India has adopted the lightest cross-border transfer rule of any major data protection law. That lightness is misleading. This note explains what Section 16 and Rule 15 require, where the real restrictions are, and how to analyse the most common group structure.
The rule
The Act allows the Government to prohibit transfers of personal data to countries it names in a notification.[1] It preserves any other law that imposes a stricter rule.[2] The Rules add one condition: a business transferring data abroad must meet whatever requirements the Government sets, by general or special order, about making that data available to a foreign government or its agencies.[3]
That is the whole regime. There is no approved-country list, no standard contract, no impact assessment, no prior approval. Transfer is allowed unless a country is blacklisted or an order is made. No country has been blacklisted and no order has been made. Section 16 starts on 13 May 2027. Until then the 2011 Sensitive Personal Data Rules apply, and they are in some ways stricter: sensitive data can go abroad only to a recipient with the same level of protection, and only where necessary for a contract or with consent.[4]
Where the real restrictions are
The DPDP layer is the thinnest of several. Sectoral rules stay in force. The RBI requires payment system data to be stored only in India.[5] The RBI, IRDAI and SEBI each have outsourcing and cloud frameworks with location and approval conditions. Telecom licences
[1] Digital Personal Data Protection Act, 2023 (“the Act”), s. 16(1).
[2] Act, s. 16(2).
[3] Digital Personal Data Protection Rules, 2025 (“the Rules”), r. 15.
[4] Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, r. 7.
[5] Reserve Bank of India, Directive on Storage of Payment System Data, 6 April 2018.
restrict data flows. CERT-In requires certain logs to be kept in India.[1] If you are regulated by any of these bodies, clear their rule first; Section 16 adds nothing to it.
The second restriction is aimed at the largest businesses. Once the Government designates a company as a Significant Data Fiduciary, it must keep in India any category of personal data the Government specifies.[2] No company has been designated and no category specified. But this is where a real localisation requirement will first appear.
Who the Act reaches
The Act applies to processing in India, and to processing abroad only where it is connected with offering goods or services to people in India.[3] A foreign company processing Indian data for its own purposes, unconnected with selling anything to anyone in India, is outside the Act. The only regulated party is the Indian business that sent the data. Indian companies processing foreign individuals’ data for foreign clients are largely exempt.[4]
The foreign parent and your employees
An Indian company employs staff. Its HR system is a global platform run by its foreign parent. Employee data is entered in India, stored abroad, and used for payroll, performance, benefits and group reporting. Three steps.
First, the Indian company is the Data Fiduciary. It decides why and how its employees’ data is processed. Its lawful basis is the employment exemption, which covers payroll, performance, leave, benefits and discipline without consent.[5] Do not ask employees for consent for these things: consent at work is hard to call free, and a consent that fails that test weakens your position.
Second, where the parent processes the data for the Indian company’s purposes, the parent is a Data Processor. The Indian company may use it only under a valid contract, must extend its security obligations to the parent by contract, and remains responsible for whatever the parent does.[6] The transfer itself is unrestricted until a notification or order says otherwise. The work is the contract. Third, identify where the parent stops being a processor. Group talent analytics, succession planning across entities, due diligence for a deal, and reporting to the parent’s own regulators are the parent’s purposes, not the subsidiary’s. For those, the parent is acting for itself. On the text of the Act, it is outside Indian jurisdiction, because employment processing is not offering goods or services to people in India. That does not make the processing unregulated. It makes the Indian company solely responsible for having disclosed the data. Whether group reporting
[6] CERT-In Directions under s. 70B(6) of the Information Technology Act, 2000, 28 April 2022 (logs to be maintained in India for 180 days).
[7] Act, s. 10; Rules, r. 13(4).
[8] Act, s. 3(a) and (b).
[9] Act, s. 17(1)(d).
[10] Act, s. 7(i); s. 2(i) (definition of Data Fiduciary).
[11] Act, s. 8(1) and (2); Rules, r. 6.
is an “employment purpose” is the open question. Reporting that affects the individual’s pay, role or job is defensibly within it. Analytics that serve the group’s planning and do not touch the individual are harder to fit.
The document that resolves this is an intra-group data transfer agreement. It makes the parent a processor for employment purposes and binds it to the security terms; it confines the parent’s own-purpose processing to a defined list, each item justified or made subject to a genuinely optional consent; and it requires return or deletion when the arrangement ends. Sign it before 13 May 2027. It is the first thing the Board will ask for.
Foreign government access
Rule 15 is about one thing: Indian personal data ending up with a foreign government. A US parent is subject to laws that can compel it to produce data it controls wherever it is stored. Contract now for the parent to notify you of any such request, to resist it where lawful, and to keep your data segregated so a request can be answered narrowly. When the Government makes an order under Rule 15, those terms will be your evidence of compliance.
What to do
Map every flow of personal data leaving India: dataset, destination, recipient, purpose. For each, identify who is fiduciary and who is processor, and paper the processor relationships. Clear the sectoral rules first. Assess whether you are likely to be designated a Significant Data Fiduciary, because that is where localisation will bite. Sign intra-group agreements on the structure above. Build a process to act on a blacklisting notification within days, because the Act gives no transition period.
The open questions
Whether “transfer” includes remote access to data stored in India from abroad. The RBI treats access as processing, and the Board is likely to follow. Whether a foreign group company processing Indian employee data for its own purposes is ever within the Act; the answer above rests on the words of Section 3, not on any decision. And what conditions a Rule 15 order will impose, which cannot be known until one is made. A business that has mapped its flows, papered its processors and confined its parent’s purposes is ready for each answer.
This note is published for general information. It states the position as understood on the date shown and is not legal advice. It does not create a lawyer–client relationship and is not an invitation to engage the firm.
