Digital Personal Data Protection Act, 2023: Cross-Border Transfer Restrictions & Data Localisation Norms – Implications for Technology Joint Ventures

I.  Introduction

The Digital Personal Data Protection Act, 2023 (‘Act’) read with the Digital Personal Data Protection Rules, 2025 (‘Rules’) significantly reshapes India’s data governance framework. For technology-driven joint ventures (‘Tech JVs’), data by itself is not only operational but is often a core commercial asset. Tech JVs usually have foreign collaborators, overseas data processors, shared intellectual property, or common cloud-based infrastructure- thereby making cross-border transfers and data localisation norms central to transaction structuring and contractual risk allocation.

II.  Cross-border data transfers and data localisation under the Act

Legal framework

The Act adopts a permissive approach wherein a ‘negative list’ model is adopted, i.e., transfers of personal data[1] are allowed unless explicitly blacklisted by the Central Government[2], thereby giving businesses flexibility in determining the jurisdiction in which they wish to process data.

However, this flexibility is restrained in various ways that may impact Tech JVs:

1. Central Government’s powers- The Central Government retains broad discretion to restrict transfers to specified jurisdictions.[3] The Rules additionally stipulate that transfers of personal data will also be subject to the Data Fiduciary[4] meeting such criteria as may be prescribed.[5] The Act does not prescribe any objective criteria, creating regulatory uncertainty.  Such restrictions may not just be jurisdiction-based, but they also hinge on compliance standards to be met by a Data Fiduciary.

2. Applicability of other laws- The Act expressly preserves the applicability of sectoral laws that impose stricter data protection or localisation requirements.[6] Accordingly, domestic sectoral frameworks of Reserve Bank of India (‘RBI’), Insurance Regulatory and Development Authority of India (‘IRDAI’) or Securities and Exchange Board of India (SEBI) may override the general permissive stance of the Act. This is particularly relevant for Tech JVs operating in regulated sectors such as banking, insurance or health-tech.  For example, RBI mandates that all data collected by payments banks[7] and all data collected by regulated entities in relation to digital lending can only be stored in servers located in India[8].  Further, the IRDAI restricts storage of data in relation to policyholders and claims outside of India.[9]

3. Significant Data Fiduciary (‘SDF’)[10]– The Rules impose additional obligations for SDFs, including a targeted localisation requirement.[11] While the criteria for SDF designation depend on factors such as volume and sensitivity of data processed, the precise thresholds and process remain unclear.[12] This causes uncertainty at the initial stage, as compliance burdens may intensify over time without clarity of what lies ahead.

4. Responsibility of a Data Fiduciary– A Data Fiduciary remains fully accountable in relation to all compliance obligations, even where processing of personal data is undertaken by an overseas Data Processor.[13] While processing must mandatorily be governed by a valid contract, the Act does not prescribe any specific provisions that should be incorporated in such contracts.[14] This means that liability remains with a Data Fiduciary (such as a Tech JV), regardless of where or by whom the data is actually processed.

Practical relevance for Tech JVs

The Act does not prescribe any criteria on the Central Government’s power to restrict cross-border transfers, leading to regulatory uncertainty for Tech JVs relying on global data flows.  In practise, data transfers are embedded in the technological architecture of the operations of a Tech JVs, i.e., data does not just sit on one server in one country, but rather flows continuously and often without deliberate transfer decisions.  This could happen in the following ways:

1. A Tech JV using any global cloud system, will have data stored or backed up across servers in multiple countries. Oftentimes, when foreign partners maintain a central data hub for all group entities worldwide or use group-wide software for customer management, finance, HR, or operations, then Indian data might flow automatically into that global system for analysis or storage.

2. If the JV is building Artificial Intelligence (‘AI’) tools or doing analytics, it may combine Indian data with data from other countries to improve or train AI models. That pooling itself involves cross-border transfer.

The key risk in this regard is that a Data Fiduciary remains responsible for compliance even where processing is undertaken by a Data Processor.  A Tech JV acting as a Data Fiduciary cannot contractually shift statutory liability to any of its Data Processor.  A breach by an overseas Data Processor may expose the JV directly to enforcement and stringent penalties (ranging from INR 50 crore to INR 250 crore)[15] and may materially affect the functioning and valuation of the Tech JV.  Given these risks, Tech JVs need to approach data governance and contractual risk allocation strategically.

Structuring and contractual implications

1. At the structuring stage, Tech JVs should undertake a granular mapping exercise of all personal data flows (from collection to storage to deletion), including embedded data mobility not just formal transfer events. Identifying the flow of data allows a Tech JV to assess reliance on specific foreign jurisdictions that may later be restricted.

2. While the Act does not mandate standard contractual clauses, the Data Fiduciary centric liability model makes robust data processing agreements (‘DPA’) essential. A DPA should address:

• Detailed description of processing of personal data and its purpose.

• Representations on server hosting locations, with appropriate penalties in case of breach.

• Prior written consent for engaging any sub-processor, along with flow-down of equivalent contractual obligations as the Data Processor.

• Defined technical and organisational security measures, along with security breach notification obligations.

3. DPAs address operational risk with Data Processors, however, the JV agreement must address regulatory risk allocation between partners themselves and ideally include:

• Robust regulatory change clause, addressing processes to be adopted in case of imposition of transfer restrictions. Specifically, the cost allocation of compliance such as establishing local infrastructure, migrating data, or engaging new vendors.

• Provision addressing potential designation as an SDF. Pre-negotiate how additional compliance obligations will be implemented and funded if SDF status is imposed.

• Clear allocation of compliance responsibilities between the partners of the Tech JV.

• Indemnity provisions should be calibrated to breach of the Act, in accordance with the stringent penalties prescribed for the breach thereof.

III.  Conclusion

In the framework of the Act, data transfer flexibility exists, but it is conditional and dynamically changing. The risk of regulatory exposure for Tech JVs is not immediate prohibition but regulatory unpredictability, inherent technological dependence of Tech JVs, and high fiscal penalties. Informed structuring decisions and well-negotiated contracts can determine whether a Tech JV can adapt to regulatory evolution or faces costly restructuring and potential enforcement action.

[1] Section 2(t) of the Act defines ‘personal data’ as “any data about an individual who is identifiable by or in relation to such data”.

[2] Section 16 of the Act.

[3] Section 16(1) of the Act.

[4] Section 2(i) of the Act defines ‘Data Fiduciary’ as “any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data”.

[5] Rule 15 of the Rules.

[6] Section 16(2) of the Act.

[7] ‘Storage of Payment System Data’, RBI/2017-18/153, dated 06 April 2018, available at: https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=11244.

[8] ‘Reserve Bank of India (Digital Lending) Directions, 2025’, dated 08 May 2025, available at: https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12848&Mode=0.

[9] Regulation 3(9), IRDAI (Maintenance of Insurance Records) Regulations, 2015.

[10] Section 2 (z) of the Act defines ‘Significant Data Fiduciary’ as “any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 [of the Act]”

[11] Rule 13(4) of the Rules.

[12] Section 10(1) of the Act.

[13] Section 8(2) of the Act.

[14] Section 8(1) of the Act.

[15] Section 33 of the Act.