Cross-Border Data Transfers Under India’s DPDP Act: A Permissive Model Without Safeguards

I. Introduction

Three years after Parliament gave the Central Government power to block personal data from leaving India for named countries, that power has never once been used: no restricted-country notification has been issued.[1] In the interim, almost every cross-border transfer of Indian personal data has proceeded lawfully by default. The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first comprehensive attempt to regulate this movement, arriving six years after the Supreme Court held that privacy is protected under Article 21 of the Constitution in Justice K.S. Puttaswamy (Retd.) v Union of India.[2]

What distinguishes the DPDP Act from many contemporaries is its permissive posture. Rather than requiring an adequacy finding before every transfer, section 16 allows data to leave India by default, subject only to countries the Central Government chooses to restrict by notification.[3] That is a deliberate wager on commercial competitiveness. Whether it also protects individuals once their data crosses the border is a separate question, and one this article treats as still open.

This article argues that the DPDP Act’s transfer regime is defensible as economic policy but incomplete as a privacy safeguard, and that its credibility will be decided less by the statute’s text than by the rules, notifications, and institutional practice that follow it. Part II sets out the statutory framework governing transfers; Part III examines the constitutional foundations laid down in Puttaswamy; Part IV evaluates the practical difficulties the regime has yet to resolve; Part V compares India’s model with the European Union, the United Kingdom, and Singapore; Part VI proposes reforms; and Part VII concludes.

II. The Legal Framework Governing Cross-Border Data Transfers

A. From the IT Act to the DPDP Act

Before 2023, cross-border data flows sat awkwardly within the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.[4] Those Rules addressed sensitive information narrowly and were written before cloud computing, offshore outsourcing, and platform-based data ecosystems reached their current scale; they were never built to police international transfers as a category.

The constitutional turning point came in 2017. A nine-judge bench in Puttaswamy unanimously held that privacy is intrinsic to life and personal liberty under Article 21, overruling the narrower positions taken in M.P. Sharma v Satish Chandra and Kharak Singh v State of Uttar Pradesh, and set out a proportionality standard for any restriction on that right.[5] The judgment created a constitutional expectation that Parliament would eventually legislate, and the report of the Committee of Experts chaired by Justice B.N. Srikrishna supplied much of the intellectual groundwork.[6] Several draft bills, some far more restrictive on localisation than what was ultimately enacted, preceded the DPDP Act. Parliament’s eventual choice, to relax localisation requirements considerably, reflects a shift in emphasis from data sovereignty toward digital trade facilitation.

B. Section 16: How the Transfer Regime Actually Works

Section 16(1) of the DPDP Act gives the Central Government power to restrict, by notification, the transfer of personal data to specified countries or territories.[7] Everything not restricted is, by implication, permitted. Section 16(2) preserves any other Indian law imposing a higher standard of protection or a tighter transfer restriction, so sector regulators, the Reserve Bank of India’s payment-data localisation mandates being the clearest example, are not displaced by the Act’s general permissiveness.[8]

This is a negative-list model, and it is unusual among major economies precisely because it does not ask the exporting entity to justify the transfer in advance. There is no equivalent, in section 16 itself, of adequacy assessment, standard contractual clauses, or binding corporate rules. As of mid-2026, the Central Government has not published a restricted-country list, which means almost every cross-border transfer is currently lawful by default.

That silence is doing a great deal of regulatory work. It is not obvious whether the absence of a list reflects considered policy, that no jurisdiction yet warrants restriction, or simply that the machinery for making such an assessment has not been built. Either way, businesses are complying with a provision whose practical content does not yet exist, which is an odd position for something regularly described as the cornerstone of India’s transfer regime.

C. Obligations That Travel With the Data

The Act frames data subjects as Data Principals and processing entities as Data Fiduciaries. Fiduciaries must implement reasonable security safeguards,[9] notify the Data Protection Board and affected individuals of a personal data breach,[10] and maintain a grievance redressal mechanism.[11] Data Principals correspondingly hold a right to obtain information about how their data is processed,[12] a right to correction and erasure,[13] and a right to grievance redressal and nomination.[14]

None of these obligations are territorially qualified; a Data Fiduciary does not shed its statutory duties merely because processing has moved offshore. The difficulty is not the drafting but the enforcement gap that follows it. A breach-notification duty is only as good as the Board’s ability to investigate a foreign processor, and a right to erasure means little if the recipient jurisdiction has no comparable concept of erasure at all. The statute exports obligations more easily than it exports the means of enforcing them.

