What Is This Module For?
The Cross-Border Transfers module helps you track and document the transfer of personal data outside India — which is regulated under the DPDP Act 2023.
Which Law Requires This?
- DPDP Act 2023, Section 16 — The Central Government may restrict transfer of personal data to certain countries by notification. Until such a negative list is published, transfers to all countries are permitted subject to contractual safeguards.
Current Status (May 2026): The Government has not yet published a negative list of restricted countries. All cross-border transfers are currently permitted but must be documented and subject to appropriate contractual safeguards (Data Processing Agreements).
Step-by-Step Guide
- Go to Cross-Border Transfers in the sidebar.
- Click "Add Transfer" for each vendor or system that processes Indian personal data outside India.
- Enter: vendor name, destination country, data categories transferred, transfer mechanism (DPA / standard clauses / adequacy), and transfer start date.
- Upload the signed Data Processing Agreement (DPA).
- Set an expiry date — dcomply flags transfers whose DPAs are expiring within 30 days.
Common Mistakes to Avoid
- Not documenting transfers to cloud services — AWS, Azure, Google Cloud, and Salesforce are all cross-border transfers if their servers are outside India.
- Missing DPA renewals — Expired DPAs mean you are transferring data without adequate safeguards.
Frequently Asked Questions
Q: Are transfers to AWS Mumbai (India region) cross-border?
A: No. If data stays within India, it is not a cross-border transfer regardless of the vendor's country of incorporation.
Q: Do we need individual consent for cross-border transfers?
A: Not currently — but you must disclose cross-border transfers in your privacy notice and have appropriate contractual safeguards in place.