CROSS-BORDER DATA TRANSFER UNDER INDIA'S DIGITAL PERSONAL DATA PROTECTION ACT, 2023: EXAMINING THE BLACKLIST APPROACH

This article examines Section 16 of India's Digital Personal Data Protection Act, 2023, which governs cross-border data transfer through a permissive “blacklist” model rather than the restrictive “whitelist” approach found in the 2022 draft Bill that preceded it. It traces the operational detail added by Rule 15 of the Digital Personal Data Protection Rules, 2025, and highlights an overlooked fact: Section 16 does not actually come into force until approximately May 2027, meaning the current absence of any restricted jurisdiction reflects an inoperative provision rather than a considered regulatory judgment. The article situates India's approach against the European Union's adequacy-based framework under the GDPR and China's three-pathway model under the Personal Information Protection Law, and argues that the principal risk for Indian businesses lies not in the current absence of friction, but in the unreviewable executive discretion the provision will vest once it commences.