Cross-Border Data Transfers Under the DPDP Act, 2023

Introduction

In today’s interconnected digital world, data does not stay within national borders. Companies often store or process personal data using servers located outside India.

To regulate this, the DPDP Act, 2023 provides rules governing cross-border transfer of personal data to ensure that Indian users’ data remains protected even when transferred abroad.

1. What is Cross-Border Data Transfer?

Cross-border data transfer occurs when:

• Personal data collected in India

• Is transferred to another country

• For storage, processing, or business operations

Example:An Indian user signs up for an international cloud service, and their data is stored on foreign servers.

2. Legal Framework Under the DPDP Act

The Act follows a “whitelisting approach.”

This means:

• Personal data may be transferred outside India

• Except to countries restricted by the Central Government

The Government has the authority to:

• Notify countries where data transfer is restricted

• Impose conditions for international transfers

3. Key Principle

The Act does not prohibit all cross-border transfers.

Instead, it allows transfers unless specifically restricted.

This makes it a flexible and business-friendly framework while maintaining regulatory control.

4. Government’s Power

The Central Government can:

• Specify countries where data transfer is prohibited

• Impose conditions on certain categories of data

• Modify restrictions based on national security or public interest

This ensures sovereignty and data protection balance.

5. Why Regulation Is Important

Cross-border transfers raise concerns such as:

• Different privacy standards in other countries

• Risk of misuse of data

• Lack of jurisdictional control

• Enforcement difficulties

Therefore, regulatory oversight is necessary.

6. Compliance Requirements for Organisations

Before transferring data internationally, organisations must:

• Ensure lawful processing

• Maintain security safeguards

• Follow government restrictions

• Continue protecting data even after transfer

Security obligations remain applicable irrespective of location.

7. Connection with Constitutional Privacy

🔹 Justice K.S. Puttaswamy v. Union of India

The Supreme Court recognized privacy as a fundamental right.

This judgment laid the foundation for regulating data flows, including international transfers, to ensure protection of personal information.

8. Practical Impact

For businesses:

• Enables global operations

• Allows cloud computing

• Supports international partnerships

For individuals:

• Ensures continued data protection

• Provides regulatory oversight

Conclusion

Cross-border data transfer provisions under the DPDP Act, 2023 create a balanced system that:

• Allows global digital operations

• Protects national interests

• Maintains privacy safeguards

• Gives the Government regulatory authority

This makes India’s data framework aligned with global digital economies.