# GDPR + DPDPA Cross-Border Transfer Quick Reference Card

**Version:** 1.1 | **Date:** April 2, 2026 (citations updated October 17, 2026) | **Source:** [statechecksecurity.com](https://statechecksecurity.com)

---

## Core Model Comparison

| Dimension | GDPR | DPDPA |
|-----------|------|-------|
| **Legal Model** | Whitelist (transfers blocked unless adequacy/SCC/BCR) | Negative list (transfers permitted unless restricted) |
| **Default Stance** | ❌ Deny | ✅ Permit |
| **Transfer Mechanism** | SCCs, BCRs, Adequacy, Derogations | No prescribed mechanism (outcome-based security); Rule 15 lets the Central Government specify requirements by order |
| **Restricted Destinations** | All non-EEA unless adequacy | **None as of October 2026** (subject to change) |
| **Change Mechanism** | EU Commission adequacy decisions | Indian Central Government notifications (Section 16) |

---

## Decision Matrix: Can I Transfer?

### EU → India

| Condition | GDPR Status | DPDPA Status | Action |
|-----------|-------------|--------------|--------|
| SCCs executed + TIA conducted | ✅ Compliant | N/A (no restriction) | ✅ **Transfer permitted** |
| SCCs executed, NO TIA | ❌ Non-compliant (Schrems II) | N/A | ❌ **Transfer denied** — conduct TIA first |
| NO SCCs | ❌ Non-compliant | N/A | ❌ **Transfer denied** — execute SCCs + conduct TIA |

### India → EU

| Condition | GDPR Status | DPDPA Status | Action |
|-----------|-------------|--------------|--------|
| Any (EEA is adequacy jurisdiction) | ✅ Compliant (Article 45) | ✅ Compliant (no restriction) | ✅ **Transfer permitted** |

### India → US (or other non-EEA)

| Condition | GDPR Status | DPDPA Status | Action |
|-----------|-------------|--------------|--------|
| N/A (non-GDPR scenario) | N/A | ✅ Compliant (no restriction) | ✅ **Transfer permitted** if Rule 6 safeguards in place |

**Key Rule:** For dual-regime scenarios (EU + India data), BOTH frameworks must be satisfied.

---

## GDPR Transfer Mechanisms

### Standard Contractual Clauses (SCCs) — Most Common

| Module | Scenario | Use Case |
|--------|----------|----------|
| **Module 1** | Controller → Controller | EU parent → Indian subsidiary |
| **Module 2** | Controller → Processor | EU company → Indian SaaS provider |
| **Module 3** | Processor → Processor | EU processor → Indian sub-processor |
| **Module 4** | Processor → Controller | Indian processor → EU controller (data return) |

**Critical:** Schrems II requires Transfer Impact Assessment (TIA) for EVERY SCC transfer. Assess destination country laws for compatibility with GDPR safeguards.

### EU Adequacy Countries (No SCC Needed)

✅ Andorra, Argentina, Canada (commercial), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, UK, Uruguay

❌ **India does NOT have EU adequacy** as of October 2026

---

## DPDPA Transfer Requirements

### Section 16: Negative List Model

**Rule:** Transfers permitted UNLESS the Central Government restricts a destination.

**Current Status (October 2026):** 🟢 **No country restricted**

**Rule 15:** Transfers are subject to any requirements the Central Government specifies, by general or special order, for making personal data available to a foreign State or entities under its control. Section 16 and Rule 15 apply from 13 May 2027.

**SDFs:** Rule 13(4) can require specified personal data (and its traffic data) to stay in India.

**Monitor:** MeitY notifications, Data Protection Board updates

**Engineering Implication:** Build transfer governance to support dynamic restriction enforcement. DO NOT hardcode "all transfers permitted."

