Cross-Border Data Transfer Under DPDPA

Yes, the DPDPA takes a permissive approach to cross-border transfers of personal information. Under Section 16(1), personal information may be transferred outside India for processing. However, Section 16(2) empowers the Central Government to restrict transfers to specific jurisdictions by notification. This means transfers are allowed by default to all countries unless the government explicitly restricts a particular jurisdiction. This approach differs significantly from the GDPR's adequacy-based model where transfers are restricted by default and only allowed to approved countries. Organisations must monitor government notifications to ensure they are not sending personal information to any newly restricted jurisdiction.

As of now, the Central Government has not yet published the specific list of restricted jurisdictions under Section 16(2) of the DPDPA. The Act empowers the government to notify restricted countries through official gazette notifications, and this list may evolve over time based on geopolitical considerations, protection standards of recipient countries, and national security concerns. Organisations should implement monitoring systems that track government notifications in real-time and have contingency plans in place to reroute information flows if a jurisdiction they currently transfer personal information to becomes restricted. Qverlabs provides automated jurisdiction monitoring to alert organisations immediately when regulatory changes occur.

A transfer impact assessment (TIA) under DPDPA is a structured evaluation of the risks associated with transferring personal information outside India. While the DPDPA does not explicitly mandate TIAs in the way the GDPR does, conducting them is a best practice that demonstrates compliance with the general obligations under Section 8. A comprehensive TIA should evaluate the protection laws of the destination jurisdiction, the nature and sensitivity of personal information being transferred, the purpose and necessity of the transfer, contractual safeguards in place with the recipient, technical measures protecting information during transit and at rest, and the potential impact on data principal rights if something goes wrong. TIAs should be documented and reviewed periodically.

The DPDPA requires data fiduciaries to implement appropriate safeguards when transferring personal information outside India. Under Section 8(3), when engaging data processors (including those outside India), the data fiduciary must have a valid contract in place. Recommended safeguards include contractual clauses ensuring the recipient maintains equivalent protection standards, technical measures such as encryption in transit and at rest, access controls limiting who can access personal information at the destination, audit rights allowing the data fiduciary to verify the recipient's compliance, breach notification obligations requiring the recipient to report incidents promptly, and deletion requirements ensuring information is purged after the purpose is fulfilled. These safeguards should be documented and auditable.

The DPDPA and GDPR take fundamentally different approaches to cross-border information transfers. The GDPR operates on a restrictive model where transfers are prohibited by default and only permitted to countries with an adequacy decision from the European Commission, or through specific transfer mechanisms like Standard Contractual Clauses or Binding Corporate Rules. The DPDPA takes an open model where transfers are permitted by default to all jurisdictions except those specifically restricted by the Central Government under Section 16(2). This means the GDPR creates a whitelist of approved countries, while the DPDPA creates a blacklist of restricted ones. In practice, this makes DPDPA cross-border compliance less burdensome for most transfers, but organisations must still maintain robust monitoring for government notifications and implement appropriate safeguards.

Yes, using cloud service providers (CSPs) can trigger cross-border transfer obligations under the DPDPA. When personal information is stored on or processed by cloud infrastructure located outside India, this constitutes a cross-border transfer even if the data fiduciary is an Indian organisation. This applies to public cloud providers like AWS, Azure, and Google Cloud where information may be replicated across global regions, SaaS platforms that process personal information on international servers, CDN providers that cache content across global edge nodes, and backup services that store records in offshore centres. Organisations must audit their cloud configurations to identify all international information flows, ensure no personal information is being transferred to restricted jurisdictions, and maintain appropriate contractual agreements with their CSPs under Section 8(3).

Transferring personal information to a jurisdiction restricted by the Central Government under Section 16(2) constitutes a violation of the DPDPA. The consequences include financial penalties as specified in the Act's Schedule, which can be up to 250 crore rupees depending on the nature and severity of the violation. The Data Protection Board of India can conduct inquiries, direct the data fiduciary to cease the transfer immediately, and impose remedial measures. Beyond regulatory penalties, the data fiduciary faces reputational damage, potential loss of business trust, and may need to undertake costly remediation to reroute information flows. Organisations should implement automated controls that prevent transfers of personal information to restricted jurisdictions at the infrastructure level, rather than relying on manual processes.

Section 17 of the DPDPA provides certain exemptions that may apply to cross-border transfers of personal information. The Central Government may exempt specific information processing activities from the provisions of the Act in the interest of sovereignty and integrity of India, security of the state, friendly relations with foreign states, maintenance of public order, or for preventing incitement to any cognisable offence. Additionally, processing necessary for enforcing legal rights or claims, processing by courts or tribunals, and processing for approved research or statistical purposes may receive exemptions. However, these exemptions are narrow and context-specific. Organisations should not assume an exemption applies without careful legal analysis, and should document the legal basis for any transfer that relies on an exemption rather than the general permission under Section 16(1).

Effective cross-border information flow monitoring for DPDPA compliance requires a multi-layered approach. First, conduct a comprehensive flow mapping exercise to identify all existing international transfers across databases, cloud services, SaaS platforms, email systems, and third-party integrations. Second, implement automated discovery tools that continuously scan network traffic, API calls, and pipeline configurations to detect new cross-border flows as they emerge. Third, maintain a real-time transfer registry logging every cross-border movement with destination, purpose, categories, volume, legal basis, and safeguards applied. Fourth, set up automated alerts for transfers to newly restricted jurisdictions based on government notification monitoring. Fifth, conduct periodic audits reconciling actual information flows against the documented transfer registry. Qverlabs automates this entire process with AI-powered flow discovery and continuous jurisdiction monitoring.

Unauthorised cross-border transfers of personal information under the DPDPA can attract significant penalties. While the Act does not specify a separate penalty category exclusively for cross-border transfer violations, such transfers would fall under the general non-compliance provisions in the Schedule. If the unauthorised transfer results in a breach due to inadequate safeguards, penalties can reach up to 250 crore rupees. Failure to maintain reasonable security safeguards for information transferred internationally can attract penalties up to 250 crore rupees. Non-compliance with other provisions of the Act, including transfer restrictions, carries penalties up to 50 crore rupees per instance. Additionally, the Data Protection Board can direct the organisation to cease processing, implement corrective measures, and report back on remediation. Repeated violations may attract progressively higher penalties and increased regulatory scrutiny.