Last review date: 20 December 2024

Transfers of personal data to third countries are only permissible if there is a legal basis for the processing/transfer and one of the following applies:

☒  other solutions

Please see the separate question for information on data localization provisions that are not restricted to personal data.

Under the DPDP Act, a transfer of personal data for processing is permitted to any country or territory outside India, except to those specifically blacklisted by the Government of India. The list of countries to whom cross-border data transfers are not permitted has yet to be notified by the Government of India.

Separately, under the Privacy Rules, the transfer of sensitive personal data to a third party (whether located in India or elsewhere) is only permitted if:

• The recipient ensures the same level of data protection that is adhered to by the data controller, and
• The transfer of sensitive personal data is:
  • Necessary for the performance of a lawful contract between the collector and data subject, or
  • Has been expressly consented to by the data subject