### Rule 6: Security Safeguards That Travel with the Data

Even when transfer is permitted, security safeguards must apply:

| Safeguard | DPDPA Rule | Implementation |
|-----------|------------|----------------|
| **Encryption at rest** | Rule 6(1)(a) | AES-256, cloud KMS |
| **Encryption in transit** | Rule 6(1)(a) | TLS 1.3 enforced |
| **Access control** | Rule 6(1)(b) | IAM, least privilege, MFA |
| **Logging** | Rule 6(1)(c) | All access/processing events |
| **Log retention** | Rule 6(1)(e) | Minimum 1 year |
| **Processor contracts** | Rule 6(1)(f) | DPA with security clauses |

**Critical:** Data Fiduciary remains responsible for processing by its Data Processors, wherever it occurs (Sections 8(1), 8(5)).

---

## Dual Compliance Checklist

### Phase 1: Legal Foundation
- [ ] Execute GDPR SCCs (Module 2 for C→P most common)
- [ ] Conduct TIA per Schrems II
- [ ] Update Data Processor contracts (Section 8(2)) with security-safeguard provisions (Rule 6(1)(f))
- [ ] Verify consent for processing (DPDPA Section 6(1))

### Phase 2: Security Safeguards
- [ ] Encrypt data at rest (AES-256)
- [ ] Encrypt data in transit (TLS 1.3)
- [ ] Implement IAM with least privilege
- [ ] Deploy comprehensive logging (1-year retention minimum)

### Phase 3: Data Residency Architecture
- [ ] **AWS:** Deploy EU data in eu-west-1/eu-central-1, India data in ap-south-1/ap-south-2
- [ ] **Azure:** Deploy EU data in West Europe/North Europe, India data in Central India/South India
- [ ] Use region restrictions (S3 bucket policies, Azure Policy)
- [ ] Use KMS/CMK for encryption

### Phase 4: Transfer Governance Automation
- [ ] Build transfer approval workflow (checks BOTH GDPR adequacy AND DPDPA restriction status)
- [ ] Implement configuration-driven policy engine
- [ ] Test with simulated restriction scenarios

### Phase 5: Breach Notification
- [ ] **GDPR:** 72 hours to EU DPA
- [ ] **DPDPA:** "Without delay" to Data Principals (Rule 7(1)) and initial intimation to the Board (Rule 7(2)(a)); detailed Board report within 72 hours, extendable on written request (Rule 7(2)(b))
- [ ] Single breach detection triggers parallel notifications

---

## Critical Timelines

| Event | GDPR | DPDPA | Action |
|-------|------|-------|--------|
| **Breach notification to regulator** | 72 hours to DPA (Article 33) | Initial intimation without delay (Rule 7(2)(a)); detailed report within 72 hours (Rule 7(2)(b)) | Parallel notifications |
| **Breach notification to individuals** | Without undue delay (Article 34) | Without delay (Rule 7(1)) | Same workflow |
| **Data Subject rights response** | One month (Article 12(3)) | Rules set no deadline for rights requests; grievances answered within a period not exceeding 90 days (Rule 14(3)) | Unified portal |
| **SCC review/renewal** | Monitor for EU Commission updates | N/A | Quarterly check |
| **Restriction monitoring** | Monitor adequacy decisions | Monitor Section 16 notifications | Daily/weekly automation |

---

## Common Pitfalls

❌ **Assuming GDPR adequacy = no work needed**
✅ Even with adequacy, DPDPA Rule 6 security safeguards still apply

❌ **Hardcoding "India allows all transfers"**
✅ Section 16 allows dynamic restrictions — build for change

❌ **Forgetting onward transfers**
✅ Sub-processors need SCCs too (GDPR) + security safeguards (DPDPA)

❌ **Confusing consent requirements**
✅ GDPR has 6 legal bases; DPDPA primarily requires consent. Verify BOTH.

