Cross-Border Data Transfers Under India's DPDP Act: Risks for European Companies

India's Digital Personal Data Protection Act and its implementing Rules create a new cross-border transfer regime that diverges in significant respects from the GDPR framework European companies already operate under. Organisations that collect or process personal data of Indian data principals – including through digital products, shared service centres, or intra-group data flows – face an evolving compliance timetable with hard deadlines, open interpretive questions, and potential regulatory exposure before full guidance has been issued. Understanding where the two regimes converge, and where they conflict, is essential before the substantive obligations take effect on 13 May 2027.

The Legislative Framework: DPDP Act and the 2025 Rules

India's Digital Personal Data Protection Act (the "DPDP Act") received presidential assent in August 2023, but it was the DPDP Rules 2025, notified on 13 November 2025, that gave the statute its operational architecture. The Rules address consent mechanics, the consent-manager regime, data fiduciary obligations, cross-border transfer restrictions and the constitution of the Data Protection Board of India (the "Board"). Until the Rules were published, large parts of the Act remained aspirational; many European compliance teams had, reasonably, deferred detailed gap analyses.

The implementation calendar now has three significant milestones. First, the Rules themselves entered force on notification in November 2025. Second, the consent-manager regime – under which accredited intermediaries will facilitate and record consent on behalf of data principals – becomes operational from November 2026. Third, the full suite of substantive obligations under the Act, including data breach notification duties, data fiduciary accountability requirements and cross-border transfer controls, apply from 13 May 2027. European companies therefore have a defined, but not comfortable, runway to align their Indian data operations.

Cross-Border Transfer Controls: What the Rules Actually Say

The DPDP Act adopts a whitelist approach to international data transfers. Personal data of Indian data principals may be transferred to countries or territories notified by the Central Government as permissible destinations; transfers to non-notified jurisdictions are, in principle, prohibited. This is structurally different from the GDPR's adequacy-plus-safeguards model, where transfers to non-adequate countries can be legitimised by standard contractual clauses, binding corporate rules or derogations.

As at the time of writing, the Central Government has not yet published the positive list of permitted jurisdictions. That list is expected before the May 2027 compliance deadline, but its precise scope – and whether the European Union or individual EU Member States will appear on it – remains pending. Equally open is whether bilateral data-flow arrangements, such as the EU–India Trade and Technology Council framework discussions, will influence the list's composition. European companies must therefore plan for a scenario in which their home jurisdiction is not automatically whitelisted.

Certain categories of data – including data processed by Significant Data Fiduciaries, a designation the Central Government may apply based on volume, sensitivity or risk – may attract additional restrictions. The criteria for that designation are still subject to clarification under the Rules, meaning that companies with large Indian user bases cannot yet determine with certainty whether enhanced obligations will apply to them.

If your organisation processes personal data of Indian residents and relies on intra-group transfers to European entities, our team can help you map those flows against the emerging DPDP framework. Please write to info@ferrazwhitmore.com or visit our contacts page to discuss your situation.

Interaction with GDPR: Convergences and Tensions

European companies already subject to the GDPR will find some familiar concepts in the DPDP Act – consent as a lawful basis, purpose limitation, rights of access and erasure, and breach notification obligations. However, the surface similarity conceals material differences that create dual-compliance complexity.

• Consent mechanics: The DPDP Act requires a specific, informed, unconditional and unambiguous consent notice in plain language. The Act also places obligations on consent managers from November 2026. GDPR consent, while substantively similar, has an established body of supervisory authority guidance and case law that does not translate directly to the Indian framework.
• Legitimate interests: The GDPR permits processing on legitimate interests grounds; the DPDP Act does not recognise an equivalent general basis. European companies that rely heavily on legitimate interests for processing Indian personal data will need to reground that processing in consent or one of the Act's enumerated "deemed consent" categories.
• Data breach notification: The DPDP Act requires notification of personal data breaches to the Data Protection Board and, in some circumstances, to affected data principals. The GDPR requires notification to the competent supervisory authority within 72 hours. The two notification obligations will run in parallel for companies subject to both regimes, and the timelines, content requirements and thresholds are not aligned. Companies that have invested in GDPR-compliant breach response programmes should audit whether those programmes capture the DPDP Act's distinct requirements.
• Territorial scope: The GDPR has a broad extraterritorial reach; the DPDP Act applies to processing of digital personal data within India and to processing outside India if it relates to profiling of Indian data principals. The overlap is considerable for any European company with an India-facing product or service.
• NIS2 and DORA intersections: For European financial institutions and digital infrastructure operators, NIS2 Directive and DORA obligations already impose third-country risk management and ICT incident reporting requirements. Where India-based processing forms part of a critical function or ICT chain, the DPDP Act's requirements may interact with – and in some cases conflict with – the operational resilience obligations imposed by DORA and the incident classification thresholds under NIS2.

Financial services companies regulated by RBI or SEBI in India face a further layer of sector-specific data localisation and audit requirements that sit alongside the DPDP Act. RBI's existing framework for payment system data, and SEBI's requirements for market infrastructure, were not formally amended by the DPDP Rules; the interaction between sector-specific rules and the new general data protection regime remains an open interpretive question that regulators have not yet authoritatively resolved.

For more on how data protection obligations intersect with financial regulation in India, our banking and finance practice in India works closely with our data protection team on integrated advice.

The Data Protection Board: Enforcement Architecture

The Data Protection Board of India has now been constituted following the notification of the 2025 Rules. The Board is the primary adjudicatory body for complaints and breach investigations under the Act. It has power to impose financial penalties, the quantum of which scales with the nature and gravity of the violation, and its decisions are subject to appellate review before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), with further recourse to the courts.

