#India Is Pitching BRICS a Payments Rail. Its Cross-Border Data Transfer Rules Under the DPDP Act Are Blank.

On 10 September, two days before the 18th BRICS Summit opened in New Delhi, India's position on a bloc-wide payments system became public: link the members' central bank digital currencies to each other, and drop the idea of a single shared network. It is a serious proposal with a specific consequence nobody at the summit will be asked about — cross-border data transfer under the DPDP Act, the statute that is supposed to govern where Indians' personal data ends up, is a power the Government holds and has never once exercised.

That matters this week because the architecture being discussed at Bharat Mandapam would route Indian retail payment data through central banks in Brazil, Russia, China, South Africa and a widening list of partner states. India has exactly one binding rule about where that data may sit, and it was written by the Reserve Bank of India in 2018, eight years before the DPDP regime existed.

#What India actually put on the BRICS table

The 18th BRICS Summit runs 12–13 September 2026 in New Delhi, under an Indian chairship themed "Building for Resilience, Innovation, Cooperation and Sustainability." Digital public infrastructure sits inside the Innovation pillar, alongside AI, start-ups and R&D.

On 10 September, reporting confirmed that the RBI's preferred model is linking BRICS members' CBDCs for cross-border settlement rather than building a bloc-wide rail, and that India has ruled out backing a unified BRICS payments network. The stated rationale is partly geopolitical — New Delhi has no interest in a project read as an attack on the dollar, and has its own reservations about deepening financial plumbing with China. It is also practical: bilateral linkage is how India has already exported UPI, which by September 2026 is live in eleven countries including Singapore, the UAE, France, Sri Lanka, Mauritius and Cambodia.

Bilateral linkage, though, is not a lighter-touch option for personal data. It is the heavier one. A single bloc-wide system would have needed one negotiated data regime. Ten bilateral CBDC or fast-payment linkages need ten, each with a counterparty whose domestic privacy law ranges from Brazil's LGPD to Russia's data-localisation statute to China's PIPL — and India currently brings no framework of its own to those negotiations.

That gap was flagged two days ago. In a 9 September analysis, ThePrint set out the two regimes that actually govern Indian payment data — the DPDP Act 2023 and the RBI's circulars — and asked practitioners how a BRICS rail would sit inside them. Senior advocate N.S. Nappinai made the structural point plainly: "Municipal laws will always prevail over international covenants," and the RBI circular, "being delegated legislation, is easier to modify than parliament enacted laws." Legal director Prasanth Sugathan, quoted in the same piece, argued that memoranda of understanding and shared technical standards — the UPI method — would be preferable to a formal treaty structure.

Read those two observations together and the picture is uncomfortable. The instrument that can be changed fastest is the one written by a sectoral regulator; the instrument Parliament passed is the one that, on cross-border transfers, says almost nothing.

#Cross-border data transfer under the DPDP Act is a power nobody has used

Section 16 of the DPDP Act 2023 does not work the way GDPR Chapter V does. There is no adequacy assessment, no standard contractual clauses, no binding corporate rules. Instead the Central Government may, by notification, restrict transfers of personal data to specified countries or territories. Everything not on that list is permitted. It is a negative list — a blacklist — and it is a policy lever, not a rights test.

Three facts about that lever, as of today:

1. No country has ever been notified. As of mid-2026 the Government has published no restricted-country list, which means cross-border transfer under the DPDP Act is, in practice, unrestricted.
2. Rule 14 of the DPDP Rules 2025 widens the discretion rather than narrowing it. It provides that a data fiduciary processing personal data in India, or outside India in connection with offering goods or services to Indian data principals, may transfer that data abroad subject to such requirements as the Central Government may specify by general or special order. No such order has issued.
3. Neither provision is in force yet. Rule 14 sits in the tranche of operational rules that commences on 13 May 2027, eighteen months after the Rules were notified on 13 November 2025. The only tranche live today is the administrative machinery; the next, on 13 November 2026, is Rule 4 — consent manager registration.

So the honest statement of Indian law on cross-border data transfer in September 2026 is: a power exists, it has never been used, and it does not bite for another twenty months. Any BRICS payments linkage agreed this week will be negotiated, built and probably piloted before the DPDP Act has anything operative to say about where the data goes.

#The RBI's 2018 circular is the only rule with teeth — and it cuts the other way

What fills the vacuum is circular DPSS.CO.OD No. 2785/06.08.005/2017-2018 of 6 April 2018, which requires all authorised payment system operators to store the entire data relating to their payment systems — customer data, payment credentials, transaction details — only in India, so the RBI has unfettered supervisory access.

The circular does contemplate cross-border transactions. Data on the foreign leg may be stored abroad, and data processed abroad must be deleted from foreign systems and brought back to India within one business day or 24 hours of processing, whichever is earlier. That is a workable rule for a card transaction cleared through a foreign network. It is a much harder fit for a CBDC linkage, where settlement finality happens on a foreign central bank's ledger and the "foreign leg" is not a discrete processing step you can wind back in a day.

Section 16(2) of the DPDP Act preserves this. It expressly does not disturb any other law that imposes a higher degree of protection or restriction on transfers abroad. The RBI's localisation mandate therefore survives the DPDP regime intact and continues to prevail. Which produces the arrangement Nappinai described: the operative constraint on BRICS payment data is a 2018 supervisory circular, amendable by the RBI without going back to Parliament, and the statute is silent.

