Cross-border transfer checklist (DPDP)

What the law says about transfers

• s.16(1): the Central Government may restrict transfers to countries it notifies. The cross-border transfer page explains the approach.
• s.16(2): stricter sectoral laws on transfers still apply.
• Rule 15: transfers are subject to requirements the government may set by general or special order about making personal data available to a foreign State or its agencies.
• Rule 13: a Significant Data Fiduciary must keep personal data the government specifies, on a committee's recommendation, and related traffic data within India.
• s.17(1)(d): for personal data of people outside India processed in India under a contract with a person outside India, Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16 do not apply. Check the scope with counsel.

Transfers within a group count too: an Indian entity sending customer data to a parent company abroad is sending it outside India. Remote access from another country, such as a support team logging in from abroad, deserves the same scrutiny.

Checklist before data leaves India

Run this checklist for every new flow, and once a year for existing ones. Most flows go through vendors, so the vendor questions further down do much of the work.

1. 01Inventory destinations

   List every system, vendor and group company that stores or accesses personal data outside India, including support, analytics and backup tools.

2. 02Record the reason

   For each flow, write the purpose, the data categories, the ground under s.4 and the recipient.

3. 03Check sector rules

   Check your regulator's directions alongside DPDP; some sectors limit transfers or require local copies.

4. 04Check SDF exposure

   If you could be notified as an SDF, note which data might be specified for localisation under Rule 13.

5. 05Put contracts in place

   Make sure each foreign processor has a valid contract with security terms (s.8(2), Rule 6) that lists its locations.

6. 06Log the decision

   Record who approved the transfer and when, and what you would do if the destination were restricted.

7. 07Watch for notifications

   Track s.16 notifications and Rule 15 orders, and re-run this checklist when one appears.

Transfer register fields

The entries are samples for a fictional lender.

Questions for vendors

• In which countries do you store, process or access our data, including for support and backups?
• Which sub-processors are involved, and where are they?
• Can you keep our data in India if we need it?
• How will you tell us about a change of location?
• Will you comply with a restriction the Indian government notifies under s.16?
• How will you respond to a foreign government's request for our data, and will you tell us?

The vendor due diligence guide covers the rest of the questionnaire.

How TruePrivacy helps

Cross-border transfers keeps a country restriction list that you maintain, and warns when a vendor or transfer destination matches a restricted country. DPDP has no notified list yet, so the list is yours to keep current.

Vendors and processors sends assessments through a portal link and tracks contracts, and records of processing keeps the flows in one exportable register. Related template: the processor addendum.