Cross-Border Data Transfer

India's approach to cross-border data transfer under the DPDP Act

India's Digital Personal Data Protection Act of 2023 takes a relatively permissive approach to cross-border data transfer compared with some regimes. Rather than requiring transfers to be approved case by case, it allows personal data to be transferred outside India except to countries the central government restricts by notification. This is sometimes described as a negative-list approach.

The law's rules and timelines are being implemented in phases, and supporting regulations continue to develop, so companies should check the current status rather than relying on an older summary. Sector-specific rules, such as those affecting certain financial data, may impose additional localization requirements on top of the general framework.

Obligations that follow the data

A permissive rule on cross-border data transfer does not mean the data can be handled carelessly. Under the DPDP Act, an organization that determines the purpose and means of processing, called a data fiduciary, remains responsible for the personal data it handles, including when processors act on its behalf. Consent, purpose limitation, security safeguards, and the rights of the individuals concerned continue to apply wherever the data goes.

Employee data has its own considerations in any cross-border data transfer, including limited situations where processing may be permitted for employment purposes without separate consent. Companies should work out which basis applies to each category of data they handle rather than defaulting to a single approach.

When EU or other rules also apply

Many companies operate under more than one regime. If an India-based employee's data is processed by a company with EU connections, GDPR may also apply, and cross-border data transfer from the EU to India typically requires safeguards such as standard contractual clauses. Other jurisdictions have their own rules, and some US states impose obligations too.

The practical result is that a single data flow can be subject to several sets of rules at once. A payroll file sent from an Indian provider to a European headquarters, for instance, needs to satisfy both the DPDP Act and the requirements governing the receiving party.

Practical steps for cross-border data transfer compliance

The first step is mapping what data is collected, where it is stored, and who has access, including vendors. Many companies discover that data flows more widely than they realized, through HR platforms, payroll providers, and collaboration tools, and each of those flows is a cross-border data transfer in its own right.

From there, companies should put contracts in place with every processor involved in a cross-border data transfer, specifying security measures, permitted uses, and what happens when the relationship ends. They should limit access to what is necessary, use encryption in transit and at rest, and have an incident response plan. Training employees who handle personal data reduces the risk of accidental exposure.

Employee data and trust in cross-border data transfer

Beyond legal compliance, how a company handles employee data affects trust. Employees want to know what is collected, why, who sees it, and where it goes. A short, plain-language notice answering these questions is better than a dense policy few will read.

For India-based employees working for a foreign company, it is also worth explaining that their data may be processed abroad and what safeguards are in place for any cross-border data transfer. Transparency reduces anxiety and demonstrates respect.

Choosing vendors carefully for cross-border data transfer

Because transfers often go through vendors, vendor selection matters. Ask where data is stored, which sub-processors are used, what security certifications the provider holds, and how breaches are handled and reported. A provider that cannot answer clearly is a risk.

Review these arrangements periodically, not only at signing. Vendors change sub-processors, laws evolve, and a relationship that was compliant two years ago may need updating.

Responding when a cross-border data transfer goes wrong

Even well-run programs experience incidents. A misdirected email, a lost laptop, or a vendor breach can expose employee data, and the speed and quality of the response determines how much harm results. Have a clear plan that names who investigates, who decides whether to notify affected people and regulators, and how the company will communicate.

Rehearse the plan at least once a year. A short exercise that walks through a hypothetical breach reveals gaps in contact lists, decision rights, and vendor responsibilities before a real event forces the issue. Document what you learn and update the plan, and make sure India-based staff know whom to contact if they notice something wrong.

Keeping a record of your decisions

Regulators and clients increasingly ask companies to show how they reached their decisions about personal data. Keep a short register of the data you handle, the legal basis for each use, the vendors involved, and the safeguards in place. Update it whenever a new tool is introduced or a vendor changes its subprocessors. This is not bureaucracy for its own sake. A current register is the fastest way to answer a customer's security questionnaire, respond to an employee's request about their own data, or demonstrate good faith if something goes wrong. It also reveals forgotten systems that still hold personal data long after anyone needed them. Assign an owner, review the register twice a year, and keep it simple enough that people actually maintain it. Companies that treat this record as a living document tend to spend far less time scrambling when questions arise, and far more time on the work the data was collected to support.

How kaam.work handles cross-border data transfer

kaam.work handles employee data for India-based hires under clear data processing terms, with safeguards appropriate to the client's situation, including standard contractual clauses where EU rules apply. Companies get clarity on how employee data is collected, stored, and moved, without needing to build the framework themselves.

Frequently asked questions

Does India restrict cross-border data transfer?

The DPDP Act allows transfers outside India except to countries the government restricts by notification, though sector-specific rules may add requirements.

Do obligations still apply after data leaves India?

Yes, the organization responsible for the data remains accountable for consent, purpose, security, and individual rights wherever the data goes.

What if GDPR also applies to a cross-border data transfer?

Transfers from the EU to India typically require safeguards such as standard contractual clauses, in addition to Indian requirements.

What is the first practical step for compliance?

Mapping what data is collected, where it is stored, and who can access it, including vendors and sub-processors.

How does an Employer of Record handle cross-border data transfer?

It processes employee data under clear terms with appropriate safeguards, including standard contractual clauses where EU rules apply.