Navigating India's Cross-Border Data Transfers: The Negative-List Model Under DPDPA Section 16

As of late 2026, with the Digital Personal Data Protection Act, 2023 (DPDPA) fully operational, Indian businesses are actively recalibrating their data processing strategies, particularly concerning cross-border transfers. A pivotal aspect of this new regime is the unique approach taken by the DPDPA in Section 16, which outlines a “negative-list” model for international data flows – a significant departure from global norms and prior Indian legislative discussions.

The Negative-List Framework: A Sovereign Approach

Section 16 of the DPDPA grants the Central Government the power to notify specific countries or territories to which a Data Fiduciary cannot transfer personal data. The critical implication here is that, by default, personal data transfers to any country or territory not on this negative list are permitted, subject to other provisions of the DPDPA and applicable sectoral laws. This stands in stark contrast to the “positive-list” or “adequacy decision” model favoured by jurisdictions like the European Union under its General Data Protection Regulation (GDPR), where transfers are generally prohibited unless the receiving country is deemed “adequate” or specific safeguards (like Standard Contractual Clauses) are in place.

India’s negative-list model reflects a sovereign choice, aiming to provide greater flexibility for businesses while retaining the government’s ability to restrict transfers based on national interests, security concerns, or inadequate data protection standards in the recipient jurisdiction. This approach means Data Fiduciaries do not need to wait for an official “adequacy” stamp for a country; instead, they must actively monitor for any notifications that prohibit transfers.

Criteria and Implementation: The Role of DPDP Rules

While Section 16 lays down the framework, the practical implementation hinges heavily on the Digital Personal Data Protection Rules (DPDP Rules) that are being formulated or have recently been notified. These Rules are expected to elaborate on the criteria the Central Government will consider when adding a country or territory to the negative list. Potential factors could include:

• Reciprocity in Data Protection: Whether the receiving country offers comparable data protection standards to Indian citizens.
• National Security and Public Order: Geopolitical considerations or concerns about data access by foreign governments.
• Economic Interests: Protecting Indian businesses and critical infrastructure.
• International Agreements: Adherence to global data protection conventions.

The transparency and stability of these criteria will be crucial for businesses. Frequent changes to the negative list or unclear rationale could introduce significant operational challenges and compliance risks for Data Fiduciaries relying on global data flows.

Interplay with Sectoral Regulations

An important consideration for Indian businesses is how Section 16 interacts with existing sectoral data transfer and localisation norms. The DPDPA, under Section 40, clarifies that its provisions are in addition to, and not in derogation of, any other law currently in force. This means that where sectoral regulators like the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), or the Insurance Regulatory and Development Authority of India (IRDAI) have imposed stricter data localisation requirements or specific restrictions on cross-border transfers (e.g., RBI’s norms for payment system data mandating storage only in India), those specific requirements will continue to apply.

For instance, if a country is not on the DPDPA’s negative list, but RBI regulations prohibit the transfer of specific payment data to that country, the RBI’s stricter norm would prevail. Conversely, if a country is on the negative list, no personal data transfer would be permitted under DPDPA, irrespective of sectoral norms. Businesses must therefore navigate a multi-layered compliance landscape, ensuring adherence to both the DPDPA and any applicable sectoral regulations.

Implications for Data Fiduciaries

The negative-list model presents both opportunities and challenges. On one hand, it offers initial flexibility, potentially reducing the administrative burden of seeking specific approvals for every international transfer. On the other hand, it places a continuous monitoring obligation on Data Fiduciaries. A country could be added to the negative list at any time, necessitating immediate cessation of transfers and potentially costly reconfigurations of data processing infrastructure.

Furthermore, while the DPDPA permits transfers to non-listed countries, Data Fiduciaries still bear the overarching accountability under Section 8 to implement reasonable security safeguards to prevent personal data breaches. This implies that even for permitted transfers, robust contractual clauses with Data Processors in recipient countries, ensuring adequate data protection and compliance with DPDPA principles, remain essential. Unlike GDPR’s explicit reliance on mechanisms like SCCs for transfers outside adequate countries, DPDPA’s negative list focuses on permission to transfer, but the safeguarding responsibility always remains with the Fiduciary.

Practical Takeaway

For Indian businesses, General Counsels, and Data Protection Officers, navigating cross-border transfers under DPDPA Section 16 demands proactive vigilance. Firstly, establish robust internal processes to continuously monitor notifications from the Central Government regarding the negative list. Secondly, conduct thorough due diligence on all third-party vendors and cloud providers involved in international data transfers, ensuring their data handling practices align with DPDPA obligations, even if their host country isn’t on the prohibited list. Thirdly, review and update inter-company and third-party contractual agreements to include strong data protection clauses that reflect DPDPA’s accountability principles and provide mechanisms for immediate action should a recipient country be added to the negative list. Finally, ensure a clear understanding of how DPDPA’s general provisions interact with specific sectoral regulations, prioritising the stricter of the two where overlaps exist. Compliance in this evolving landscape requires agility and a comprehensive risk management strategy.