For Indian businesses, that is not an abstraction. Banks, payment aggregators and fintechs that spent 2018–2020 repatriating payment data are the entities that would have to re-plumb for a CBDC linkage, and they would be doing it against a circular that could be modified faster than they can migrate — with the DPDP Act's own transfer conditions arriving mid-build in May 2027. Our /resources library tracks how the two regimes interact for regulated entities.

#The Significant Data Fiduciary tier that would have covered this is empty

There is one more place the DPDP framework could have reached a BRICS rail: Significant Data Fiduciary designation. Rule 13 of the DPDP Rules 2025 loads extra duties onto SDFs — an India-based Data Protection Officer, an independent data auditor, an annual Data Protection Impact Assessment, algorithmic due diligence, and compliance with any Government direction that specified categories of personal data and traffic data not be transferred outside India.

That last item is the sharpest localisation instrument in the entire DPDP architecture. It is also, right now, aimed at nobody. As of 6 September 2026, no entity or class of entities has been notified as a Significant Data Fiduciary. The large payment platforms and banks that would obviously qualify are, in DPDP terms, ordinary data fiduciaries with no localisation direction applicable to them.

MeitY has signalled it wants to move faster here — at a stakeholder meeting in January 2026 it floated compressing the SDF compliance window from eighteen months to twelve and notifying cross-border restrictions for SDFs. Eight months later, neither the designation nor the restrictions have been notified.

#No regulator is available to referee any of it

The institution meant to enforce all of this is the Data Protection Board of India, and it still has no one in it. MeitY issued notices inviting applications for the Chairperson and four Member posts on 6 May 2026 and again on 6 June 2026. As of August, no appointment had been made.

The consequences are already reaching courts. In a 1 August analysis for LiveLaw, Dr Raghvendra Kumar Chaudhary of CHRIST University documented Parth Sharma v. Union of India, in which the Madhya Pradesh High Court directed a petitioner to approach the Board within seven days and expect a reasoned decision within fifteen — to a body with no members capable of hearing it.

The same vacancy is what makes the November 2026 milestone precarious. Consent managers must register with the Board from 13 November 2026, and operating as one without registration exposes an entity to penalties of up to ₹50 crore. The registrar does not yet exist. If you are building consent infrastructure against that date, our /consent-manager guidance walks through what the Rule 4 conditions actually require.

#Where this leaves the EU, and why it compounds

India's cross-border position is not being read only by BRICS partners. The India–EU Free Trade Agreement was concluded on 27 January 2026, and it did not deliver adequacy: the European Commission has not recognised India in its adequacy decisions, with cross-border data governance instead slated for review within five years of entry into force. In April 2025 the European Data Protection Supervisor declined a European Investment Bank request to transfer contact data to India on framework-adequacy grounds.

The structural obstacle is precisely the one BRICS week exposes. GDPR transfers run on assessed, reviewable mechanisms; DPDP transfers run on an unnotified government list. A regime whose transfer rule is "whatever the executive later decides, enforced by a board that has not been constituted" is difficult to assess for adequacy in either direction. Every month the list stays blank and the Board stays empty, the adequacy conversation gets harder — and if India now layers bilateral CBDC data-sharing arrangements on top, European regulators will be assessing a moving target.

#What Indian businesses should actually do before May 2027

Nothing in this argues for waiting. Three things are worth doing now, regardless of what the summit declaration says.

Map your transfer surface before the list exists. The point of the negative-list design is that restrictions can arrive by notification, with no consultation obligation and no transition period written into Section 16. Firms that know which processors, sub-processors and group entities in which jurisdictions touch Indian personal data can respond to a notification in weeks. Firms that do not will be doing discovery under a deadline.

Treat the RBI circular as the live rule and the DPDP Act as the coming one. For regulated financial entities, payment data localisation is enforceable today and DPDP transfer conditions are not. Build to the stricter of the two; Section 16(2) guarantees the sectoral rule survives anyway.

Assume Significant Data Fiduciary designation is coming and cheap to prepare for. A DPO, an annual DPIA and algorithmic due diligence are defensible governance whether or not the notification names you. MeitY has already said it wants the SDF timeline shortened, and a designation arriving with a twelve-month window is very different from one arriving with eighteen.

The gap this week makes visible is not that India is negotiating cross-border payments. It is that India is negotiating them while its own cross-border data transfer rules are an unexercised power, its localisation mandate is a 2018 circular, its toughest localisation tool points at an empty category, and its regulator has no members. The BRICS declaration will be drafted in the language of data sovereignty — the Data Economy Governance Understanding adopted at Rio last year already commits the bloc to balancing sovereignty with trusted flows. Sovereignty over data is a claim you have to be institutionally capable of making. On 11 September 2026, India is making it from a statute whose transfer chapter has never been switched on.

If you are assessing what the DPDP Act's cross-border rules mean for your data flows, start with a transfer map and a designation assumption. Our /resources library keeps the phased DPDP timeline — 13 November 2026, 13 May 2027 — alongside what each tranche actually obliges you to have in place.