#India's DPDP Cross-Border Data Transfer Rules Are Not in Force. Your Contracts Are Being Redrafted as If They Are

India's DPDP cross-border data transfer regime — Section 16 of the Digital Personal Data Protection Act, 2023 and Rule 15 of the DPDP Rules, 2025 — does not commence until 13 May 2027, and the list of restricted countries it depends on is still empty. That has not stopped a year of vendor agreements, cloud contracts and data processing addenda from being rewritten around a transfer mechanism that does not yet legally exist.

That is the argument advocate Pooja Dhumal put in a Bar and Bench column published on 18 September, which led the specialist privacy feeds through 19 September. It is uncomfortable reading for anyone who has signed off a "DPDP cross-border compliance" invoice in the last ten months — and it is also, in one important respect, incomplete. The column is right about the law as notified. It understates what MeitY has been openly proposing to do to that timeline since January.

Both halves matter, because the two together point to a drafting posture that most Indian contracts currently do not have.

#What actually commenced on 13 November 2025 — and what did not

The DPDP Rules, 2025 were notified on 13 November 2025 with a staggered commencement built into Rule 1 itself. The phase structure is unusually precise, and almost every confused client memo in circulation comes from ignoring it:

• Live since 13 November 2025: Rules 1, 2 and 17 to 21, alongside Sections 1(2), 2, 18–26, 35, 38–43 and 44(1) and (3) of the Act. These are definitions, the constitution of the Data Protection Board of India, its procedure and appeal machinery, and consequential amendments. Institutional plumbing, not duties on business.
• From 13 November 2026: Rule 4, plus Sections 6(9) and 27(1)(d) — the consent manager registration framework. Fifty-four days away.
• From 13 May 2027: Rules 3 and 5 to 16, Rules 22 and 23, and Sections 3 to 17 and 27 to 37 in substance. Notice. Consent. Security safeguards. Breach reporting. Retention. Data principal rights. And cross-border transfer.

Rule 15 sits squarely in that last bucket. So does Rule 13(4), the Significant Data Fiduciary localisation provision. Until 13 May 2027, there is no operative statutory obligation governing where an Indian data fiduciary sends personal data — a point confirmed across practitioner analyses and not seriously disputed.

The one caveat worth stating plainly: the Phase 2 and Phase 3 dates are computed from Rule 1's offsets rather than separately gazetted. They are the near-universal reading, but they are a reading.

#India chose a negative list, not adequacy. That is the whole design.

The structural point most contracts get wrong is not timing. It is model.

Rule 15 states, in substance, that a data fiduciary may transfer personal data outside India except where the Central Government restricts such transfer. No adequacy finding. No standard contractual clauses. No binding corporate rules. No transfer impact assessment. Transfers are permitted by default, and the government may later publish a negative list of restricted jurisdictions.

This is the inverse of the GDPR. Under EU law, a transfer is prohibited unless a lawful basis for it is constructed in advance — one of roughly fifteen adequacy decisions, or an Article 46 safeguard the exporter must itself paper and defend. Under the DPDP Act, the exporter does nothing until New Delhi names a country.

And New Delhi has named none. As of now, no country or territory has been notified as restricted under Section 16. The negative list is an empty set attached to a rule that has not commenced.

So when an Indian data processing agreement imports GDPR-style SCCs by reference, hardcodes Article 28 audit rights, or bolts on a Schrems-style transfer risk assessment as a DPDP requirement, it is not being cautious. It is importing the machinery of a regime India deliberately declined to adopt, and creating contractual obligations that no Indian regulator will ever ask for — but that an Indian counterparty can be sued on.

Dhumal's sharpest line is about who pays for this: firms billing for "DPDP cross-border compliance" today are billing for compliance with law that does not bind, and the column argues that work should be scoped honestly as risk preparation. "Clients deserve to know the difference between 'this is legally required now' and 'this is prudent given what's coming in 2027.'"

#Why "not in force" is not the same as "no risk"

Here is what a pure wait-and-see reading misses.

On 23 January 2026, MeitY convened stakeholders and circulated proposals to compress the DPDP compliance runway from eighteen months to twelve, with comments due by 4 February. Three items were proposed for immediate enforcement rather than waiting out the grace period:

1. Notification of Significant Data Fiduciaries and the criteria for designating them;
2. Rules 13(4) and 15 — the SDF localisation measure and the cross-border transfer provision;
3. Section 17(2), the exemption power for instrumentalities of the State.

Rule 8(3) retention limits were proposed on a 90-day clock. For SDFs, the practical effect would be to pull full compliance forward from 13 May 2027 to 13 November 2026 — the same date the consent manager window opens.

That proposal has not been gazetted. Eight months on, it remains a consultation document, and a prudent adviser should say so. But it is the government's own stated preference, it targets cross-border transfer specifically, and it would land on precisely the large financial services, health, telecom, e-commerce and platform businesses whose contracts are hardest to renegotiate at speed.

