Cross-border data transfer under DPDP: the negative list mechanism explained

SSection 16 of the DPDP Act takes a distinctive approach to cross-border data transfer. Unlike the GDPR, which requires an adequacy decision or appropriate safeguards before personal data can leave the EEA, the DPDP Act presumes that transfer to any country is permissible — except where the Central Government has expressly notified that country to the contrary. The negative list mechanism is one of the few areas where Indian law is more permissive than its European counterpart.

How the mechanism works

Three operative pieces:

• Section 16(1) authorises transfer to any country not specifically restricted.

• Section 16(2) preserves stricter sectoral regimes — banking, telecom, healthcare may impose stronger localisation than DPDP itself.

• Section 16(3) creates the negative list: any country the Central Government notifies becomes a restricted destination.

As of writing, no country has been added to the negative list. The list is reviewed annually. The expectation among practitioners is that countries with documented hostility to India's strategic or commercial interests are the candidates — though the Act gives no statutory criteria, leaving the executive a wide margin of discretion.

What it means for SaaS contracts

The practical effect is that most India-to-overseas data flows are presumptively lawful under the DPDP framework. Standard contractual clauses in SaaS agreements are not required by Indian law — though most enterprise buyers will still demand them on the strength of their own GDPR or local-law obligations. The contracting team's job is largely to make sure that the sectoral overlay (RBI, IRDAI, TRAI) is identified and respected before relying on the general DPDP permission.

The unresolved RBI question

The most important friction is between DPDP and the RBI's 2018 payments data localisation directive, which mandates that payments data be stored only in India. DPDP does not override sectoral law, so the RBI position controls — but the boundary between 'payments data' and 'personal data of a payments user' has never been crisply drawn. Until the regulators issue a joint clarification, enterprise teams should assume the stricter regime applies.