❌ **Single-region backup strategy**
✅ Cross-region backups = cross-border transfers = compliance requirement

❌ **Ignoring sectoral regulations**
✅ Finance (RBI), securities (SEBI), insurance (IRDAI) may have stricter cross-border rules

---

## AWS Configuration (Quick Start)

```terraform
# EU data residency
resource "aws_s3_bucket" "eu_data" {
  bucket = "company-eu-data-prod"
  # Deploy in eu-west-1 or eu-central-1
}

# India data residency
resource "aws_s3_bucket" "india_data" {
  bucket = "company-india-data-prod"
  # Deploy in ap-south-1 or ap-south-2
}

# Region restriction policy
resource "aws_s3_bucket_policy" "region_lock" {
  # Deny access from outside allowed regions
  # See full template: aws-data-residency.tf
}
```

---

## Azure Configuration (Quick Start)

```json
{
  "policyRule": {
    "if": {
      "allOf": [
        {"field": "location", "notIn": ["westeurope", "northeurope"]},
        {"field": "type", "equals": "Microsoft.Storage/storageAccounts"}
      ]
    },
    "then": {"effect": "deny"}
  }
}
```

**Deploy:** Azure Policy + Initiative (see `azure-data-residency.json`)

---

## Transfer Governance Engine (Python)

```python
from transfer_governance_engine import TransferGovernanceEngine, TransferRequest

engine = TransferGovernanceEngine()

request = TransferRequest(
    origin_jurisdiction="eu",
    destination_jurisdiction="india",
    data_category="personal_data",
    scc_executed=True,
    tia_conducted=True,
    consent_obtained=True
)

result = engine.evaluate_transfer(request)
# Returns: APPROVED | DENIED | MANUAL_REVIEW_REQUIRED
```

**Full implementation:** `transfer_governance_engine.py`

---

## Cross-Framework Integration

**If you also maintain:**

### ISO 27001:2022
- **A.5.31** (Legal requirements) → Track GDPR adequacy + DPDPA Section 16 restrictions
- **A.5.19** (Supplier relationships) → SCCs + processor contracts with Rule 6(1)(f) security provisions
- **A.8.24** (Cryptography) → GDPR Article 32 + DPDPA Rule 6(1)(a)

### SOC 2 Trust Services Criteria
- **CC9.2** (Vendor contracts) → SCCs + DPA with Rule 6(1)(f) security provisions
- **CC6.7** (Encryption) → GDPR Article 32 + DPDPA Rule 6(1)(a)
- **CC7.4** (Incident communication) → Dual breach notification

### NIST CSF 2.0
- **GV.PO-02** (Legal requirements) → Compliance monitoring
- **PR.DS-01** (Data at rest) → Encryption requirement
- **RS.CO-02** (Incident communication) → Breach notification

---

## Regulatory Contacts

**GDPR:**
- **EU DPA Directory:** https://edpb.europa.eu/about-edpb/board/members_en
- **One-Stop-Shop:** Contact lead supervisory authority

**DPDPA:**
- **Data Protection Board of India:** https://dataprotection.gov.in (when live)
- **MeitY Notifications:** https://www.meity.gov.in

**Monitor daily:** GDPR adequacy decisions + DPDPA Section 16 restrictions

---

## Resources

📄 **Full Article:** [GDPR SCCs vs. DPDPA Cross-Border Transfer Rules](/dpdpa-cross-border-data-transfer)

📊 **Comparison Matrix (CSV):** `gdpr-dpdpa-comparison-matrix.csv` (21 dimensions)
✅ **Implementation Checklist:** `dual-compliance-checklist.md` (8 phases, 36 weeks)
💻 **Code Templates:**
- `aws-data-residency.tf` (Terraform)
- `azure-data-residency.json` (ARM template)
- `transfer_governance_engine.py` (Python)

🆘 **Support:** [contact@statechecksecurity.com](mailto:contact@statechecksecurity.com)
🔍 **Compliance Assessment:** [statechecksecurity.com/contact](/contact)

---

**StateCheck Security** — Engineering-focused GDPR + DPDPA compliance for MNCs

*Print this card for quick reference during cross-border data architecture reviews*

---

© 2026 StateCheck Security | [Privacy Policy](/privacy) | [Terms](/terms)