Indian businesses increasingly rely on international cloud platforms, overseas service providers, multinational group companies and global technology infrastructure. These arrangements frequently involve the movement of customer, employee and business related information across national boundaries. This raises an important legal question: can Indian businesses transfer personal data outside India?
The answer is yes, subject to applicable legal and regulatory requirements. India’s approach to cross-border data transfer is evolving through the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules). However, businesses must also consider existing obligations under the Information Technology Act, 2000, sector specific regulations and applicable foreign data protection laws. Understanding these requirements is essential before transferring personal information to an overseas entity.
What Is Cross-Border Data Transfer?
Cross-border data transfer refers to the movement, disclosure, transmission or availability of personal data from one country to another for processing, storage, access or other business purposes. For example, an Indian company using a cloud hosting provider with servers in Singapore may transfer personal data outside India. Similarly, a business sharing employee information with its overseas parent company or engaging an international payroll provider may undertake cross-border data processing.
Such transfers are common in information technology, banking, healthcare, e-commerce, financial services and business process outsourcing. Although international data sharing can improve operational efficiency, it also creates privacy, cybersecurity and regulatory risks.
What Does the DPDP Act, 2023 Say About Cross-Border Data Transfers?
Section 16 of the DPDP Act establishes the framework governing the transfer of personal data outside India. It empowers the Central Government to restrict a Data Fiduciary from transferring personal data for processing to specified countries or territories through a government notification. This represents a relatively permissive approach compared with regulatory frameworks requiring prior approval or an approved list of countries. International transfers are contemplated by the legislation, subject to restrictions imposed by the Government.
Section 16(2) is equally important. It clarifies that the DPDP Act does not override any existing Indian law providing a higher degree of protection or greater restrictions on international data transfers. Consequently, businesses cannot rely exclusively on the DPDP Act when assessing overseas data sharing. They must also identify sector specific requirements and other applicable legal obligations.
An important implementation update: Although the DPDP Act received presidential assent in August 2023 and the DPDP Rules were notified in November 2025, the substantive provisions relating to personal data processing and international transfers have a phased commencement.
Under the Government’s notification dated 13 November 2025, Section 16 is scheduled to come into force eighteen months after publication, namely 13 May 2027. Rule 15 follows the corresponding implementation timeline. Therefore, as of November 2026, businesses should not incorrectly assume Section 16 and Rule 15 are already operational. They should continue complying with the existing applicable framework while preparing for the forthcoming requirements.
What Does Rule 15 of the DPDP Rules, 2025 Provide?
Rule 15 addresses the transfer of personal data outside the territory of India. It permits such transfers, subject to requirements the Central Government may specify through general or special orders.
These requirements concern making personal data available to a foreign State, a person or entity under the control of a foreign State, or an agency of such a State. Importantly, Rule 15 does not prescribe a universal requirement for Standard Contractual Clauses or an adequacy assessment before every international transfer. Nor does it establish a blanket prohibition on using overseas cloud infrastructure. However, the Government retains the authority to introduce additional requirements. Businesses should therefore monitor relevant notifications and assess whether their international service providers or corporate arrangements could fall within future restrictions.
Do Existing Indian Laws Restrict International Data Transfers?
Yes. Even before the substantive DPDP provisions commence, certain Indian laws impose obligations concerning personal information transferred outside the country.
1. Information Technology Act and SPDI Rules
The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 currently remain relevant. Rule 7 of the SPDI Rules governs the transfer of sensitive personal data or information. It permits transfers to another body corporate or person in India or abroad, provided the recipient ensures the same level of data protection as required under the Rules.
The transfer must also be necessary for the performance of a lawful contract between the body corporate and the information provider, or take place with the provider’s consent. Sensitive personal information includes specified categories such as passwords, financial information, health conditions, medical records and biometric information. Businesses handling such information should examine the purpose of the transfer, the recipient’s security arrangements and the contractual safeguards before sharing it internationally.
2. Reserve Bank of India Requirements
Businesses operating in the banking and payment ecosystem may face additional restrictions. The RBI’s 2018 circular on Storage of Payment System Data requires payment system providers to store payment system data in systems located in India. The RBI has clarified that overseas processing may be permitted in specified circumstances, but the data must be returned to India and deleted from overseas systems within the prescribed timeframe.
This requirement is particularly relevant to payment gateways, payment service providers, banks and third party technology vendors supporting payment operations.
3. CERT-In Directions
The Indian Computer Emergency Response Team (CERT-In) issued cybersecurity directions under Section 70B of the Information Technology Act in April 2022. Among other requirements, covered entities must maintain logs of their information and communication technology systems securely for a rolling period of 180 days within Indian jurisdiction.
These requirements should not be confused with a blanket localisation requirement for all personal data. Businesses must identify the particular records covered by the directions and implement appropriate retention arrangements.
Does the DPDP Act Require All Personal Data to Be Stored in India?
