Cross-Border Data Transfer
Sending personal data to another country, including storing it on servers abroad.
A cross-border transfer is any movement of personal data to another country, including storing it on a server or cloud service outside India. The DPDP Act allows it, unless the Government restricts a particular country.
Meaning of Cross-Border Data Transfer
The Act allows transfers outside India except to countries the Central Government restricts by notification. Stricter sector laws that already restrict transfers continue to apply. Rule 15 allows the Government to set requirements for making data available to a foreign State or entities it controls.
Section 16(1) of the DPDP Act provides that the Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified. Unlike some other laws, the Act does not list approved countries and does not demand that every transfer be authorised. The default is that transfer is permitted; the Government's power is to block named destinations. In practice, a fiduciary must keep watching for notifications.
Section 16(2) preserves stricter laws. If another law already gives a higher degree of protection for, or imposes a restriction on, the transfer of personal data, that law continues to apply. This matters for regulated sectors: payment-system data is subject to the RBI's storage directive, and insurers, telecom operators and others have their own rules. Section 38 adds that the Act is in addition to other laws. So a transfer may be fine under the DPDP Act and still be restricted by a sector regulator.
Rule 15 adds that personal data processed under the Act may be transferred outside India subject to the requirements the Central Government may specify, by general or special order, for making the data available to a foreign State or to any person or entity under the control of such a State. Separately, Rule 13 allows localisation conditions for Significant Data Fiduciaries. The Act's other duties go with the data: even when the data is abroad, the Indian fiduciary remains responsible for notice, consent, security and breach intimation, and Section 8(1) makes it responsible for what its processors do.
It helps to know what counts as a transfer. Hosting a database in a data centre outside India is a transfer; so is giving a foreign analytics vendor access to customer records, using a global support desk to view customer files, or a group company abroad accessing HR data. The Act also applies to processing outside India linked to offering goods or services to people in India (Section 3(b)). And Section 17(1) exempts, among others, processing under contracts with persons outside India of data of people not in India, so a typical offshore services provider may fall outside parts of the Act for that data.
Examples of Cross-Border Data Transfer
A SaaS company hosts customer data in Singapore. The transfer is allowed unless India restricts that country or a sector rule forbids it.
A Bengaluru SaaS company stores customer data in Singapore and uses a support desk in Europe. It maps both flows, confirms neither country is restricted, and records the vendors' processor contracts. It also prepares a migration plan in case a notification changes the position.
An insurer uses an offshore claims-analytics vendor. Even though the DPDP Act permits the transfer, its IRDAI obligations require records in India, so it keeps primary records on Indian servers and sends only masked extracts abroad.
A travel booking platform shares passenger names and passport details with partner airlines and hotels in several countries. It limits the fields to what each booking needs and records that the transfer is necessary to deliver the service the customer requested.
Why Cross-Border Data Transfer matters
Almost every modern business sends personal data abroad somewhere in its technology stack, through cloud hosting, email delivery, analytics, customer relationship tools or software support. If the Government restricts a country that hosts one of these services, the business may need to move the data quickly. A company that has no data flow map will not know what is affected and may breach the restriction without realising it.
There is a contract and trust dimension too. Enterprise customers, especially banks and insurers, ask vendors where data sits and who can access it. A clear answer, backed by a data map and processor contracts, speeds up sales; an unclear answer is a reason for delay, or for losing the deal.
How it works in practice
- 1Build a data flow map that shows each system holding personal data, the country where it is stored or accessed from, the vendor, and the purpose. Update it whenever a new tool is added.
- 2Check each flow against sector rules. For example, a payment business should confirm the RBI's storage rule and a regulated insurer should check IRDAI requirements, since Section 16(2) keeps stricter rules alive.
- 3Put written processor contracts in place with every vendor abroad, requiring security safeguards equal to Rule 6, breach notice to you without delay, no onward transfer without permission, and deletion on exit.
- 4Set up a monitoring step for Section 16 notifications and Rule 15 orders, and prepare a migration option for each critical vendor so you can move within a defined time.
- 5Tell users in the notice, where relevant, that data may be processed outside India, and keep the explanation consistent with the actual flows.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing the DPDP Act bans data transfers abroad. The default is permission, with restriction by notification.
Assuming that if the Act permits a transfer, it is lawful in every sector. Section 16(2) keeps stricter laws.
Ignoring remote access. Viewing data from abroad can be a transfer even if the servers are in India.
Leaving vendors uncontracted. The fiduciary stays responsible for processors under Section 8(1).
Compliance tips
Include a destination-country field in your vendor register so you can filter quickly if a country is restricted.
Prefer vendors that offer Indian data regions where cost and performance allow, which reduces future risk.
Test your ability to restore and migrate data, not just to back it up.
Review the position every quarter and whenever you add a major tool.
Common questions about Cross-Border Data Transfer
Is it legal to store Indian customers' data on foreign servers?
Generally yes under the DPDP Act, since Section 16 allows transfer unless the Central Government restricts a country. But sector rules, such as the RBI's for payment data, may require storage in India, and you stay responsible for security.
Which countries are restricted under Section 16?
That depends on notifications issued by the Central Government. The Act does not list countries, so check the Gazette and official announcements rather than assume a list exists.
Does the Act apply to a foreign company serving Indian customers?
Yes, if the processing outside India is connected with offering goods or services to [Data Principals](term/data-principal) in India, under Section 3(b). The foreign company then takes on the duties of a Data Fiduciary for that processing.