Navigating India's Cross-Border Data Transfers: The DPDPA's Negative List

The Digital Personal Data Protection Act, 2023 (DPDPA), enacted in August 2023 and largely operational by September 2026, has fundamentally reshaped India’s privacy landscape. Among its most distinctive features is the approach to cross-border data transfers, outlined in Section 16. Unlike many global privacy regimes that adopt a “positive list” or “adequacy” model, the DPDPA champions a “negative list” framework, presenting both unique opportunities and compliance challenges for Indian businesses.

The DPDPA’s Negative List Model (Section 16)

Section 16(1) of the DPDPA articulates a straightforward principle: the Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary to any country or territory outside India. This means that, by default, cross-border transfers of personal data from India are permissible unless the destination country or territory has been explicitly placed on a restricted list by the government. This stands in stark contrast to the European Union’s General Data Protection Regulation (GDPR), for instance, which generally prohibits transfers outside the EU/EEA unless the destination country is deemed “adequate” (a positive list) or specific safeguards (like Standard Contractual Clauses) are implemented.

The DPDPA’s model shifts the burden of identifying high-risk jurisdictions from individual Data Fiduciaries to the Central Government. While this might appear to simplify compliance for businesses, it necessitates continuous monitoring of official notifications. As of late 2026, the initial notifications regarding restricted territories are keenly awaited, shaping the immediate operational landscape for data fiduciaries engaged in international data flows. The underlying assumption is that countries not on the negative list are considered sufficiently safe for data transfers, though the criteria for restriction remain at the government’s discretion, potentially encompassing factors like data protection laws, enforcement mechanisms, and international cooperation.

Interplay with Sectoral Regulations and DPDP Rules

While Section 16 provides the overarching framework for cross-border transfers under the DPDPA, its application cannot be viewed in isolation. India’s regulatory environment includes specific sectoral norms that impose additional requirements, particularly concerning data localisation or residency. Section 40 of the DPDPA clarifies that its provisions are in addition to, and not in derogation of, any other law in force. This means Data Fiduciaries must navigate both the DPDPA and existing or evolving sectoral mandates.

For example, the Reserve Bank of India (RBI) has long mandated data localisation for payment system operators, requiring the storage of all payment system data in India. Similarly, regulations from SEBI for capital markets and IRDAI for the insurance sector often include provisions related to data residency or specific security standards for data processed abroad. The DPDP Rules, notified earlier this year, further elaborate on certain aspects of the Act, though Section 16’s core mechanism remains government notification. Data Fiduciaries must understand that even if a country is not on the DPDPA’s negative list, sectoral regulations might still prohibit or restrict the transfer of specific types of data, or mandate that a copy of the data remains stored within India. Therefore, a comprehensive data governance strategy requires a multi-layered approach, addressing both general privacy law and specific industry requirements.

Implications for Data Fiduciaries in India

The negative-list model under DPDPA Section 16 presents a distinct operational paradigm for Indian Data Fiduciaries. Firstly, it places a premium on staying updated with Central Government notifications. A Data Fiduciary must have robust internal processes to monitor the official gazette and other government pronouncements regarding restricted countries. Any transfer to a newly restricted territory would necessitate immediate cessation or re-routing of data flows.

Secondly, while the initial burden of assessing ‘adequacy’ is removed, Data Fiduciaries still retain fundamental responsibilities under the DPDPA. These include adherence to principles of purpose limitation (Section 6), data minimisation (Section 7), and maintaining reasonable security safeguards (Section 8) irrespective of the data’s destination. Even for transfers to non-restricted countries, Data Fiduciaries should implement strong contractual agreements with foreign Data Processors or Fiduciaries, ensuring accountability and compliance with Indian law. This includes provisions for data breach notification (Section 17) and Data Principal rights (Chapter III). The DPDPA’s approach encourages a baseline of data protection for all transfers, rather than focusing solely on the destination country’s legal framework.

Practical takeaway

Indian businesses, General Counsels, and Data Protection Officers must adopt a proactive and multi-faceted approach to cross-border data transfers. Begin by meticulously mapping all international data flows, identifying the types of personal data transferred and their destination countries. Simultaneously, establish a robust mechanism to monitor notifications from the Central Government under DPDPA Section 16 regarding restricted territories. Crucially, ensure that your data transfer practices also comply with any specific data localisation or residency requirements imposed by sectoral regulators like the RBI, SEBI, or IRDAI, as these operate in parallel with the DPDPA. Finally, regardless of the destination, embed strong contractual clauses and security measures in all cross-border data processing agreements to uphold the Data Principal’s rights and maintain accountability under Indian law.