The Board is not a supervisory authority in the GDPR sense; it does not issue binding opinions on processing activities in advance, nor does it operate a one-stop-shop mechanism equivalent to the EU's lead supervisory authority model. For European companies accustomed to engaging proactively with a data protection authority, the DPDP Act's reactive, complaints-driven Board model requires a different compliance posture: the burden lies squarely on the data fiduciary to implement compliant systems before a breach or complaint arises.

Questions of insolvency, restructuring or corporate enforcement affecting data fiduciaries would engage the NCLT (National Company Law Tribunal) rather than the Board, and the interface between those jurisdictions has not yet been tested.

Strategic Risks for European Companies: A Practical Assessment

The principal risk categories facing European companies under the DPDP Act can be grouped as follows:

• Transfer risk: Operating intra-group or vendor data transfers to or from India under the assumption that existing GDPR mechanisms (SCCs, BCRs) provide DPDP Act compliance is legally unsound. The two frameworks require separate legal bases, and neither imports the other.
• Consent recapture risk: Companies that built their Indian user consent architecture around GDPR-compatible consent notices may need to recapture consent under the DPDP Act's distinct formal requirements. The consent-manager regime operational from November 2026 adds a further procedural layer.
• Gap risk on deemed consent: The Act's "deemed consent" categories – processing for employment, emergencies, public interest, and similar purposes – have limits and conditions. Relying on them without a thorough legal analysis of each processing activity creates regulatory exposure.
• Dual breach notification burden: A cyber incident affecting Indian personal data simultaneously triggers GDPR notification obligations to the competent EU supervisory authority and DPDP Act notification to the Board. The timelines and content requirements differ, and a company that manages only one correctly may still face sanctions under the other.
• Significant Data Fiduciary designation: If designated, companies face heightened obligations including data protection impact assessments, periodic audits and appointment of a Data Protection Officer in India. Designation criteria have not been fully specified, creating planning uncertainty for companies with large datasets or sensitive processing.
• Whitelist uncertainty: Until the Central Government publishes the list of permitted transfer destinations, no company can say with certainty that its transfer flows are compliant. Prudent organisations are stress-testing their transfer maps now, before the list is published.

Consent Managers: A New Compliance Infrastructure Requirement

The consent-manager regime, which becomes operational from November 2026, introduces accredited intermediaries through which data principals can grant, manage, review and withdraw consent. For European companies offering consumer-facing digital services in India, this creates a new technical and contractual interface requirement: systems must be capable of receiving, recording and honouring consent signals through the consent-manager infrastructure.

The practical implications – API integration, consent record auditability, data subject request workflows – are not trivial, particularly for multinational platforms that have engineered their consent management around GDPR consent management platforms. A detailed technical and legal analysis of the consent-manager requirements is available in our India DPDP consent managers alert.

Our data protection and technology team advises European companies on building DPDP-compliant consent infrastructure that also satisfies GDPR requirements. To discuss an integrated approach, contact us at info@ferrazwhitmore.com or through our contacts page.

Strategic Recommendations for European Companies

Given the May 2027 compliance deadline and the significant open questions still pending from the Central Government, a staged, risk-calibrated approach is advisable.

• Data mapping and transfer audit: Map all personal data flows between your Indian operations and European or third-country entities. Identify which flows are covered by the DPDP Act and which will require a whitelist-based transfer permission once the permitted-country list is published.
• Consent architecture review: Audit existing consent notices served to Indian data principals against the DPDP Act's requirements. Begin designing recapture workflows and consent-manager integration ahead of the November 2026 operational date.
• Dual incident response planning: Update breach response and notification procedures to run GDPR and DPDP Act obligations in parallel. Assign clear ownership for each notification track and test the procedures in tabletop exercises.
• Sector-specific overlay: If your Indian operations are regulated by RBI or SEBI, or if you operate within a DORA or NIS2 scope in Europe, commission an integrated analysis of how the sectoral requirements interact with the DPDP Act. Do not treat the frameworks as independent silos.
• Monitor the permitted-country list: Establish a regulatory monitoring function specifically tracking the Central Government's notifications under the Act. The publication of the whitelist will require immediate transfer-mapping action; the interval between publication and the May 2027 compliance deadline may be short.
• Engage early with local counsel: The DPDP Act is a new regime and the Board is newly constituted. Early engagement with counsel in India is advisable both for practical compliance guidance and to understand the Board's emerging enforcement priorities.

Outlook

The period between now and 13 May 2027 is one of structured uncertainty. The primary legislative text is settled; the Rules have been notified; the Board is constituted. But several of the most commercially important implementation decisions – the permitted-country transfer list, Significant Data Fiduciary designation criteria, and sector-specific guidance – remain pending. The consent-manager regime will come online in November 2026, giving companies a roughly six-month window to validate their consent infrastructure before full substantive obligations apply.

For European companies, the risk is not simply that the DPDP Act imposes new obligations; it is that those obligations must be satisfied in parallel with an existing GDPR compliance programme that was not designed with the DPDP Act in mind. Retrofitting GDPR-era frameworks onto a structurally different Indian regime is possible, but requires deliberate legal engineering rather than assumption of equivalence.

Our data protection practice in India works with European companies navigating the dual GDPR–DPDP Act compliance environment, including cross-border transfer analysis, consent architecture, breach response and regulatory engagement with the Data Protection Board.

To discuss your organisation's DPDP Act readiness or to commission a gap analysis against your existing GDPR programme, please reach out to our team at info@ferrazwhitmore.com or visit our contacts page.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.