Cross-border transfers under DPDP: avoid the blanket localisation myth

Two claims often distort a discussion about DPDP and international services: that every business must keep all personal data in India, or that the Act permits every overseas transfer without further checks. Neither describes the framework accurately. A useful assessment identifies the data, the processing arrangement and each applicable restriction.

As of 22 October 2026, the main DPDP transfer provisions are scheduled for 13 May 2027 under the commencement notification. This article explains the enacted and final-rule framework for readiness. It does not invent a future country list, designation or government order.

Begin with section 16

Section 16(1) of the Act allows the Central Government, by notification, to restrict a Data Fiduciary’s transfer of personal data for processing to a country or territory outside India. The provision establishes a power to impose restrictions; it is not itself a blanket direction that every dataset must remain in India.

Section 16(2) preserves restrictions under other Indian law that provide a higher degree of protection or restriction on transfer. A business therefore cannot stop its analysis after reading the DPDP Act if its sector, activity or information is governed by another relevant requirement.

The practical question is not simply whether a supplier is foreign. Determine which personal data will be processed, where and by whom, and what current legal restrictions apply to that arrangement. Company nationality and data location are related facts, but they are not interchangeable.

Read the final Rules’ distinct provisions

Rule 15 addresses requirements the Central Government may specify concerning making personal data available to a foreign State, a person or entity under its control, or an agency of that State. Its subject is specific and should not be paraphrased as an automatic ban on all foreign providers.

Rule 13(4) separately concerns specified personal data and related traffic data processed by Significant Data Fiduciaries. The government specification contemplated by that rule is an important condition. Do not turn the provision into a universal localisation mandate for every organisation and every record.

Significant Data Fiduciary status itself depends on notification under section 10, based on the statutory considerations. A business should not assume it becomes an SDF solely because it crosses an invented turnover or employee threshold.

Keep sector requirements separate and current

A regulated activity may have a transfer or localisation condition that does not apply to an ordinary retail business. Identify the exact source, covered entity, data category, permitted arrangement and exceptions before applying it.

If a payment-related requirement is relevant, for example, the team should consult the current primary regulatory instrument and assess the particular role and data. It should not turn a slogan about payment localisation into a general DPDP rule for all invoices, customer profiles and business software.

The same discipline applies to contractual commitments. A customer agreement may promise a location or access restriction beyond the general legal baseline. That promise needs to be considered in procurement and configuration even when it is not a universal statutory rule.

Work through a supplier decision

Imagine a hypothetical Indian design studio evaluating an overseas project-management service. The service would hold client contact details and project comments. The studio first maps the processing: primary storage, backups, support access and subprocessors.

It then checks applicable current restrictions and contractual promises, the prospective DPDP framework and any relevant official notifications as they become operative. It also assesses the ground and purpose for processing, notice, security, supplier terms and rights support. A transfer assessment does not replace those other questions.

If the service cannot explain where a support attachment goes, record the uncertainty and resolve it. The appropriate outcome might be a contractual clarification, a configuration change, a restriction on uploaded content or a different service. The decision should follow the facts rather than a blanket preference presented as law.

Build a review process for changing instruments

Maintain a short register identifying the relevant data flows, legal sources, supplier commitments and review owner. Include the date each source was checked. Revisit the assessment when a notification, order, sector rule or material service arrangement changes.

As of this article’s cutoff, no universal DPDP country blacklist is asserted here. That is a statement about the article’s verified evidence, not a guarantee that no relevant restriction can exist for a particular reader or that future notifications will never be issued.

A defensible transfer decision can explain why the actual arrangement is permitted and appropriately controlled under the requirements that apply to it. It should remain reviewable when the law or service changes, without relying on either a localisation myth or an assumption of unrestricted movement.