Glossary
What is a cross-border transfer under DPDP?
A cross-border transfer sends personal data outside India. DPDP allows it unless the Central Government restricts a notified country.
Definition
A cross-border transfer is a transfer of personal data outside India. Under s.16 of the DPDP Act, 2023, the Central Government may restrict transfers to countries it notifies, and stricter sectoral laws still apply (s.16(2)). Rule 15 makes transfers subject to requirements the Central Government may set by general or special order about making personal data available to a foreign State or its agencies.
What it means
DPDP takes a negative-list approach: the Central Government may notify countries to which transfer is restricted. No such list has been notified, as of 4 November 2026.
Stricter sectoral laws still apply, so check your regulator's directions alongside DPDP. A Significant Data Fiduciary may also have to keep personal data the Central Government specifies within India (Rule 13). See cross-border transfer law.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.16 | The Central Government may restrict transfer to notified countries |
| s.16(2) | Stricter sectoral laws still apply |
| Rule 15 | Requirements set by general or special order on making data available to a foreign State |
| Rule 13 | SDFs keep specified personal data and related traffic data in India |
| s.17(1)(d) | s.16 does not apply to certain processing in India of data of Data Principals outside India under a contract with a person outside India |
Common misconceptions
- “DPDP has an approved country list.” It has no approved list. The Government may notify restricted countries, and no list has been notified.
- “DPDP overrides sectoral localisation rules.” No. s.16(2) keeps stricter sectoral laws in force.
- “Transfer rules apply only to SDFs.” s.16 applies to all Data Fiduciaries; Rule 13 adds a localisation duty for SDFs for data the Government specifies.
Related terms
Processes personal data on behalf of a Data Fiduciary (s.2).
Significant Data FiduciaryA Data Fiduciary the Central Government notifies for extra duties (s.10).
Digital personal dataPersonal data in digital form, the Act's scope (s.2, s.3).
ProcessingAny wholly or partly automated operation on digital personal data (s.2).
In TruePrivacy
Cross-border transfers keeps a country restriction list you maintain and warns when a vendor or transfer destination matches a restricted country. DPDP has no notified list, so the list is yours to keep current. Vendor records hold risk levels, assessments and contract tracking.
Is cross-border transfer allowed under DPDP?
Yes, unless the Central Government restricts transfers to a country it notifies under s.16. Rule 15 requirements and stricter sectoral laws (s.16(2)) also apply.
Which countries are restricted under DPDP?
No list has been notified, as of 4 November 2026. Watch for Central Government notifications under s.16.
Do sector regulators' localisation rules still apply?
Yes. s.16(2) keeps stricter sectoral laws in force. Check your regulator's directions alongside DPDP.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin