BACK TO DPDP RULES INDEX
DPDP Rules 2025 Phase 3 (13 May 2027 (but negative list not yet notified — transfers currently unrestricted)) CROSS_BORDER

Rule 8

Restriction on Transfer of Personal Data Outside India

Practical Note

The critical practical point: the negative list has NOT been notified as of the Rules' commencement. Until the Central Government notifies which countries are on the negative list, there are NO restrictions on cross-border transfers. However, businesses should begin mapping where they transfer Indian user data — the negative list could be notified at any time and will require immediate compliance changes.

THE STATUTE

Original Text

(1) Subject to such conditions as the Central Government may, by notification, specify, a Data Fiduciary may transfer personal data of a Data Principal to any country or territory outside India, other than the countries or territories to which the Central Government may, by notification, restrict the transfer of personal data.

Analysis & Details

Rule 8 implements DPDP Act Section 16's cross-border transfer framework — a permissive, negative-list model that is fundamentally different from GDPR's restrictive, positive-adequacy approach. Under DPDP Rule 8, personal data can be transferred to ANY country UNLESS that country appears on the Central Government's 'negative list'. No additional safeguards (SCCs, BCRs, binding corporate rules) are required for permitted transfers — the absence of a country from the negative list is sufficient authorisation. This permissive model is more business-friendly than GDPR but raises concerns about protection standards in destination countries. Contrast with GDPR: under GDPR Articles 44–49, transfers outside the EU are prohibited unless the destination country has an adequacy decision from the European Commission, or the data exporter has implemented appropriate safeguards (Standard Contractual Clauses, Binding Corporate Rules, or other Article 46 mechanisms). GDPR starts with 'no' and requires a positive justification; DPDP starts with 'yes' and only restricts where specifically prohibited. The negative list has not been notified as of the Rules' commencement (13 November 2025). This means, practically, that cross-border transfers are currently unrestricted — there are no countries on the negative list yet. The negative list is expected to include countries with poor data protection standards, geopolitical adversaries, or countries that have demonstrated risk of misusing Indian citizens' data. China, Pakistan, and other geopolitically sensitive jurisdictions are widely speculated candidates, but nothing has been officially announced. Even after the negative list is notified, transfers to non-blocked countries remain unrestricted — unlike GDPR which requires adequacy or safeguards regardless of destination.

GDPR Parallel

Articles 44–49 (Transfers to Third Countries)

IT Act Impact

The IT Act had no cross-border transfer restrictions. Rule 8 creates the first cross-border transfer restriction framework for personal data in India. CERT-In's separate data localisation requirements for cybersecurity incident logs continue independently of Rule 8.

Common Queries

Yes — currently without restriction. Rule 8 uses a permissive model: transfers are allowed to any country UNLESS it is on the Central Government's negative list. The negative list has not been notified as of the Rules' commencement (November 2025), meaning there are currently NO restrictions on cross-border transfers. Once the negative list is notified, businesses must stop transferring to listed countries.
GDPR uses a restrictive model: transfers outside the EU are prohibited by default and only permitted if the destination country has an adequacy decision OR the exporter implements safeguards (Standard Contractual Clauses, Binding Corporate Rules, etc.). DPDP uses a permissive model: transfers to any country are permitted unless specifically prohibited by the negative list. No SCCs or adequacy assessments are required under DPDP. GDPR starts with 'no'; DPDP starts with 'yes'.
No. The DPDP Act 2023 and Rules 2025 abandoned the mandatory data localisation requirement that was in the earlier Personal Data Protection Bill 2019. There is no requirement to store a copy of personal data in India. The only restriction is the negative-list prohibition — once notified, transfers to blacklisted countries are prohibited.

Key Rules & Provisions

Permissive model: transfers allowed to ALL countries EXCEPT those on the negative list.

No SCCs, BCRs, or adequacy assessments required for permitted transfers.

Negative list not yet notified — transfers currently unrestricted (as of Nov 2025).

Fundamentally different from GDPR's restrictive adequacy-based approach.

Data localisation requirement (from PDP Bill 2019) completely abandoned.