Introduction

Cross-border data transfers have consistently occupied a complex position within data protection framework around the world. They sit at the intersection of two competing interests: on one hand, the commercial necessity of allowing personal data to move freely in an increasingly interconnected and international digital economy, and on the other, the sovereign interest of ensuring that individuals do not lose the protection of their personal data (that is ensured by domestic data protection laws) merely because their data is processed or stored outside national borders.

Overview of Cross-Border Data Transfer Principles:

The EU’s General Data Protection Regulation (“GDPR“) addresses this problem through a restrictive framework. As a general rule, personal data cannot be transferred outside the European Economic Area (“EEA“) unless the destination country has been recognised as providing an adequate level of protection, or the transfer is otherwise supported by recognised safeguards such as Standard Contractual Clauses (“SCCs”) or Binding Corporate Rules (“BCRs”).

In contrast, India’s Digital Personal Data Protection Act, 2023 (“DPDP Act“), read with the newly-framed Digital Personal Data Protection Rules, 2025 (“DPDP Rules“), propose to adopt a fundamentally different approach. Section 16 of the DPDP Act and Rule 15 of the DPDP Rules, when in full force[i], will permit cross-border transfers of personal data to any country, subject only to restrictions that the Central Government may notify from time to time.

These contrasting frameworks reflect two distinct philosophies. The GDPR follows a model, where personal data transfers are allowed only if the transferring entity can establish that adequate safeguards exist in the destination country. The GDPR regime, comprising adequacy decisions, SCCs, and BCRs, has also been extensively shaped by the jurisprudence of the EU Court of Justice of the European Union, particularly through the judgment in Schrems II[ii]. This ruling essentially reinforced the principle that international transfers require continuous assessment of the legal environment in the destination country.

The DPDP Act, however, proposes to adopt a ‘negative list’ approach, where personal data transfers are permitted outside domestic borders by default unless the Government imposes restrictions by their official notifications for such transfers to a foreign country. While Section 16(2) of the DPDP Act clarifies that the cross-border transfer framework under Section 16 does not restrict the applicability of any other law in force in India that provides a higher degree of protection for, or restrictions on, the transfer of personal data outside India, the difference between the two regimes reflects fundamentally different conceptions of how cross-border transfer risk ought to be managed.

Separately, Rule 13(4) of the DPDP Rules provides for additional restrictions in relation to Significant Data Fiduciaries. Under the said Rule, personal data specified by the Central Government, on the recommendation of a committee constituted by it, must be processed subject to the restriction that such personal data, as well as traffic data pertaining to its flow, is not transferred outside India.

Thus, while the DPDP framework does not impose a general data localisation requirement applicable to all personal data or Data Fiduciaries, specified categories of personal data processed by Significant Data Fiduciaries may be subjected to localisation restrictions through executive control.

Framework relating to cross-border transfer of personal data under the GDPR

Chapter 5[iii] of the GDPR deals with transfer of personal data to third countries[iv] or international organisations. Article 44 lays down the overarching principle that any transfer of personal data which is processed, or intended to be processed, after transfer to a third country or an international organisation must comply with the provisions of Chapter 5, in addition to the other applicable requirements of the GDPR.

Adequacy Decisions

The primary mechanism through which the GDPR permits cross-border transfers is the ‘adequacy decision’ under Article 45. Pursuant to Article 45(1), the European Commission may determine that a third country, territory, specified sector within a third country, or an international organisation ensures an adequate level of protection for personal data (the “Adequacy Decision”).

Once such an Adequacy Decision is adopted, personal data may be transferred to that jurisdiction without requiring any further authorisation or additional transfer safeguards, such as SCCs or BCRs. In effect, transfers to jurisdictions covered by an adequacy decision are treated in substantially the same manner as transfers within the EEA, as the destination jurisdiction is considered to provide a level of protection that is essentially equivalent to that guaranteed under the GDPR.

A list of countries determined to have adequate level of data protection by the Commission is provided here: Adequacy Decisions – List of Countries [v].

Appropriate Safeguards

Where the European Commission has not adopted an Adequacy Decision (under Article 45) of the GDPR, a transfer of personal data may nevertheless take place if the Data Controller or Processor implements appropriate safeguards to protect the transferred data. Such safeguards must ensure that data subjects continue to enjoy enforceable rights and have access to effective legal remedies.

Article 46 of the GDPR identifies several mechanisms that may be relied upon to provide these safeguards for transfers to countries outside the EEA. For private organisations, the principal transfer mechanisms include:

Standard Contractual Clauses (SCCs);
Binding Corporate Rules (BCRs);
Approved codes of conduct;
Approved certification mechanisms; and
Ad hoc contractual clauses.

Standard Contractual Clauses (SCCs)

SCCs are pre-approved contractual terms adopted by the European Commission that enable the lawful transfer of personal data from the EEA to Data Processors / Controllers in third countries, depending upon the transfer relationships, that are not covered by an Adequacy Decision.

Introduced in their current form on 4 June 2021, the SCCs are designed to ensure that personal data transferred outside the EEA continues to receive a level of protection consistent with the GDPR. The SCCs impose binding data protection obligations on both the Data Controller and Processor and may be supplemented with additional safeguards, provided these do not conflict with the clauses.

A list of SCCs issued by the Commission is provided here: Standard Contractual Clauses [vi].

There are additional ad hoc contractual clauses that are custom contractual clauses that Data Processors and Data Controllers may use for a specific situation instead of using SCCs. However, these ad hoc clauses require formal approval from their country’s respective data protection authorities.

