Cross-Border Data Transfer Under DPDP: What's Actually Restricted
Unlike GDPR's adequacy-decision framework, DPDP takes a blocklist approach, data transfer out of India is generally permitted except to specifically restricted countries.
The DPDP Act takes a notably different approach to cross-border data transfer than GDPR: rather than requiring an adequacy decision or standard contractual clauses for each destination country, DPDP permits transfer to any country by default, except those the Indian government specifically restricts via notification. This is structurally simpler for companies used to navigating GDPR's transfer mechanisms, but it also means the restricted list can change, and compliance requires monitoring it rather than relying on a one-time assessment.
Sector-specific restrictions can still apply on top of DPDP's general rule, certain categories of data (in specific regulated sectors) may carry additional localization or transfer requirements under sectoral regulation, independent of DPDP itself.
For most foreign companies with routine data flows between an Indian subsidiary and global systems, DPDP's general permissiveness on cross-border transfer is good news, but it shouldn't be assumed to override any sector-specific data localization rules that separately apply to the business.