Cross-Border Data Transfers Under Indian Data Protection Laws

Businesses increasingly depend on global cloud infrastructure, international group companies, overseas vendors and remote service providers. As a result, cross-border data transfers have become an important legal and operational issue for organisations operating in India. Personal data may move from an Indian customer to a cloud server overseas, from an Indian subsidiary to its foreign parent company, or from an Indian business to an international analytics or support provider.

India's regulatory framework is evolving through the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The framework generally permits international transfers, while giving the Central Government power to restrict transfers to specified countries or territories. However, this does not mean businesses can ignore sector specific localisation rules, contractual obligations, security requirements or foreign privacy laws.