Cross-border data-transfer clauses and DPDPA contracting for foreign companies.
The DPDPA permits transfer of personal data outside India except to countries the government restricts, which is a more permissive default than the GDPR adequacy-and-transfer-tool model, but it does not remove the need for contractual protection between the parties. A foreign company receiving Indian personal data, or an Indian Data Fiduciary sending it abroad, still needs data-processing terms that allocate roles, impose security and purpose limits, flow down Data Principal rights, and handle breach and sub-processing, because liability under the DPDPA follows the Data Fiduciary regardless of where processing happens.
Layered on top are sectoral localisation rules, notably the RBI payment-data mandate and other sector directions, which can override the general permissive position for specific data. We draft the cross-border data-transfer and processing clauses that give effect to the DPDPA allocation of responsibility, reconcile them with the counterparty GDPR or other-law requirements, and build in the sectoral-localisation carve-outs so the contract is accurate rather than generic.
Confirming whether a given transfer is permitted under the DPDPA and whether any government restriction or sectoral localisation applies.
Drafting the controller-processor and transfer clauses that allocate DPDPA roles, security, purpose limits, and sub-processing controls.
Building the mechanism for the foreign recipient to support Data Principal rights and the Data Fiduciary obligations.
Reconciling the India clauses with the counterparty GDPR SCCs or other-law transfer requirements so one agreement works across regimes.
Carving out RBI payment data and other sector-localised data that cannot leave India or must be mirrored locally.
Allocating breach-notification responsibility and liability between the parties consistent with DPDPA accountability.
Not in the EU sense. The DPDPA permits transfer outside India except to restricted countries, so there is no mandatory SCC template. But the parties still need robust data-transfer and processing clauses to allocate DPDPA responsibility, and sectoral localisation rules can override the permissive default.
Largely yes, except to countries the government restricts and except where sectoral rules, such as the RBI payment-data mandate, require the data to stay in or be mirrored in India. The general position is permissive, but the sectoral overlays must be checked.
The Data Fiduciary remains accountable under the DPDPA regardless of where the processing occurs, which is why the transfer contract must impose security, purpose, and breach obligations on the foreign recipient and allocate liability clearly.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing. An initial discussion is confidential and is used only to understand the matter and assess fit.
Share the key facts for a confidential preliminary assessment of your India matter.