III. Judicial Foundations

Puttaswamy remains the doctrinal anchor for everything that follows, but it is worth being precise about what it actually decided. The nine-judge bench held that privacy is protected under Articles 14, 19 and 21, and articulated a proportionality test requiring legitimate aim, statutory backing, necessity, and proportionality for any state interference with that right.[15] The judgment did not concern data transfers at all; it arose from a challenge to the Aadhaar biometric identification scheme. Its reasoning on informational self-determination has nonetheless become the constitutional vocabulary for every data protection debate in India, including this one.

A related but distinct judgment followed in 2018, when a five-judge bench upheld the constitutional validity of the Aadhaar Act while striking down several of its provisions, in the case reported as Puttaswamy (Aadhaar-5J.) v Union of India.[16] That decision matters here less for its Aadhaar-specific holding than for its reaffirmation, on facts involving mass data collection, that the proportionality framework from 2017 has practical teeth rather than remaining aspirational language.

Neither judgment supplies a ready-made test for cross-border transfers specifically, and that gap is worth naming rather than glossing over. Puttaswamy tells a court how to evaluate a restriction on privacy; it says nothing about what happens when the protection an individual actually needs depends on a foreign legal system the Indian judiciary cannot reach. The DPDP Act was Parliament’s opportunity to build that missing piece, and section 16 does so only partially: it tells the government when it may act, but not what an aggrieved Data Principal may do while it does not.

IV. Critical Challenges in Cross-Border Data Transfers

Four problems recur once the statute meets practice. The first is jurisdiction and enforcement. An Indian order against a data processor with no assets or presence in India is, in most cases, a paper remedy. The Data Protection Board can issue directions and impose penalties, but collecting a penalty from an entity outside Indian jurisdiction generally requires either a treaty mechanism or the cooperation of a foreign court, and the DPDP Act creates neither.

The second is divergent standards without a checklist. Section 16 does not ask whether the destination country’s law is adequate in the GDPR sense, nor does it publish criteria for restriction. That silence protects flexibility but sacrifices predictability: a business cannot know in advance whether tomorrow’s notification will catch a jurisdiction it currently relies on, and an individual cannot know what standard of protection accompanies their data abroad.

The third is national security. Large, aggregated datasets covering financial records, health data, or telecommunications metadata carry strategic value that ordinary commercial transfers do not. Reserving executive power to restrict transfers to specific countries is a reasonable response to that risk, but broad discretion exercised without published criteria is difficult to challenge and, over time, difficult to trust.

The fourth is compliance layered on compliance. A company operating in India, the European Union, and the United States is not choosing among three separate transfer regimes; it is complying with all three simultaneously, and the requirements do not map onto each other cleanly. The DPDP Act’s comparative simplicity is a genuine advantage for smaller firms, but it does not reduce the complexity created by the other regimes a multinational must also satisfy; it only avoids adding a fourth layer of friction.

What ties these four problems together is not that the Act got the balance wrong, but that it deferred the balance to instruments that do not yet exist, principally rules, notifications, and institutional capacity at the Data Protection Board. A statute that is permissive by default places a correspondingly heavier burden on whatever comes after it, and that burden has not yet been discharged.

V. Comparative Perspectives

The European Union’s approach under the GDPR inverts India’s presumption: transfers require either an adequacy decision or an alternative safeguard such as Standard Contractual Clauses or Binding Corporate Rules before data may leave the European Economic Area.[17] The United Kingdom, after Brexit, retained substantially the same architecture under the UK GDPR, running its own adequacy list in parallel with the EU’s.[18]

Singapore’s Personal Data Protection Act, 2012 sits closer to the middle. Its transfer limitation obligation does not require a government adequacy finding, but it does require the transferring organisation itself to ensure, typically by contract, that the recipient provides protection comparable to the PDPA.[19] The obligation is placed on the exporting entity rather than assumed away, which is the feature India’s section 16 currently lacks.

Measured against these models, the DPDP Act sits at the permissive end of the spectrum: no adequacy requirement, no contractual safeguard requirement, and a restriction mechanism that operates only in the negative and only when the government chooses to use it. That positioning is not indefensible; it mirrors India’s broader regulatory instinct to legislate principles and leave detail to delegated rulemaking. But it means India has adopted the least protective transfer model among the systems compared here, without yet building the alternative safeguards, contractual or institutional, that Singapore at least retained.

VI. Recommendations for Reform

Four changes would narrow the gap between the Act’s permissive text and its practical accountability, without abandoning its underlying commercial logic.

First, the Government should publish the criteria it intends to apply before restricting a jurisdiction under section 16(1), covering the foreign law’s substantive protections, its enforcement track record, its cybersecurity posture, and its treaty relationship with India. A published methodology does not weaken executive discretion; it simply makes that discretion reviewable, which the proportionality standard in Puttaswamy would in any event require if a restriction, or the failure to impose one, were ever challenged.

