Yes. India's DPDP framework permits transfer of personal data to any country the government has not specifically restricted — and as of mid-2026 no country has been restricted. The obligations that bite are consent, notice and retention, not geography.
This is the question we are asked most often, usually with the assumption baked in that the answer is no. It is the opposite of the European rule, and almost everyone gets it backwards.
Why everyone assumes it is banned
Most people's mental model of data protection comes from GDPR, where cross-border transfer is prohibited by default. You need an adequacy decision for the destination country, or standard contractual clauses, or one of a short list of derogations. The burden sits on you to justify the transfer.
India built the opposite mechanism.
| GDPR (EU) | DPDP (India) | |
|---|---|---|
| Default position | Transfer prohibited | Transfer permitted |
| Mechanism | Allowlist — adequacy decisions | Blocklist — restricted countries only |
| Who carries the burden | You justify each transfer | Government must restrict a country |
| Countries currently restricted | Most of the world lacks adequacy | None notified to date |
Under Section 16 of the DPDP Act, personal data may flow to any country except those the Central Government specifically restricts. As of mid-2026 the government has issued no such notification. There is, at present, no jurisdiction you are barred from sending personal data to.
The catch worth understanding
The permission is real. It is also revocable without warning.
The government is under no obligation to publish reasons for restricting a country, and the Act provides no alternative transfer mechanism to fall back on — there is no Indian equivalent of standard contractual clauses to keep a flow alive after a restriction lands.
Design so the model provider can be swapped without re-architecting. Not because a restriction is likely — because if one arrives, there is no legal workaround, only a migration.
In practice that means an abstraction layer between your application and whichever model you call, and not writing provider-specific behaviour deep into your business logic. This is good engineering regardless. It happens to also be your only available hedge.
What does apply to you
Geography is the easy part. These are the obligations that actually take work.
A contract with your processor
A Data Fiduciary may transfer personal data to another Data Fiduciary or to a Data Processor only under a valid contract. If you are calling a model API with customer data in the payload, that provider is your processor, and the commercial terms you clicked through need to cover it.
Consent and notice
Consent must be free, specific, informed, unconditional and unambiguous, gathered through a clear affirmative action, with notice given in plain language. "We may use your data to improve our services" does not describe sending a customer's policy details to a third-party model.
Retention and deletion
Personal data must not be kept past the purpose it was collected for. Conversation logs, call recordings and transcripts are the ones teams forget — they accumulate silently, and they are exactly the artefacts an AI feature generates most of.
Breach notification within 72 hours
The Data Protection Board and affected individuals must be notified of a personal data breach. Failure to notify carries a penalty of up to ₹200 crore.
Children's data
Processing a child's personal data requires verifiable parental consent. Verification can rely on information already held, details supplied by the parent, or virtual tokens issued by authorised entities or DigiLocker providers. Non-compliance with the children's provisions carries up to ₹200 crore.
If your product is consumer-facing and you have not built an age gate, this is the sharpest edge in the entire framework.
There is no special AI clause
Worth stating plainly, because it comes up in every conversation: the DPDP framework contains no AI-specific provisions. There is no separate regime for machine learning, no carve-out for model training, no additional consent category for automated processing.
Sending personal data to a language model is processing. It is governed by the same rules as putting that data in a spreadsheet, a CRM, or an offshore BPO. The novelty is in your architecture, not in the law.
This cuts both ways. There is no extra hurdle to clear — and no exemption to hide behind.
When does DPDP compliance become mandatory?
The DPDP Rules were notified on 13 November 2025, alongside the constitution of the Data Protection Board of India. Implementation is phased across eighteen months.
| Date | What comes into force |
|---|---|
| 13 Nov 2025 | Rules 1, 2 and 17–21. Definitions and procedural framework. Data Protection Board constituted. Complaints can be filed. |
| 13 Nov 2026 | Rule 4. Consent Manager registration opens — a regulated Indian entity with ₹2 crore minimum net worth acting as a single interface for managing consent. |
| 13 May 2027 | Rules 3, 5–16, 22 and 23. Full substantive compliance. Notice and consent standards, data principal rights, security safeguards, breach reporting, retention and deletion, children's data, cross-border conditions. |
Be careful with how this gets sold to you. A large compliance industry has grown around quoting the ₹250 crore ceiling next to whichever date is nearest. The honest position is that full substantive obligations land on 13 May 2027, and the November 2026 milestone is principally the Consent Manager framework.
