Cross-border personal data transfers under the DPDPA rest on the Central Government’s restricted-jurisdiction notification and the transfer requirements it may specify under Rule 15. AMLEGALS structures the transfer architecture — group agreements, processor contracts and sector-specific localisation compliance — for multinational operations.
Section 16 of the DPDPA empowers the Central Government to restrict transfer of personal data to specified countries or territories outside India. Unlike the GDPR’s adequacy-decision model, the DPDPA uses a restricted-jurisdiction approach — transfer is permitted everywhere unless specifically restricted. However, the absence of the notification as of October 2026 does not mean a compliance holiday. Rule 15 of the DPDP Rules 2025 subjects transfers to requirements the Central Government may specify by order, Section 8 keeps the Data Fiduciary accountable wherever the data is processed, and sector-specific localisation requirements (RBI, CERT-In, SEBI, IRDAI) apply independently under Section 38.
AMLEGALS advises Indian subsidiaries of multinational corporations, GCCs, IT services companies and export-oriented businesses on building cross-border data transfer architectures that comply with the DPDPA, Rule 15 and sector-specific requirements simultaneously. The practice covers data-flow mapping, transfer classification (intra-group vs third-party), group data transfer agreements, processor contract amendments under Section 8(2), sector-specific localisation audits and transfer risk assessments.
Mapping every cross-border personal data flow by category, volume, destination and purpose, and classifying as intra-group or third-party.
Drafting the group-level agreement covering purpose limitation, security obligations, breach notification, Data Principal rights and sub-processing restrictions for intra-group transfers.
Amending Section 8(2) processor contracts to include cross-border transfer obligations, equivalent-protection warranties and audit rights.
Auditing compliance with RBI data localisation (payment system data), CERT-In log retention (180 days in India), SEBI CSCRF and IRDAI data governance requirements.
Conducting a risk-based assessment of each transfer destination’s legal framework and the practical enforceability of contractual safeguards.
Monitoring the Section 16 notification timeline and preparing the client’s transfer architecture for immediate compliance upon publication.
Section 16 of the DPDPA restricts transfer of personal data to any country or territory outside India that is not notified by the Central Government. The approach is a negative list — transfer is permitted to all jurisdictions except those specifically restricted. Rule 15 of the DPDP Rules 2025 makes transfers subject to any requirements the Central Government specifies, by general or special order, on making personal data available to a foreign State or to any entity under its control or agency.
As of October 2026, the Central Government has not published the notification under Section 16(1) identifying restricted jurisdictions. Until such notification, the default position is that cross-border transfers are permissible subject to any requirements specified by the Central Government under Rule 15, compliance with sector-specific restrictions (such as RBI data localisation for payment data) and the general obligation to maintain reasonable security safeguards under Section 8(5) regardless of location.
Several sector regulators impose independent data-localisation or transfer requirements that operate alongside the DPDPA under Section 38 (which provides that the DPDPA applies in addition to other laws). RBI’s April 2018 circular requires payment system data to be stored in India. CERT-In’s April 2022 directions require logs to be maintained in India for 180 days. SEBI’s CSCRF prescribes data localisation for certain categories of market infrastructure data. IRDAI has its own data governance requirements. These sector requirements continue regardless of the Section 16 notification.
No contractual form is prescribed. Rule 15 subjects transfers to any requirements the Central Government specifies by order. Because the Data Fiduciary remains responsible under Section 8 for processing by its Data Processors and for reasonable security safeguards wherever the data sits, a transfer agreement binding the recipient to purpose limitation, security safeguards, breach intimation and support for Data Principal rights is the practical way to evidence compliance. Group data transfer agreements (akin to GDPR binding corporate rules) are a practical mechanism for intra-group transfers.
The GDPR uses an adequacy-decision model supplemented by Standard Contractual Clauses, Binding Corporate Rules and specific derogations. The DPDPA uses a restricted-jurisdiction model — transfers are permitted except to restricted territories. The DPDPA does not prescribe standard contractual clauses or an equivalence test; Rule 15 instead subjects transfers to any requirements the Central Government specifies by order. The DPDPA also does not have a transfer impact assessment requirement analogous to the Schrems II framework, although a risk-based assessment is prudent practice.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing.
Share the data flow profile for a confidential assessment of cross-border transfer compliance.