The position today
Section 16 of the DPDP Act lets the Central Government restrict the transfer of personal data to specified countries or territories by notification. Until a country is notified, transfers are allowed by default. This is the opposite of an EU-style "adequacy" regime, and far more permissive than the earlier draft bills that proposed sectoral whitelists.
No country has been notified yet. But sector regulators (RBI, IRDAI, MeitY for non-personal data and certain SDFs) can — and in some cases already do — impose localisation requirements that override the default.
What this means for your stack
- Cloud hosting — your AWS/GCP/Azure region choice is currently a business decision, not a DPDP one. But it must be disclosed.
- Analytics & ads — Google Analytics, Meta, LinkedIn pixels and similar tools transfer data abroad. You still need consent under DPDP, and the transfer must be in your notice.
- SaaS & CRM — HubSpot, Salesforce, Zendesk, Notion, Linear etc. often host outside India. Acceptable today, must be disclosed, contractually governed.
- Payment & banking data — RBI's 2018 directive on storage of payment system data still applies. If you handle payments, that's your real cross-border constraint.
What to do right now
- Map your data flows. Make a one-page table: data category, processor, region, lawful basis, retention. Update it whenever you onboard a vendor.
- Inventory your processors. Every SaaS that touches user data is a Data Processor. Have a signed agreement; document subprocessors.
- Disclose transfers in your notice. Don't hide behind "we may share with service providers globally". Name the categories and where data goes.
- Have a relocation plan. If a country gets blacklisted later, you need to know how long it would take you to move workloads. For mission-critical systems, prefer India regions when available — they're a hedge, not a requirement.
If you operate in BFSI, healthcare or telecom: your sector regulators' localisation rules likely already exceed what DPDP requires. Don't loosen them on the back of DPDP's permissive default — sector rules win.
Want a deeper dive on a specific obligation? Read the full DPDP guide or run a free compliance scan.