Cross-Border Data Transfers under Section 16 of DPDP Act 2023: The Negative List Architecture and Sectoral Localization Mandates

I. I. The Evolution of Cross-Border Data Transfer Jurisprudence in India

For years, international trade bodies, global cloud providers, and multinational corporations watched India's evolving data localization debates with intense apprehension. Earlier legislative drafts—notably the 2018 draft bill drafted by the Justice Srikrishna Committee and the 2019 Personal Data Protection Bill—proposed strict, protectionist data localization mandates requiring live copies of all personal data to be stored within Indian geographic borders.

The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) marked a dramatic, market-oriented departure from rigid localization. Section 16 of the Act introduces a flexible, 'blacklisting' or 'negative list' architecture.

However, navigating cross-border data flows from India requires far more than reviewing Section 16. Sectoral regulators—including the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), and the Insurance Regulatory and Development Authority of India (IRDAI)—maintain strict, non-negotiable data localization regimes. This treatise deconstructs the dual-layered legal framework governing cross-border data transfers.

II. II. The Section 16 Negative List Mechanism Deconstructed

Under Section 16(1) of the DPDP Act, the Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.

This provision establishes a presumption of cross-border transferability: an enterprise is legally permitted to transfer digital personal data to any foreign country or territory, *except* those explicitly notified on the Central Government's restriction list (the 'Negative List'). The Central Government evaluates geopolitical relationships, sovereign cybersecurity threats, reciprocal data protection standards, and intelligence access laws in formulating the negative list.

If a country is placed on the negative list, transferring personal data of Indian Data Principals to servers or third-party vendors located within that jurisdiction becomes a direct statutory violation, subjecting the enterprise to penalties up to INR 50 Crores under Paragraph 5 of the Schedule.

III. III. Section 16(2) Priority Clause: Sectoral Localization Prevails

The critical statutory caveat that corporate legal counsel must master is codified under Section 16(2): 'Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India.'

Section 16(2) acts as a statutory savings clause, explicitly subordinating the DPDP Act's permissive transfer model to existing and future sectoral localization mandates. Consequently, an enterprise cannot argue that a cross-border transfer is lawful under the DPDP Act if it contravenes a sectoral regulator's specific directive.

The DPDP Act functions as a baseline floor; sectoral regulations operate as a ceiling. Compliance with Section 16 is necessary, but wholly insufficient without sector-specific regulatory clearance.

IV. IV. Sectoral Localization Mandates: RBI, SEBI, and IRDAI

Enterprises operating across regulated verticals must comply with strict statutory data localization directives:

1. **RBI Payments Data Localization (Circular DPSS.CO.OD No. 2785/06.11.001/2017-18)**: Mandates that all system providers ensure that the entire data relating to payment systems operated by them is stored in a system only in India. While data can be transferred abroad for processing, it must be deleted from foreign servers within 24 hours of processing and stored permanently exclusively within India. 2. **SEBI Cloud Framework and Intermediary Directives**: Mandates that data pertaining to Indian securities markets, customer trading records, and KYC repositories must reside in data centers located in India, preventing foreign extraterritorial access.

3. **IRDAI Maintenance of Insurance Records Regulations**: Mandates that policyholder records and financial data must be stored locally within India, subject to limited exceptions for foreign reinsurance.

V. V. Contractual Safeguards: International Data Transfer Agreements and SCCs

Even where cross-border transfer is permitted to a non-blacklisted territory, Section 8(1) of the DPDP Act dictates that the Data Fiduciary remains liable for any breach committed by its foreign Data Processor.

Enterprises must execute robust **International Data Transfer Agreements (IDTA)** or incorporate customized Standard Contractual Clauses (SCCs). These contractual instruments must obligate the foreign recipient to: (a) implement reasonable technical security safeguards under Section 8(5); (b) assist the Indian fiduciary in responding to Data Principal rights requests within statutory timeframes; (c) immediately notify the Indian fiduciary of any personal data breach to enable compliance with CERT-In 6-hour and DPBI notification timelines; and (d) submit to regular compliance audits.

Furthermore, transfer agreements must restrict downstream sub-processing without prior written authorization from the Indian Data Fiduciary.

VI. VI. Chambers Cross-Border Data Privacy Practice

Advocate Ritik Khurana Chambers provides specialized counsel to multinational corporations, global cloud service providers, and Indian enterprises on international data transfers and sovereign data governance.

Our practice drafts multi-jurisdictional Data Transfer Agreements, harmonizes EU GDPR Standard Contractual Clauses with Indian DPDP Act requirements, and designs dual-repository architectures to satisfy RBI payments and SEBI cloud localization mandates.

In regulatory reviews and cross-border enforcement proceedings, our team delivers strategic legal counsel to maintain seamless global data pipelines while eliminating statutory exposure.