Module 6: Cross-Border Transfers & Exemptions
How Section 16 handles international transfers, how sectoral laws can be stricter, and which exemptions in Section 17 apply. This DPDPA 2023 course page explains cross border transfers and exemptions in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Module 6 lessons (about 3 hours) (cross border transfers and exemptions)
Read the lessons in order, like chapters of a book. Each has reading, a click-through diagram, an activity and a quiz.
What you will learn about cross border transfers and exemptions
- Explain the “negative list” model for transfers
- Identify when sectoral rules override DPDPA
- List major Section 17 exemptions
- Map your organisation’s data flows
Transfers (Section 16)
Personal data may be transferred outside India except to countries or territories the Central Government restricts by notification. If another law is stricter, such as RBI rules on payment data, the stricter rule applies.
- Map every vendor, cloud region and support team location
- Keep contracts that bind overseas recipients to equal protection (good practice)
- Watch for notifications of restricted countries
- Significant Data Fiduciaries may face localisation of specified data under the Rules
Exemptions (Section 17) (cross border transfers and exemptions)
Some obligations do not apply in specific situations.
- Enforcing legal rights or claims
- Courts and tribunals performing judicial functions
- Prevention, detection or investigation of offences
- Processing of non-residents’ data under a foreign contract (the outsourcing and BPO carve-out)
- Approved mergers, demergers and similar schemes
- Research, archiving and statistics under prescribed standards
- State instrumentalities notified for security and public order
- Notified classes of startups
Practical steps
Create a data-flow map, tag each flow with the destination country, and review the list whenever the Government issues a notification.
Transfers are open by default, closed by notification, and always subject to stricter sectoral rules.
Check your understanding of cross border transfers and exemptions
Q1. What is the default position on cross-border transfers?
Q2. If a sectoral law is stricter than DPDPA on transfers, which applies?
Q3. Which processing enjoys a notable exemption for outsourcing?
Quick FAQs (cross border transfers and exemptions)
Do we need Standard Contractual Clauses?
The Act does not mandate them, but binding contracts are sensible evidence of protection.
Is there a list of restricted countries yet?
Check MeitY notifications; the list is set by the Government, not by the Act.
Do it yourself: practical guides
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.