Cross-Border Transfers of Personal Data

The general position

• Transfer outside India is permitted except to notified restricted territories
• Restrictions may be added by notification, so the position can change
• Nothing in the Act lowers a higher bar set by another Indian law
• The Data Fiduciary remains accountable for the data wherever it goes

Sectoral rules usually bind tighter

The last of those points is the one that catches people. RBI's storage requirements for payment system data, directions applying to banks and NBFCs, insurance and telecom regulation, and public-procurement conditions frequently require data to stay in India regardless of what the DPDP Act alone would allow. Where two rules apply, the stricter one governs.

If you are regulated, start from your sectoral obligations and treat the DPDP position as the floor rather than the answer.

You cannot govern a transfer you have not mapped

• Inventory every processor and sub-processor, including the ones procurement did not route through you
• Record where each one stores and processes data, not just where it is headquartered
• Watch for indirect transfer: backups, replicas, support tooling, analytics and error reporting
• Flag SaaS vendors whose default region is outside India even when an India region exists

Contracts and the duty that stays with you

Processors must operate under a valid contract, and that contract is where your instructions, security expectations, breach notification timelines and deletion obligations live. Accountability does not transfer with the data: if a sub-processor you never vetted loses it, the obligation to notify the Board and the affected people is still yours.

The sovereign option

For organisations whose risk appetite or regulator does not accommodate transfer at all, the simplest answer is architectural rather than contractual — keep processing inside your own environment so the question does not arise. That is a design decision best made early, because unwinding a cross-border dependency later is considerably harder.