That is not a reason to wait. Consent architecture, retention policy and breach process are slow to build and slower to retrofit, and they touch every product surface you have. But you are not late, and anyone telling you otherwise is selling something.
Penalties, for scale
- ₹250 crore — failure to implement reasonable security safeguards
- ₹200 crore — failure to notify the Board or affected individuals of a breach
- ₹200 crore — non-compliance with the children's data provisions
Penalties are assessed per violation, per inquiry. A single investigation that finds a security failure alongside a missed notification and a consent defect can attract separate penalties for each.
A practical position
- Use the model you think is best. No jurisdiction is currently restricted, and choosing a weaker model for imagined legal reasons costs you real quality today against a hypothetical.
- Keep provider choice swappable. One abstraction layer. It is the only hedge available if a restriction ever lands.
- Check your processor terms. Confirm your data is not used for training, and that the contract covers processing on your behalf.
- Write the retention policy now. Especially for transcripts, recordings and conversation logs.
- Fix consent and notice at the point of collection. This is the slow one. Start it early.
- Build an age gate if you are consumer-facing. ₹200 crore, and no ambiguity in the drafting.
Common questions
Can Indian companies send personal data to OpenAI, Anthropic or Google?
Yes. The DPDP Act permits transfer of personal data to any country the Central Government has not specifically restricted under Section 16. As of mid-2026 no country has been notified as restricted, so there is no jurisdictional bar on using these providers. A valid contract with the provider as your processor is still required.
Does the DPDP Act require data localisation?
Not generally. The Act uses a blocklist model rather than a localisation mandate. Significant Data Fiduciaries face additional restrictions on transferring categories of data the government specifies, but there is no blanket requirement to keep personal data inside India.
How is DPDP different from GDPR on cross-border transfers?
They are inverted. GDPR prohibits transfers by default and requires an adequacy decision or safeguards such as standard contractual clauses. DPDP permits transfers by default and restricts only countries the government specifically notifies. India has notified none to date.
When does DPDP compliance actually become mandatory?
Implementation is phased. The Rules were notified on 13 November 2025. Consent Manager provisions take effect 13 November 2026. Full substantive compliance — notice, consent, security safeguards, breach reporting, retention, children's data and cross-border conditions — takes effect 13 May 2027.
Are there special DPDP rules for AI or machine learning?
No. The framework contains no AI-specific provisions. Sending personal data to a language model is processing, governed by the same consent, notice, retention and security obligations as any other processing.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failure to implement reasonable security safeguards. Failure to notify a breach and non-compliance with children's data provisions each carry up to ₹200 crore. Penalties are assessed per violation, so a single inquiry can produce cumulative fines.
Do we need consent to record and transcribe customer calls?
Call recordings and transcripts are personal data. They require a lawful basis, notice in plain language describing the purpose, and a retention period tied to that purpose. Recordings are the artefact teams most often accumulate without a deletion schedule.
Sources
- Digital Personal Data Protection Act, 2023 — Section 16, transfer of personal data outside India
- Digital Personal Data Protection Rules, 2025 — notified 13 November 2025; Rule 15, transfer of personal data outside India
- Ministry of Electronics and Information Technology — notifications of 13 November 2025 constituting the Data Protection Board of India
Facts verified 16 August 2026. This is a plain-English summary for product and engineering teams, not legal advice. The cross-border position depends on the government not having restricted a destination country; confirm the current position and your specific obligations with counsel before relying on it.
Building this yourself? We already run it in production.
Talk to us