Navigating India's Open Skies: Cross-Border Data Transfers Under DPDPA's Negative List

As of October 2026, India’s digital economy continues its rapid expansion, bringing with it an increasing volume of cross-border data flows. The Digital Personal Data Protection Act, 2023 (DPDPA), now fully operational with its accompanying DPDP Rules 2025, has introduced a distinctive framework for these transfers, particularly through its “negative-list” model outlined in Section 16. This approach marks a significant departure from global norms and demands a nuanced understanding from Indian businesses and legal professionals.

The DPDPA’s “Open Skies” Approach to Data Transfers

The DPDPA adopts a fundamentally permissive stance towards cross-border data transfers. Section 16(1) unequivocally states that a Data Fiduciary may transfer personal data outside India, except to such countries or territories as the Central Government may notify. This establishes a default position of permissibility, shifting the regulatory burden from individual data fiduciaries needing to justify each transfer to the government identifying specific risks. In contrast to frameworks like the EU’s General Data Protection Regulation (GDPR), which requires “adequacy decisions” or specific safeguards for transfers (as per GDPR Articles 44-50), the DPDPA streamlines the process by presuming transfers are acceptable unless explicitly prohibited. This “open skies” model is designed to foster India’s digital trade while maintaining essential national interests.

Crafting the Negative List: Criteria and Consultation

The power to restrict data transfers lies with the Central Government, as per Section 16(2). This provision allows for the notification of countries or territories where personal data transfers are prohibited. The criteria for such restrictions are broad, encompassing considerations of national security, foreign policy, economic interests, and the overall data protection standards prevalent in the destination country. The DPDP Rules 2025 likely elaborate on the procedural aspects and specific factors that guide the government in forming this list. Furthermore, Section 16(2) mandates consultation with relevant stakeholders before such a list is notified. This would include seeking input from the Data Protection Board of India (DPBI), industry bodies, and privacy experts, ensuring a balanced and well-informed decision-making process that reflects both geopolitical realities and data protection imperatives. The dynamic nature of this regulatory landscape means businesses must remain vigilant for updates to this list.

Interplay with Sectoral Regulations and Existing Mandates

While the DPDPA provides a general framework, it’s crucial to understand its interaction with India’s existing sectoral regulations. Section 43 of the DPDPA clarifies that while the Act has an overriding effect, it does not prevent any other law from imposing stricter standards for the protection of personal data. This means that even if a country is not on the Central Government’s negative list, specific sectoral norms might still restrict data transfers. For instance, the Reserve Bank of India (RBI) mandates data localisation for payment system providers, requiring all payment system data to be stored exclusively in India. Similarly, the Securities and Exchange Board of India (SEBI) and the Insurance Regulatory and Development Authority of India (IRDAI) have specific guidelines for financial and insurance data, which often include stringent requirements for data residency and confidentiality. Therefore, Data Fiduciaries must navigate a layered compliance environment, ensuring adherence to both the DPDPA’s general principles and any stricter sectoral mandates that apply to their specific industry.

Operationalising Cross-Border Transfers for Indian Businesses

For Indian Data Fiduciaries and Processors, the negative-list model simplifies the initial assessment of whether a transfer is permissible. However, this simplification does not diminish their overarching accountability under the DPDPA. Section 8 places a significant obligation on Data Fiduciaries to ensure that personal data, even when transferred outside India, remains protected in accordance with the Act’s provisions. This necessitates robust due diligence on overseas data recipients, ensuring they have adequate technical and organisational measures in place to protect the data. While the DPDPA doesn’t explicitly mandate standard contractual clauses for permission to transfer data to non-restricted countries, such clauses are indispensable for establishing clear responsibilities, audit rights, and liability frameworks. Data mapping and comprehensive vendor management strategies become critical tools for businesses to track data flows, understand the protections in place, and demonstrate compliance with their accountability obligations.

Practical takeaway: Indian businesses, GCs, and DPOs must adopt a proactive and adaptive approach to cross-border data transfers. Regularly monitor notifications from the Central Government regarding the negative list, as this will directly impact permissible destinations. While the DPDPA’s negative-list model offers a streamlined path for many transfers, it does not absolve Data Fiduciaries of their fundamental accountability under Section 8. Therefore, implement robust data governance frameworks, conduct thorough due diligence on all overseas data processors, and ensure comprehensive contractual clauses are in place to safeguard personal data. Crucially, always cross-reference DPDPA requirements with any applicable sectoral regulations (e.g., RBI, SEBI, IRDAI), which may impose additional or stricter conditions on data residency and transfers.