Rule 13(4) deserves attention on its own terms. It requires an SDF to ensure that personal data and the traffic data pertaining to its flow, as specified by the Central Government on the recommendation of a committee, is not transferred outside India. That is targeted localisation with a moving definition — the categories are set later, by a body whose composition and reasoning are not published in advance. The Software Freedom Law Centre has criticised exactly this delegation, arguing transfer conditions should be set out in the text of the rule rather than deferred to notification.

For an architecture decision — which region a workload runs in, whether logs leave the country — a rule whose scope is defined after you build is materially worse than one that binds today. You cannot re-region a production estate on notice.

#The localisation that already binds you

There is also a category error running through the "nothing is in force" framing. Plenty is in force; it just is not the DPDP Act.

The RBI's 2018 circular on Storage of Payment System Data requires that all payment transaction data for rupee-denominated transactions be stored in India. It admits no adequacy-style workaround, it has bound payment system operators for eight years, and it is entirely unaffected by DPDP commencement dates. Foreign banks were still in discussions with the RBI in early 2026 about migrating historical payment data held offshore since 2018.

Telecom entities report security incidents to the Central Government within six hours. CERT-In's 2022 directions impose the same six-hour clock on a broad class of cyber incidents, with criminal exposure for non-compliance. Neither waits for May 2027, and both already shape where infrastructure can sit.

So the honest statement to a board is narrower than either extreme: the DPDP Act imposes no cross-border obligation on you today; your sectoral regulator very likely does. Any contract review that conflates the two produces bad advice in both directions — over-papering the DPDP position while under-papering the RBI one.

#A drafting posture that survives either outcome

The practical question is what to put in an agreement signed this quarter that will still be sensible in November 2026 and in May 2027, under an accelerated timeline or the notified one. Four moves do that work:

Draft for change, not for a mechanism. A regulatory-change clause obliging good-faith renegotiation on notification of a Section 16 restriction costs nothing and covers every scenario. A hardcoded SCC annexure covers none of them and must be unwound.

Make data-location clauses operational, not legal. Name data centre regions, sub-processor locations and replication behaviour as commercial commitments with change-control. Those terms are enforceable now, survive any regulatory outcome, and are what you will need on the day a restricted-country list actually appears.

Spend the runway on mapping, not on drafting. The most valuable clause in a 2026 vendor agreement is a cooperation and information right that lets you find out where data actually goes. Most Indian organisations cannot answer that question today, which is why the eventual compliance exercise will be expensive regardless of what the rules say.

Check the rule numbers. The draft rules circulated in November 2024 carried the transfer provisions at Rules 12 and 14; the notified 2025 Rules carry them at Rules 13(4) and 15. A memo or template citing the draft numbering is a reliable tell that it was assembled from pre-notification commentary and never revisited.

Two further notes on precision. DPDP's own breach clock — intimate the Board without delay, detailed report within 72 hours, notify affected data principals — is Rule 7, not Article 33, and it is not the GDPR timeline even where the number matches. And a consent manager under Rule 4 is a registered intermediary, not a consent banner vendor; if you are evaluating tooling ahead of 13 November, see our consent manager breakdown before signing anything that claims registered status.

#The readiness gap points the other way

For all the talk of over-preparation, the aggregate Indian position is under-preparation by a wide margin. An EY India survey of more than 150 professionals found roughly 81% had not updated or drafted DPDP-aligned contracts, around 71% reported limited familiarity with the Act and Rules, and sectoral momentum was badly uneven — consumer and retail around 50% underway, technology services near 39%, healthcare and life sciences at under 10%.

That is the context for the 18 September Privacy by Design 2026 summit in Bengaluru, where roughly 250 founders and 35 venture investors spent a day on the argument that DPDP posture is a commercial asset rather than a legal cost. Eight weeks from the consent manager date, the room's problem was not that anyone had over-drafted their transfer clauses. It was that most had not looked at their data flows at all.

The two findings are not in tension. A small number of well-advised enterprises are gold-plating a cross-border regime that has not commenced; a large majority have done nothing on any part of the Act. Both are failures of sequencing, and both get fixed by the same first step — knowing where the data is before writing a clause about where it may go.

#What to do this week

Pull every agreement signed since November 2025 that contains a cross-border or data-transfer clause. Sort into three piles: clauses that impose GDPR machinery India did not adopt (renegotiate or add a change clause at next amendment), clauses that make operational location commitments (keep, and verify they are true), and agreements with nothing at all (add a regulatory-change and cooperation clause now, cheaply, before the counterparty's leverage improves).

Then watch two triggers, not a date. The first is any gazette notification acting on MeitY's January proposal — that would move Rules 13(4) and 15 forward and compress the SDF runway to weeks. The second is the first designation of Significant Data Fiduciaries, which is the moment abstract localisation exposure attaches to named companies. Neither has happened. Either can happen without warning.

For the phased commencement tables, the SDF designation criteria and our running tracker of what is actually in force, see /resources.

---

Sources: Bar and Bench · Mondaq — MeitY timeline proposals · SFLC.in · King Stubb & Kasiva · EY India · Treelife · dpdprules.org