Second, the Data Protection Board should develop model contractual terms for cross-border transfers, borrowing selectively from the EU’s Standard Contractual Clauses and Singapore’s comparable-protection requirement, without importing the EU’s full adequacy machinery. This would give Data Fiduciaries a safe harbour and give Data Principals something closer to Singapore’s transferred-obligation model.

Third, India should pursue mutual assistance arrangements with major destination jurisdictions specifically for data protection enforcement, not a wholesale adequacy framework, but narrower agreements permitting the Board to request information or cooperation from foreign counterparts. Without this, the enforcement gap identified earlier persists regardless of how the statute is drafted.

Fourth, the DPDP Rules should require Data Fiduciaries to disclose, at the point of consent, which countries a Data Principal’s information may be transferred to and under what safeguards. Consent under the Act is already meant to be informed; specificity about destination is a modest addition that would let compliance-minded organisations differentiate themselves and let individuals make an actual choice rather than a nominal one.

VII. Conclusion

The DPDP Act’s transfer regime is not badly designed so much as unfinished. Section 16 answers the question a trade ministry would ask, can data move, more completely than it answers the question a privacy regulator would ask, which is what happens to that data, and to the person it describes, once it arrives. Puttaswamy supplies the constitutional standard against which any restriction must be measured; it does not supply the institutional machinery that makes cross-border enforcement real. Whether India’s model proves durable will depend on choices Parliament has not yet made: a published restriction methodology, a contractual safeguard regime, and enforcement cooperation with the jurisdictions where Indian data actually ends up. Until those choices are made, the Act’s commercial success is likely to outpace its privacy protection, and the two are not the same achievement.

Table of Cases

Justice K.S. Puttaswamy (Aadhaar-5J.) v Union of India (2019) 1 SCC 1.

Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1.

Kharak Singh v State of Uttar Pradesh AIR 1963 SC 1295.

M.P. Sharma v Satish Chandra AIR 1954 SC 300.

Table of Legislation

Constitution of India.

Digital Personal Data Protection Act 2023 (India).

Information Technology Act 2000 (India).

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (India).

Regulation (EU) 2016/679 (General Data Protection Regulation).

Data Protection Act 2018 (UK), as amended (UK GDPR).

Personal Data Protection Act 2012 (Singapore).

Bibliography

Books

Greenleaf G, Asian Data Privacy Laws (Oxford University Press 2014).

Kuner C, Transborder Data Flows and Data Privacy Law (Oxford University Press 2013).

Journal Articles

Greenleaf G, ‘India’s 2023 Data Privacy Act: Business/Government Friendly, Consumer Hostile’ (2023) 185 Privacy Laws & Business International Report 1, 3-12.

Svantesson DJB, ‘The Regulation of Cross-Border Data Flows’ (2011) 1(3) International Data Privacy Law 180.

Official Reports and Online Sources

Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, ‘A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians’ (Ministry of Electronics and Information Technology, 2018).

Ministry of Electronics and Information Technology, Digital Personal Data Protection Act, 2023 (Government of India).

European Commission, ‘Adequacy Decisions’ (General Data Protection Regulation guidance).

OECD, Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.

[1]Digital Personal Data Protection Act 2023 (India) (Act No 22 of 2023) (‘DPDP Act’), s 16(1).

[2]Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1.

[3]DPDP Act 2023, s 16(1).

[4]Information Technology Act 2000 (India); Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (India).

[5]Puttaswamy (n 2), overruling M.P. Sharma v Satish Chandra AIR 1954 SC 300 and Kharak Singh v State of Uttar Pradesh AIR 1963 SC 1295.

[6]Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, ‘A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians’ (Ministry of Electronics and Information Technology, 2018).

[7]DPDP Act 2023, s 16(1).

[8]DPDP Act 2023, s 16(2).

[9]DPDP Act 2023, s 8(5).

[10]DPDP Act 2023, s 8(6).

[11]DPDP Act 2023, s 8(10).

[12]DPDP Act 2023, s 11.

[13]DPDP Act 2023, s 12.

[14]DPDP Act 2023, s 13.

[15]Puttaswamy (n 2).

[16]Justice K.S. Puttaswamy (Aadhaar-5J.) v Union of India (2019) 1 SCC 1.

[17]Regulation (EU) 2016/679 (General Data Protection Regulation), arts 44–49.

[18]Data Protection Act 2018 (UK), as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (UK GDPR).

[19]Personal Data Protection Act 2012 (Singapore), s 26.