They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
SECTION 16 · 0 COUNTRIES RESTRICTED (MID-2026)
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineThe DPDP Act takes a balanced approach to cross-border data transfers, permitting transfers except to countries specifically notified by the Central Government.
A negative-list model: transfers are permitted by default, and as of mid-2026 no restricted-country list has been notified.
S.16Governing section
0Countries restricted (mid-2026)
1,000+Audits delivered
DPDP Act 2023 · Section 16 + Rule 15 · Last reviewed June 2026
Direct Answer
Can personal data leave India under the DPDP Act?
Under Section 16 of the DPDP Act 2023, a data fiduciary may transfer personal data outside India to any country except those the Central Government specifically notifies as restricted — a “negative list” approach that is far more permissive than the GDPR’s adequacy-and-safeguards model. As of mid-2026 no restricted-country list has been notified, so cross-border transfers are broadly allowed, though sectoral localization rules (such as the RBI’s payment-data mandate) can be stricter and continue to prevail.
Key Takeaways
- DPDP uses a negative-list model: transfer is allowed to every country except those notified as restricted by the Central Government (Section 16).
- This inverts the GDPR, which prohibits transfers unless an adequacy decision or safeguard (SCCs, BCRs) applies.
- Sectoral localization rules — for example the RBI requirement to store payment data in India — are stricter and prevail over the Act.
- Accountability stays with the data fiduciary: all DPDP obligations follow the data abroad, so contractual safeguards and transfer records remain essential.
Section 16
Key Principles
Negative List Approach
Transfer is permitted to all countries EXCEPT those specifically notified by the Central Government
Government Notification
Central Government will notify countries/territories where transfer is restricted based on security considerations
Contractual Safeguards
Data Fiduciaries must ensure appropriate contractual arrangements with foreign processors
Continued Obligations
All DPDP Act obligations continue to apply even after data is transferred outside India
The Framework
Permitted Transfers & Restriction Factors
Permitted Transfers
Transfer of personal data outside India is permitted to all countries and territories EXCEPT:
- Countries notified by Central Government
- Territories restricted for security reasons
Restriction Factors
- National Security: Countries posing security threats may be restricted
- Diplomatic Relations: Geopolitical considerations may influence restrictions
- Legal Framework: Countries without adequate data protection laws
- Enforcement Capability: Jurisdictions where Indian laws cannot be enforced
Your Obligations
Compliance Requirements
- Verify the destination country is not on the restricted list
- Implement appropriate contractual safeguards with foreign recipients
- Ensure the foreign recipient provides equivalent data protection
- Maintain records of all cross-border transfers
- Respond to Data Principal requests regardless of data location
- Ensure breach notification obligations are met for transferred data
- Conduct due diligence on foreign Data Processors
Two Models
DPDP vs GDPR: Cross-Border Transfer
For organizations operating in both jurisdictions, the transfer mechanisms differ fundamentally.
| Aspect | DPDP Act 2023 (India) | GDPR (EU) |
|---|---|---|
| Default rule | Permitted to all countries except those notified (blacklisted) by the Central Government | Prohibited unless an adequacy decision or appropriate safeguard applies (whitelist model) |
| Mechanism | Negative list — no transfer-specific instrument required for non-restricted countries | Adequacy decisions, Standard Contractual Clauses (SCCs), or Binding Corporate Rules (BCRs) |
| Sectoral overrides | Sectoral regulators (e.g. RBI) may impose stricter localization that prevails | Member-state and sectoral rules can add conditions |
| Ongoing obligations | All DPDP obligations continue to apply to data after transfer | Controller remains accountable, and a transfer impact assessment may be required |
See the full DPDP vs GDPR comparison for a clause-by-clause breakdown.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions on transferring personal data outside India under the DPDP Act.
Does the DPDP Act allow personal data to leave India?
Yes. Section 16 of the DPDP Act 2023 adopts a negative-list (blacklist) approach: a data fiduciary may transfer personal data to any country or territory except those the Central Government specifically notifies as restricted. As of mid-2026 no such restricted-country list has been notified, so transfers are broadly permitted, subject to sectoral rules.
How does DPDP cross-border transfer differ from the GDPR?
The models are inverted. The GDPR prohibits transfers unless an adequacy decision or a safeguard such as Standard Contractual Clauses applies (a whitelist). The DPDP Act permits transfers everywhere except to notified restricted countries (a blacklist). DPDP therefore imposes fewer transfer-specific formalities, but sectoral localization rules can be stricter.
Do sector-specific data localization rules still apply under DPDP?
Yes. The DPDP Act expressly preserves stricter requirements imposed under other laws. For example, the Reserve Bank of India mandates that payment system data be stored in India. Where a sectoral regulator imposes localization, that rule prevails over the Act’s more permissive transfer regime.
What safeguards should we put in place for cross-border transfers?
Even though DPDP does not mandate a specific transfer instrument for non-restricted countries, you should verify the destination is not restricted, put contractual data-protection obligations on foreign recipients and processors, ensure they can support data-principal rights and breach notification, and keep records of every transfer. These measures preserve accountability, which continues to rest with the data fiduciary.
Who is responsible for data after it is transferred abroad?
The data fiduciary remains fully accountable. All DPDP Act obligations — security safeguards, breach notification, and honouring data-principal rights — continue to apply to the personal data regardless of where it is processed. Transferring data to a processor or affiliate abroad does not transfer the legal responsibility.
Continue your DPDP research
- DPDP Act compliance hub — the full guide to the Act and Rules 2025.
- DPDP compliance consulting in India — transfer assessments and end-to-end implementation.
- DPDP penalty calculator — model your exposure under the Act.
- Tranquility Cybersecurity credentials & proof.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
DPDP vs GDPR
Side-by-side comparison for companies subject to both regimes.
Read morePrivacy
DPDP Rules 2025
The rules under the DPDP Act, each with its start date and what it asks of a company.
Read morePrivacy
GDPR Compliance
The EU's data protection regulation for any company with EU users.
Read morePrivacy
PDPL Compliance (KSA & UAE)
Saudi Arabia's SDAIA-enforced privacy law and the UAE's federal PDPL.
Read morePrivacy
ISO 27701 (PIMS)
The privacy extension to ISO 27001 — one audit, two certificates.
Read moreDPDP course · Module 5 of 8
Previous · Module 44.8 Penalties and how enforcement worksCourse map8 modules · 79 lessons · 24 readyNext5.10 The hard cases
Next in the course: 5.6 Data localisation across Indian laws. Parth Chauhan is writing it.