APAC / Asia-Pacific / revised 28 Oct 2026
India DPDP Act 2023: Cross-Border Transfers for AI Inference
India's DPDP Act takes a negative-list approach: personal data may be transferred abroad unless the Central Government restricts transfers to a notified country. The real constraints for AI inference come from sector regulators, from the Rules' conditions on access by foreign states, and from the possibility of localisation duties for Significant Data Fiduciaries.
- Citation
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023), section 16; Digital Personal Data Protection Rules, 2025, Rule 15
- Regulator
- Data Protection Board of India; Ministry of Electronics and Information Technology (MeitY) for rule-making
- In force
- Act assented 11 August 2023; Rules notified 13 November 2025, with most obligations, including Rule 15, applying 18 months later
- Maximum penalty
- Up to INR 250 crore for failure to take reasonable security safeguards (Schedule); up to INR 50 crore for breaches of other provisions, including transfer restrictions
Section 16: transfer unless restricted
Section 16(1) allows the Central Government, by notification, to restrict the transfer of personal data by a Data Fiduciary to any country or territory outside India. Unlike GDPR Chapter V there is no adequacy test or standard contract requirement in the Act itself. Section 16(2) preserves any other Indian law that provides a higher degree of protection or a restriction on transfer, so sector rules such as the Reserve Bank of India's 2018 directive on storage of payment system data continue to apply.
The DPDP Rules 2025
MeitY notified the DPDP Rules on 13 November 2025. Provisions establishing the Data Protection Board took effect immediately; consent manager registration follows after one year; and the substantive obligations, including notice, security safeguards, breach intimation and Rule 15 on transfers, apply 18 months after notification, in May 2027.
Rule 15 makes transfers subject to requirements the Central Government may specify by general or special order about making personal data available to a foreign state or any person or entity under its control. The Rules also let the Government, on the recommendation of a committee, require Significant Data Fiduciaries to keep specified personal data and associated traffic data within India.
Scope and exemptions
The Act applies to digital personal data processed in India and to processing outside India connected with offering goods or services to Data Principals in India. Section 17(1)(d) exempts most obligations for personal data of persons outside India processed in India under a contract with a foreign person, which matters for Indian delivery centres running inference on clients' foreign data.
- 01
Plan for a notified blacklist
Write the routing policy so that a newly notified restricted country can be added as a data change, not a code release. When a notification lands, traffic to that country should stop within minutes. - 02
Sector overlays first
Payment data under RBI rules, insurance data under IRDAI guidance and telecom subscriber data under licence conditions can require Indian storage. Tag requests by sector so the stricter overlay wins. - 03
Aadhaar and PAN masking
Aadhaar numbers are 12 digits validated with a Verhoeff checksum; PAN follows a five letter, four digit, one letter pattern. Mask both in-path. Aadhaar storage and display are also restricted under the Aadhaar Act and UIDAI regulations. - 04
Security safeguards as the main exposure
The largest penalty attaches to failure of reasonable security safeguards. Encryption in transit, access logging and provider zero retention are the controls an inquiry will ask about first. - 05
Readiness for SDF designation
If you may be designated a Significant Data Fiduciary, keep an Indian inference path warm so a localisation direction does not require a rebuild.
| # | Rule | Legal rationale |
|---|---|---|
| 01 | Block routes to any country on the tenant's restricted-country list, maintained from section 16 notifications. | Section 16 is a negative list. Enforcement means reacting to notifications, not maintaining an approval list. |
| 02 | Requests tagged as RBI payment data resolve to Indian endpoints only. | Section 16(2) preserves stricter sector rules, and the RBI requires payment system data to be stored in India. |
| 03 | Mask Aadhaar and PAN on every route by default. | Minimisation reduces breach impact and supports the reasonable security safeguards duty that carries the highest penalty. |
| 04 | Prefer Indian endpoints for tenants designated as Significant Data Fiduciaries. | Positions the tenant for localisation directions that the Rules allow the Government to issue. |
in-dpdp-transfer
The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.
Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.
How the policy engine workspackage yttsecunet.policies.in_dpdp_transfer
import rego.v1
default allow := false
in_regions := {"ap-south-1", "ap-south-2", "centralindia"}
allow if {
input.request.origin_country == "IN"
input.request.sector == "rbi_payment"
input.route.provider_region in in_regions
}
allow if {
input.request.origin_country == "IN"
input.request.sector != "rbi_payment"
not input.route.destination_country in data.india.restricted_countries
input.guardrail.aadhaar_masked
}
reasons contains "destination restricted under section 16" if {
input.route.destination_country in data.india.restricted_countries
}Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.
Can we send Indian personal data to a US or EU model today?
Under the DPDP Act, yes, unless the destination is restricted by notification or a sector rule requires local storage. Contractual and security duties still apply to how the provider handles it.
When do the cross-border provisions actually bite?
Rule 15 and the main fiduciary obligations apply 18 months after the 13 November 2025 notification, in May 2027. Sector localisation rules already apply.
Does YTT Secunet run inference in India?
YTT Secunet routes to Indian regions of model providers and to self-hosted runtimes in Indian data centres through its APAC data plane. YTT Secunet does not host foundation models itself.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.