No. The DPDP framework does not impose universal data localisation on all Indian businesses. Section 16 adopts an approach under which international transfers may be restricted by Government notification. This is different from requiring every organisation to maintain all personal information exclusively on Indian servers.
However, additional requirements may apply to Significant Data Fiduciaries. Section 10 of the DPDP Act and Rule 13 of the DPDP Rules provide for restrictions concerning specified personal data and related traffic data, where the Government imposes such requirements. Businesses should therefore distinguish between general data protection obligations and specific localisation requirements applicable to particular entities, data categories or industries.
What Should Businesses Do Before Transferring Personal Data Overseas?
A legally compliant international data transfer requires more than selecting a cloud service provider or signing a technology agreement. Businesses should adopt a structured compliance approach.
Identify the personal data being transferred – Organisations should identify whether the information concerns customers, employees, vendors or other individuals. They should also determine whether sensitive personal data or information is involved.
Establish the purpose of the transfer – Businesses should document why information needs to be shared overseas and whether the proposed transfer is necessary for the relevant business activity.
Review the recipient’s data protection practices – Organisations should assess the recipient’s security standards, access controls, confidentiality arrangements, retention practices and breach response procedures.
Review contractual safeguards – Agreements with overseas vendors should address permitted processing activities, confidentiality, security obligations, subcontracting, breach notifications, deletion requirements and responsibility for regulatory non-compliance.
Check sector specific requirements – Businesses should determine whether RBI directions, CERT-In requirements or other industry regulations impose additional obligations.
Monitor foreign legal requirements – International transfers may also be subject to overseas privacy laws. For example, Indian businesses processing personal data within the territorial scope of the European Union’s GDPR may need to comply with its international transfer requirements, including appropriate safeguards under Chapter V.
Why Is Legal Advice Important for Cross-Border Data Protection?
International data sharing frequently involves multiple organisations, jurisdictions and contractual relationships. A transfer which appears operationally straightforward may create regulatory exposure if the parties have not properly assessed their responsibilities. Businesses should review their privacy notices, data processing agreements, vendor contracts and internal data governance policies before establishing overseas processing arrangements.
Obtaining advice from cross-border data protection lawyers can help organisations identify applicable Indian and international requirements, evaluate transfer risks and structure appropriate contractual safeguards. Similarly, lawyers can assist with technology contracts, cloud service arrangements, outsourcing agreements, cybersecurity obligations and regulatory considerations arising from international business operations.
A proactive legal review can help organisations reduce compliance risks while maintaining the operational benefits of global technology infrastructure.
Conclusion
Indian businesses can transfer personal data outside India, but the applicable legal requirements must be assessed carefully. The DPDP Act, 2023 introduces a framework under which the Government can restrict transfers to specified jurisdictions, while Rule 15 provides for additional requirements concerning access by foreign States and related entities. However, businesses must not overlook existing obligations under the SPDI Rules, RBI directions, CERT-In requirements and applicable foreign privacy laws.
With the substantive cross-border transfer provisions of the DPDP framework scheduled to commence on 13 May 2027, organisations should use the transition period to review their international data flows, vendor relationships, contractual safeguards and information security arrangements. Businesses may also seek advice from technology lawyers for businesses when assessing their data protection obligations and international compliance requirements. A well-structured compliance framework can support international business operations while protecting individual privacy and reducing regulatory exposure.
Frequently Asked Questions
1. Can Indian companies transfer personal data to foreign countries?
Yes. Indian companies can transfer personal data overseas, subject to applicable laws, regulatory restrictions and sector specific requirements. The DPDP Act introduces a framework permitting transfers unless the Government restricts specified destinations.
2. Is consent required for cross-border data transfers in India?
Consent requirements depend on the applicable legal framework and the nature of the processing. Under Rule 7 of the existing SPDI Rules, transfers of sensitive personal data require consent or necessity for performing a lawful contract, along with the prescribed level of protection. Under the DPDP framework, consent requirements relate to the underlying processing activity rather than creating a separate universal consent requirement for every international transfer.
3. Does India have a data localisation requirement?
India does not impose a blanket data localisation requirement on every business. However, specific sectors and categories of information may be subject to localisation obligations under applicable regulations. The DPDP framework also permits additional restrictions for specified entities and data categories.
4. Can Indian businesses use foreign cloud storage providers?
Yes, subject to applicable legal and regulatory requirements. Businesses should assess the location of data storage, overseas access arrangements, contractual safeguards, security practices and any sector specific restrictions before selecting a cloud provider.
5. What happens if an Indian company transfers personal data without complying with applicable laws?
Non-compliance may result in regulatory proceedings, financial penalties, contractual disputes and reputational damage. The consequences depend on the applicable legislation, the nature of the violation and the circumstances of the transfer.
6. When will the cross-border data transfer provisions of the DPDP Act become effective?
Section 16 of the DPDP Act and Rule 15 of the DPDP Rules, 2025 are scheduled to commence on 13 May 2027 under the phased implementation framework notified in November 2025.