Binding Corporate Rules (BCRs)

BCRs are internal data protection policies adopted by multinational group entities to facilitate the transfer of personal data between group entities located within and outside the EEA. They are particularly suited to organisations that undertake frequent intra-group cross-border data transfers. As per the provisions, BCRs must be approved by the competent supervisory authority.

To serve as a valid transfer mechanism under Article 46 of the GDPR, BCRs must be legally binding on all entities within the corporate group, irrespective of their jurisdiction, and must provide data subjects with enforceable rights in relation to the processing of their personal data.

Approved Codes of Conduct

Approved Codes of Conduct is a mechanism for facilitating international transfers of personal data in the absence of an Adequacy Decision.

Unlike Binding Corporate Rules, which are developed by individual corporate groups for intra-group transfers, codes of conduct are sector-specific frameworks formulated by associations or representative bodies for use by organisations operating within a particular industry.

To qualify as an appropriate safeguard under Article 46 of the GDPR, adherence to a code of conduct must be accompanied by a system of accredited monitoring bodies responsible for overseeing compliance.

Certification

Approved certification mechanisms under GDPR provide for transferring personal data to countries outside the EEA without an Adequacy Decision. This requires the non-EEA Data Processor and/or Data Controller to hold an approved certification and provide binding, enforceable commitments to protect personal data.

Derogations

Article 49 of the GDPR provides a limited set of derogations, or exceptions, that permit the transfer of personal data to a third country or an international organisation where neither an Adequacy Decision under Article 45 nor appropriate safeguards, such as SCCs, BCRs, and other as mentioned above, under Article 46, are available. These derogations are not intended to operate as a general rule and are to be used or applied restrictively.

The provision permit transfers in specific circumstances, including (a) where the data subject has explicitly consented to the transfer after being informed of the associated risks; (b) where the transfer is necessary for the performance of a contract or for pre-contractual measures requested by the data subject; (c) for important reasons of public interest; (d) for the establishment, exercise or defence of legal claims; (e) to protect the vital interests of the data subject or another individual; or (f) where the transfer is made from a public register.

Article 49 also permits certain non-repetitive transfers based on compelling legitimate interests of the Data Controller, subject to strict conditions and procedural safeguards as set out under the provisions.

Framework relating to cross-border transfer of personal data under the DPDP Act

Unlike the GDPR, the DPDP Act does not propose a safeguard-based framework for regulating cross-border transfers of personal data.

Upon the provisions coming in force, the DPDP Act will permit a Data Fiduciary to transfer personal data outside India except to such countries or territories as may be specifically restricted by the Central Government through subsequent notification[vii]. The DPDP Rules supplements this provision by prescribing that cross-border transfers shall be subject to any restrictions notified by the Central Government from time to time[viii]. It is yet to be seen which get restricted for cross-border personal data transfers by the Central Government by official notifications.

The key point to note here is that the new DPDP framework follows an approach, whereby transfers will be permissible by default unless the destination jurisdiction has been expressly prohibited by way of a “negative list”.

Notably, the DPDP Act does not require a Data Fiduciary to establish that the destination country provides an adequate level of data protection, nor does it mandate the implementation of recognised transfer mechanisms comparable to the GDPR’s Standard Contractual Clauses, Binding Corporate Rules or approved codes of conduct.

Additionally, there is no statutory obligation to undertake a transfer impact assessment or evaluate whether the legal framework of the destination country affords protections equivalent to those available under Indian law.

Accordingly, the legality of a cross-border transfer under the DPDP Act is determined principally by whether the destination country is subject to any governmental restriction.

Having said that, a Data Fiduciary remains responsible for complying with its continuing obligations under the DPDP Act and the DPDP Rules, including implementing reasonable security safeguards, ensuring compliance by any Data Processor engaged by it, and adhering to the statutory obligations applicable to the processing of personal data. The transfer of personal data outside India, therefore, does not relieve the Data Fiduciary of its responsibilities under the DPDP Act.

Conclusion

The GDPR and the DPDP Act reflect two distinct regulatory approaches to cross-border transfers of personal data.

The GDPR adopts a precautionary, but evolved framework in which international transfers are prohibited unless they are supported by an adequacy decision, appropriate safeguards, or one of the limited exceptional derogations prescribed under Chapter V. In contrast, the DPDP Act will adopt a permissive regime under which cross-border transfers are generally allowed, subject only to any restrictions that may be notified by the Central Government.

For organisations subject to both regimes, compliance with the DPDP Act will not, by itself, satisfy the requirements of the GDPR. Where personal data originating from the European Economic Area is transferred outside the EEA, the transfer must independently comply with the applicable mechanisms under Chapter V of the GDPR, irrespective of whether such transfer is permissible under Indian law.

Conversely, for transfers governed solely by the DPDP Act, the primary consideration will be whether the destination jurisdiction has been restricted by the Central Government, while ensuring continued compliance with the substantive obligations imposed on Data Fiduciaries under the Act.

Contributed by: Aditi Verma Thakur and Akash Sajan

[i] Pertinent to mention that Sections 11–17 of the DPDP Act were placed in 18-month commencement tranche under a government notification of November 2025, and they will be in full force by May 2027.

[ii] Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems, Court of Justice of the European Union.

[iii] Contains Articles 44, 45, 46, 47, 48, 49 and 50.

[iv] For purposes of this article, jurisdictions outside the EEA.

[v] https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

[vi] https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.

[vii] § 16, Digital Personal Data Protection Act, 2023.

[viii] Rule 15, Digital Personal Data Protection Rules, 2025.

Crossing Borders, Different Rules: GDPR vs India’s DPDP Framework