Cross Border Transfers

The DPDP framework differs materially from the GDPR. The GDPR generally regulates international transfers through adequacy decisions and specified safeguards. These include Standard Contractual Clauses and Binding Corporate Rules, alongside other mechanisms under Chapter V. India instead uses a more permissive statutory model under Section 16. Transfers are generally allowed unless the Central Government restricts particular countries or territories. This difference matters for Indian businesses serving European customers. An Indian company may satisfy the Indian transfer framework while still needing to meet GDPR requirements for data originating from the European Economic Area. The correct approach is therefore to identify every applicable jurisdiction rather than assume one country's compliance automatically satisfies another.

What About Overseas Cloud Providers?

Using an international cloud provider does not automatically mean a business is violating Indian data protection law. The legal assessment depends on the type of data, processing arrangement, storage location, access arrangements, applicable sectoral rules and any government restrictions. Businesses should obtain sufficient information from cloud providers about data residency, replication, remote access, subcontractors, security controls and deletion practices. A cloud contract should also be reviewed from a privacy perspective rather than treated purely as an information technology agreement.

International Transfers and Data Security

Cross border compliance is closely connected with information security. Moving personal data to another jurisdiction can increase exposure to unauthorised access, government requests, security incidents and uncontrolled onward transfers. Organisations should therefore apply appropriate technical and organisational safeguards throughout the data lifecycle. Encryption, access controls, authentication, logging, monitoring, data minimisation and secure deletion can reduce risk. The appropriate controls depend on the nature and volume of data and the potential consequences of misuse. Security should also be considered when selecting international processors. A transfer to a permitted destination does not make an insecure processing arrangement acceptable.

What Happens If a Data Breach Occurs Overseas?

An international incident can create obligations in more than one jurisdiction. An organisation should maintain a documented incident response process covering identification, containment, investigation, assessment, notification and remediation. The DPDP framework introduces breach related obligations for Data Fiduciaries, while other laws may impose separate reporting requirements. CERT In directions also require specified cyber incidents, including data breaches and data leaks, to be reported within the prescribed six hour period from noticing the incident. Organisations should therefore assess the applicable cyber security reporting requirements separately from privacy obligations. The existence of an overseas processor does not necessarily remove the Indian organisation's responsibility. Contracts should clearly allocate operational responsibilities and escalation procedures.

Practical Compliance Roadmap for Cross Border Data Transfers

Organisations preparing for the DPDP framework should begin with a complete inventory of international data flows. The next stage is to classify each transfer according to the type of information, purpose, recipient, destination and applicable law. Businesses should then identify sector specific localisation requirements and assess whether the destination could become subject to a future government restriction. Vendor agreements should be reviewed and updated where necessary. Privacy notices should accurately describe relevant processing activities. Security controls should be tested, and internal teams should understand how international data flows are approved and monitored. A transfer register can provide a central record of these decisions. It should be reviewed periodically rather than treated as a one time exercise. Organisations with complex international structures may also benefit from specialist cross-border data protection services when conducting transfer assessments, vendor reviews and international privacy compliance exercises.

What Should Multinational Companies Do Before 2027?

The remaining transition period should be used to build operational readiness. Indian subsidiaries should identify all transfers to parent companies, affiliates and global service providers. Indian companies serving overseas customers should determine whether foreign privacy laws apply alongside Indian requirements. Organisations should also review contracts for cloud services, customer relationship management platforms, payroll systems, marketing technology, analytics tools and outsourced support. A robust compliance programme should be capable of answering five basic questions quickly: what personal data leaves India, why it leaves, where it goes, who can access it and which law permits or restricts the transfer. Maintaining this evidence will become increasingly important as international data governance develops. Where cross border arrangements form part of a broader corporate structure, corporate compliance legal support can help align contractual, regulatory and governance requirements across different business functions.

Penalties and Compliance Risk

The DPDP Act provides significant financial penalties for certain breaches. The Schedule includes penalties of up to ₹250 crore for specified failures relating to security safeguards, while other categories carry lower maximum amounts. The financial exposure is only one part of the risk. Non compliant transfers can also create contractual disputes, regulatory scrutiny, customer concerns, operational disruption and difficulties during mergers, acquisitions or international due diligence. For this reason, cross border data governance should be treated as part of enterprise risk management rather than as a narrow privacy function.

Conclusion

Cross border data transfers are becoming a central issue for Indian businesses operating in a global digital economy. India's DPDP framework takes a comparatively permissive approach by allowing international transfers unless particular destinations are restricted. Yet this does not create a simple free transfer regime. Businesses must consider sector specific localisation rules, contractual controls, security safeguards, overseas privacy laws and future government notifications. The distinction between permission to transfer and responsibility to govern the transfer is especially important.

With the substantive transfer framework moving towards implementation in 2027, organisations should use the transition period to map international data flows, assess overseas vendors, strengthen contracts and establish clear governance processes. A well documented transfer framework can help businesses support international operations while maintaining compliance with India's evolving data protection landscape.

Frequently Asked Questions (FAQs)

Q1. Is cross border data transfer allowed under Indian law?

Yes. The DPDP Act generally permits transfer of personal data outside India, subject to restrictions which may be imposed by the Central Government and any stricter requirements under other applicable Indian laws.

Q2. Does the DPDP Act require all personal data to be stored in India?

No. The DPDP Act does not establish a universal data localisation requirement. However, sector specific laws and regulations may impose storage or processing restrictions for particular categories of data.

Q3. What is Section 16 of the DPDP Act?

Section 16 establishes India's principal statutory framework for transfer of personal data outside India. It permits transfers subject to restrictions which the Central Government may notify.

Q4. What is Rule 15 of the DPDP Rules 2025?

Rule 15 deals with transfer of personal data outside India and allows such transfers subject to requirements which the Central Government may specify concerning making data available to a foreign State or related entities.

Q5. Are Standard Contractual Clauses mandatory under Indian DPDP law?

The DPDP Act does not establish GDPR style Standard Contractual Clauses as a general mandatory mechanism for every international transfer. SCCs may nevertheless be required where another applicable privacy law, such as the GDPR, governs the transfer.

Q6. Can Indian companies use overseas cloud servers?

Generally, yes, subject to the DPDP framework, applicable sector specific requirements, contractual obligations, security requirements and any restrictions notified by the Central Government.

Q7. Do sector specific localisation rules still apply?

Yes. The DPDP framework does not eliminate stricter requirements imposed by other Indian laws. RBI payment data requirements provide an important example.

Q8. When will the main cross border transfer provisions become operational?

Section 16 of the DPDP Act and Rule 15 of the DPDP Rules are part of the eighteen month implementation phase and are expected to become operational on 13 May 2027 based on the November 2025 commencement notifications.

Q9. Does an overseas vendor become responsible for DPDP compliance?

The contractual relationship and statutory allocation of responsibilities must be examined carefully. A Data Fiduciary remains responsible for its obligations under the DPDP framework, while processors should be governed through appropriate contractual and security controls.

Q10. What should a business do before transferring personal data abroad?

The business should identify the data, purpose, recipient and destination, check applicable Indian and foreign laws, review sector specific restrictions, assess the vendor, establish contractual safeguards and maintain records of the transfer decision.

This update was released on 09 Sep 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.