DPDP Act Cross-Border Data Transfer: What You Can Do Today and From 13 May 2027

The short answer and where things stand

Most commentary blurs three different things: rules in force today, rules that start on 13 May 2027, and powers the Government has not used yet. This table keeps them apart. Status is as of 26 October 2026.

Absence statements, such as “none found”, come from our own searches of official sources on 26 October 2026. They are not official statements. See what we checked and when.

What applies today, and what changes on 13 May 2027

Until 12 May 2027 the transfer rules that bind a business come from older laws. From 13 May 2027 the DPDP layer is added on top. It does not replace the older sector rules.

What counts as a transfer

The Act does not define “transfer”. Section 16(1) speaks of transfer “for processing” to a country or territory, and Section 2(x) counts “making available” and “disclosure by transmission” as processing. So sending data abroad is clearly processing. Whether every kind of overseas access is a Section 16 transfer is not settled by the text.

The three DPDP controls, side by side

Section 16(1), Rule 15 and Rule 13(4) are three different tools. Mixing them up is the most common error in commentary. None of them operates today: all three start on 13 May 2027, and each needs a further notification, order or specification before it bites.

Does the DPDP Act require data localisation? Myths against the text

No. The Act contains no general localisation rule. These are the claims we see most often, tested against the Act and the Rules.

Does consent, encryption or a contract solve it?

Each of them matters, and none of them answers the transfer question on its own.

• Consent

  A ground for processing, not a transfer permit.

  • Sections 4 and 6 say when you may process. Section 16 and sector rules apply separately.
  • Under SPDI Rule 7, consent is one of two routes, and the recipient must also give the same level of protection.
  • A part of consent that conflicts with a law is invalid to that extent (Section 6(2)).

• Encryption

  A safeguard, not an exemption.

  • Rule 6(1)(a) lists encryption, obfuscation, masking and virtual tokens as measures.
  • If you can still link the data to a person, treat it as personal data.
  • It supports your Section 8(5) duty. It does not switch off sector rules.

• Contracts

  Required, and they never move responsibility.

  • Section 8(2): use a processor only under a valid contract.
  • Section 8(1): you stay responsible, whatever the contract says.
  • Rule 6(1)(f): security terms must be in the processor contract.

Other Indian laws that can still restrict transfers

Section 16(2) keeps stricter Indian laws alive, and Section 38(1) says the Act is in addition to other laws. For most regulated businesses these older rules are the real constraint today.

• Sensitive personal data

  SPDI Rules 2011, Rule 7

  • A body corporate may send sensitive personal data to a recipient in India or abroad that ensures the same level of protection.
  • The transfer must be necessary for the lawful contract, or the person must have consented.
  • Treat as in force until 13 May 2027, when Section 43A of the IT Act is omitted. What happens to the Rules afterwards is an open point.

• Regulated sectors

  Banks, NBFCs, payment firms, insurers, securities firms

  • Each regulator has its own instruments, and some require data or records to stay in India.
  • They apply whatever Section 16 allows.
  • Check the exact instrument for your licence. Do not infer it from the DPDP Act.

• Logs and incidents

  CERT-In directions, 28 April 2022

  • Logs of ICT systems are kept for a rolling 180 days within the Indian jurisdiction.
  • A CERT-In FAQ says logs may also be stored abroad if they can be produced in reasonable time. The FAQ says it is not a legal document, so do not rely on it alone.
  • Listed incidents are reported within 6 hours.

The full table, with each instrument, who it covers, its status and a last-checked date, is on the sector data localisation rules page. Banks can also read our banking page.

Offshore work for foreign clients: Section 17(1)(d)

If your India-based team processes data about people outside India under a contract with a foreign party, as many global capability centres, BPOs and IT service firms do, Section 17(1)(d) matters. It starts on 13 May 2027.

Clause (d) has no “necessary” test, unlike clauses (a), (b) and (e). Apply it stream by stream. A business that also serves Indian users has streams that do not qualify, so never assume the whole entity is covered.

Vendors, cloud and AI: a checklist

Moving data abroad does not move accountability abroad. Under Section 8(1) you answer for processing done on your behalf, whatever the contract says. Run this list for each overseas vendor.

• List every vendor, region and sub-processor that touches personal data, including logs, error tools, analytics and backups.
• Have a valid contract for each (Section 8(2)) with security terms (Rule 6(1)(f)).
• Add approved regions, a sub-processor list, notice of change and deletion at exit (Section 8(7)(b)).
• Match retention. Rules 6(1)(e) and 8(3) set one-year floors for logs and related data, so overseas log tools need the same terms.
• Set a vendor breach-notice window shorter than yours. CERT-In expects 6 hours, and Rule 7 requires a Board report within 72 hours.
• Record who can see data from abroad, from where, and why.
• Keep an approved list of AI tools. No personal data in unapproved tools, and note where processing happens.
• Ask vendors how they handle government access requests, and add notice-where-lawful clauses.
• Publish a contact who can answer questions about your use of personal data (Section 8(9), Rule 9).
• Name an owner to watch for new notifications, orders and SDF designations, and keep a dated log.

A transfer assessment you can run: seven questions

Answer in order. The result is a preliminary pointer to which rules to read. It never says that a transfer is lawful.

1. 1

   Does the data relate to people in India, or is a foreign party offering goods or services to them?

   No: the Act may not reach you. Go to question 7.Yes: go to question 2.

2. 2

   Are you a bank, NBFC, payment firm, insurer or securities-market entity?

   No: go to question 3.Yes: read your regulator’s instrument first, then go to question 3.

3. 3

   Do you hold sensitive personal data as a body corporate under the SPDI Rules?

   No: go to question 4.Yes: check the Rule 7 conditions now, then go to question 4.

4. 4

   Is it data of people outside India, processed under a contract with a foreign party?

   No: go to question 5.Yes: check Section 17(1)(d), but keep your security and processor controls.

5. 5

   Is the recipient a foreign State, or an entity it controls?

   No: go to question 6.Yes: Rule 15 may matter once an order exists.

6. 6

   Could you be notified as a Significant Data Fiduciary?

   No: go to question 7.Yes: prepare to keep specified data in India if the Government asks.

7. 7

   Map the region, recipient, access method and contract for each flow.

   Then: record unresolved items for counsel.Re-check: notifications, orders and SDF lists before 13 May 2027.

Before 13 May 2027: a 90-day plan and a transfer register

The order below is advisory sequencing, not a legal requirement. Start whenever you can. Finishing a few months before 13 May 2027 leaves time for counsel and for any notification that appears.

1. 1

   Days 1 to 30: map and classify

   Build the flow map, then record every region, recipient, access method and contract. Classify each stream: sensitive personal data, regulated-sector data, offshore-client data, or none of these.

   Output a first transfer registerOwner IT with legal
2. 2

   Days 31 to 60: contracts and controls

   Update processor contracts: regions, sub-processors, security, retention, breach-notice window and deletion at exit. Set the approved AI tools list and tighten overseas access.

   Output signed or amended contractsOwner legal and security
3. 3

   Days 61 to 90: evidence and watch

   Finish the register, send open questions to counsel, name the person who watches for notifications and orders, and rehearse a vendor breach call.

   Output register, counsel note, monitoring logOwner compliance lead

A transfer register is the working record behind all three steps. This sample shows the columns. It is illustrative, not advice.

Frequently asked questions

What we checked and when