Can we transfer personal data outside India under the DPDP Act?
The DPDP Act permits transfer of personal data outside India, subject to any restriction the Central Government may notify in respect of particular territories. It is a permissive regime with a power to restrict, rather than a general prohibition — but sector regulators such as the RBI may impose their own localisation requirements that continue to apply alongside it.
The operational requirement is therefore knowing where your data actually goes. That means every processor and sub-processor, including the ones reached indirectly through a SaaS vendor, recorded in your RoPA with the destination.
Organisations are usually surprised by how much leaves the country through analytics, support tooling and email infrastructure rather than through anything they think of as a data transfer.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Dinkar Singh — Dinkar covers privacy engineering at ProtectComply — discovery, consent propagation and the evidence trail behind them.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →