# GDPR + DPDPA Dual Compliance Checklist for Cross-Border Data Transfers

**Version:** 1.1 | **Date:** April 2, 2026 (citations updated October 17, 2026) | **Source:** [StateCheck Security](https://statechecksecurity.com)

**Purpose:** This checklist guides organizations processing both EU personal data and Indian personal data to implement a unified cross-border transfer compliance architecture.

**Audience:** Data Protection Officers (DPOs), CISOs, Compliance Leads, Cloud Architects

**Scope:** Organizations subject to BOTH GDPR (processing EU data subjects' data) AND DPDPA (processing Indian Data Principals' data)

**How to use:** Work through each phase sequentially. Mark items as complete only when you have documented evidence for both GDPR and DPDPA compliance.

---

## Pre-Assessment (Do This First)

- [ ] **Determine regulatory applicability**
  - [ ] Confirm GDPR applies (processing EU data subjects' data)
  - [ ] Confirm DPDPA applies (processing Indian residents' personal data)
  - [ ] Document which legal entities are controllers/fiduciaries
  - [ ] Document which are processors
  - [ ] Identify if any entities qualify as Significant Data Fiduciary (SDF)

- [ ] **Map current cross-border data flows**
  - [ ] List all countries where data is processed
  - [ ] Identify which flows involve EU→India or India→EU
  - [ ] Identify which flows involve EU→Third Country or India→Third Country
  - [ ] Document processors in each jurisdiction
  - [ ] Map data residency for each processing operation

- [ ] **Assess current transfer mechanisms**
  - [ ] For EU data: Are SCCs/BCRs/adequacy in place?
  - [ ] For Indian data: Do contracts provide for reasonable security safeguards (Rule 6(1)(f))?
  - [ ] Identify gaps where no transfer mechanism exists

- [ ] **Assign compliance owner**
  - [ ] Designate DPO (if required by GDPR Article 37 or DPDPA Section 10(2)(a))
  - [ ] Assign cross-border transfer compliance lead
  - [ ] Define escalation path for transfer denials

---

## Phase 1: Legal & Contractual Foundation (Weeks 1-6)

### GDPR Transfer Mechanisms

- [ ] **Verify EU adequacy decisions for existing flows**
  - [ ] Check if any destination countries have EU adequacy
  - [ ] Note: India does NOT have EU adequacy as of October 2026
  - [ ] Document which flows can rely on adequacy

- [ ] **Implement Standard Contractual Clauses (SCCs)**
  - [ ] Identify SCC module for each transfer scenario:
    - [ ] Module 1: Controller to Controller (C2C)
    - [ ] Module 2: Controller to Processor (C2P)
    - [ ] Module 3: Processor to Processor (P2P)
    - [ ] Module 4: Processor to Controller (P2C)
  - [ ] Execute SCCs with all non-EEA processors
  - [ ] Include Annexes I-III with specific transfer details
  - [ ] Ensure onward transfer clauses for sub-processors

- [ ] **Conduct Transfer Impact Assessments (TIA) per Schrems II**
  - [ ] Assess laws of destination country (India, etc.)
  - [ ] Evaluate if local laws impair SCC safeguards
  - [ ] Document supplementary measures if needed
  - [ ] Obtain approval from DPO/legal before transfer

### DPDPA Transfer Compliance

- [ ] **Monitor Section 16 restricted countries list**
  - [ ] Subscribe to MeitY notifications
  - [ ] Subscribe to Data Protection Board updates
  - [ ] **Current status (October 2026):** No country restricted
  - [ ] Build alert system for new restrictions
  - [ ] Document monitoring process

- [ ] **Update Data Processor agreements with Rule 6 safeguards**
  - [ ] Include encryption requirements (Rule 6(1)(a))
  - [ ] Include access control requirements (Rule 6(1)(b))
  - [ ] Include logging and monitoring (Rule 6(1)(c))
  - [ ] Include 1-year log retention (Rule 6(1)(e))
  - [ ] Include a provision binding the processor to take reasonable security safeguards (Rule 6(1)(f))
  - [ ] Include processor audit rights (contractual best practice; not prescribed by the Rules)
  - [ ] Ensure contracts support Data Principal rights (Sections 11-12)

- [ ] **Verify consent for cross-border processing (DPDPA)**
  - [ ] Review consent notices for purpose granularity
  - [ ] Ensure consent covers international processing
  - [ ] Implement consent withdrawal mechanism
  - [ ] Burden of proof: Maintain consent audit trail (Section 6(10))

### Unified Contract Template

- [ ] **Create dual-compliance Data Processor Agreement (DPA)**
  - [ ] Base template: GDPR SCC Module 2 (C2P) or Module 3 (P2P)
  - [ ] Append DPDPA-specific clauses:
    - [ ] Rule 6(1)(a)-(f) security safeguards
    - [ ] Section 8(5) liability for processor breaches
    - [ ] Section 11-12 Data Principal rights support
    - [ ] Rule 7 breach notification obligations
  - [ ] Test template with legal counsel
  - [ ] Roll out to all existing processor relationships

---

## Phase 2: Security Safeguards (Weeks 7-12)

### Encryption (GDPR Article 32 + DPDPA Rule 6(1)(a))

- [ ] **Implement encryption at rest**
  - [ ] AES-256 encryption for all databases
  - [ ] Cloud KMS for key management (AWS KMS, Azure Key Vault)
  - [ ] Verify encryption for ALL jurisdictions (EU, India, others)
  - [ ] Document encryption standards in security policy

- [ ] **Implement encryption in transit**
  - [ ] Enforce TLS 1.3 for all APIs
  - [ ] Reject weak cipher suites
  - [ ] Monitor for TLS downgrade attacks
  - [ ] Test encryption between EU and India environments

### Access Control (GDPR Article 32 + DPDPA Rule 6(1)(b))

- [ ] **Implement IAM with least privilege**
  - [ ] Role-based access control (RBAC) for all data systems
  - [ ] MFA for privileged accounts
  - [ ] Separate roles for EU vs. India data access
  - [ ] Regular access reviews (quarterly minimum)

- [ ] **Implement network segmentation**
  - [ ] VPCs/VNets for EU data separate from India data where needed
  - [ ] Firewall rules limiting cross-region access
  - [ ] Monitor for unauthorized cross-border access

### Logging & Monitoring (GDPR Article 32 + DPDPA Rule 6(1)(c)(e))

- [ ] **Deploy comprehensive audit logging**
  - [ ] Log all data access and processing events
  - [ ] Log cross-border data transfers
  - [ ] Integrate logs with SIEM
  - [ ] **DPDPA requirement:** Retain logs minimum 1 year (Rule 6(1)(e))
  - [ ] **GDPR requirement:** Retain logs as needed for accountability

- [ ] **Monitor for anomalous transfers**
  - [ ] Alert on transfers to newly restricted countries
  - [ ] Alert on transfers without valid SCC/consent
  - [ ] Alert on bulk data export events

---

## Phase 3: Data Residency Architecture (Weeks 13-18)

### AWS Configuration

- [ ] **Configure AWS regions for compliance**
  - [ ] **EU data:** Deploy in eu-west-1 (Ireland) or eu-central-1 (Frankfurt)
  - [ ] **India data:** Deploy in ap-south-1 (Mumbai) or ap-south-2 (Hyderabad)
  - [ ] Use S3 bucket policies to enforce region restrictions
  - [ ] Use AWS Organizations SCPs for account-level enforcement

- [ ] **Implement Terraform/IaC for data residency**
  - [ ] S3 bucket policy with region restriction
  - [ ] KMS key policy limiting operations to specific regions
  - [ ] Organizations SCP denying cross-region data movement
  - [ ] Test configuration with compliance scans

- [ ] **Configure AWS services for dual compliance**
  - [ ] RDS: Use AWS KMS for encryption at rest
  - [ ] S3: Enable default encryption + versioning
  - [ ] CloudTrail: Enable logging in BOTH EU and India regions
  - [ ] VPC Flow Logs: Monitor cross-region traffic

### Azure Configuration

- [ ] **Configure Azure regions for compliance**
  - [ ] **EU data:** Deploy in West Europe or North Europe
  - [ ] **India data:** Deploy in Central India or South India
  - [ ] Use Azure Policy to enforce location restrictions
  - [ ] Use Azure Blueprints for compliant infrastructure templates

- [ ] **Implement Azure Policy for data residency**
  - [ ] Create policy: Deny resource creation outside allowed regions
  - [ ] Create policy: Require Customer-Managed Keys (CMK) for encryption
  - [ ] Assign policies at subscription or management group level
  - [ ] Test with policy compliance scans

- [ ] **Configure Azure services for dual compliance**
  - [ ] SQL Database: Enable TDE with CMK
  - [ ] Storage Accounts: Enforce HTTPS-only + encryption
  - [ ] Monitor: Enable diagnostic logs in BOTH EU and India
  - [ ] Network Security Groups: Restrict cross-region flows

### Multi-Cloud & Hybrid Scenarios

- [ ] **Design for multi-cloud compliance**
  - [ ] Document which data lives where (AWS vs Azure vs on-prem)
  - [ ] Ensure transfer governance applies across all platforms
  - [ ] Test failover scenarios (do they violate residency?)
  - [ ] Monitor replication for compliance

---

## Phase 4: Transfer Governance Automation (Weeks 19-24)

### Dynamic Restriction Enforcement

- [ ] **Build transfer approval workflow**
  - [ ] API/service to check BOTH:
    - [ ] EU adequacy status (for GDPR)
    - [ ] India Section 16 restriction status (for DPDPA)
  - [ ] Block transfers if either check fails
  - [ ] Log all transfer approval decisions
  - [ ] Alert on attempted transfers to restricted countries

- [ ] **Implement configuration-driven policy engine**
  - [ ] Use code template from article (Python policy engine)
  - [ ] Configure allowed destinations as code
  - [ ] Update config when restrictions change
  - [ ] Deploy as pre-transfer validation gate

- [ ] **Test transfer governance**
  - [ ] Simulate new GDPR adequacy decision (allow transfer)
  - [ ] Simulate new DPDPA Section 16 restriction (block transfer)
  - [ ] Verify logs capture decisions
  - [ ] Verify alerts fire correctly

### Processor Audit Automation

- [ ] **Schedule regular processor audits**
  - [ ] Quarterly audit of cross-border processors
  - [ ] Verify SCC compliance (GDPR)
  - [ ] Verify Rule 6 security safeguards (DPDPA)
  - [ ] Document findings and remediation

- [ ] **Automate compliance checks where possible**
  - [ ] API checks for processor encryption status
  - [ ] Automated security attestation collection
  - [ ] Automated SCC renewal tracking

---

## Phase 5: Data Subject / Principal Rights (Weeks 25-28)

### Unified Rights Portal

- [ ] **Build cross-border rights handling capability**
  - [ ] Portal/API for Data Principals to submit requests
  - [ ] Identify which data is subject to GDPR vs DPDPA vs both
  - [ ] Support BOTH GDPR rights (Article 15-22) AND DPDPA rights (Sections 11-12)

- [ ] **Implement access request workflow**
  - [ ] **GDPR:** 30-day response SLA (Article 12(3))
  - [ ] **DPDPA:** 30-day response SLA (typical interpretation)
  - [ ] Compile data from ALL processors (including cross-border)
  - [ ] Return data in portable format

- [ ] **Implement erasure request workflow**
  - [ ] Cascading delete across ALL systems (EU + India + others)
  - [ ] Notify processors of erasure (GDPR SCC Clause 8.5 + DPDPA)
  - [ ] Log erasure events with 1-year retention
  - [ ] Handle legal retention holds (tax, litigation, etc.)

---

## Phase 6: Breach Notification (Weeks 29-32)

### Dual Notification Workflow

- [ ] **GDPR breach notification (72 hours to DPA)**
  - [ ] Identify lead supervisory authority (one-stop-shop)
  - [ ] Prepare breach notification template
  - [ ] Include cross-border transfer details if breach involves India
  - [ ] Test notification workflow end-to-end

- [ ] **DPDPA breach notification (dual timeline)**
  - [ ] **Tier 1:** Notify affected Data Principals "without delay" (Rule 7(1))
  - [ ] **Tier 2a:** Initial intimation to Board "without delay" (Rule 7(2)(a))
  - [ ] **Tier 2b:** Detailed report to Board within 72 hours (Rule 7(2)(b))
  - [ ] Prepare breach notification templates for both
  - [ ] Test notification workflow end-to-end

- [ ] **Unified breach response playbook**
  - [ ] Single detection triggers BOTH GDPR and DPDPA notifications
  - [ ] Playbook includes:
    - [ ] SIEM alert classification
    - [ ] Data impact assessment (EU vs India vs both)
    - [ ] Parallel notification to EU DPA, Data Principals, and India Board
    - [ ] Processor notification (if processor caused breach)
  - [ ] Conduct tabletop exercise annually

---

## Phase 7: Documentation & Audit Readiness (Weeks 33-36)

### GDPR Accountability

- [ ] **Maintain Records of Processing Activities (RoPA)**
  - [ ] Document all cross-border transfers
  - [ ] Include SCC details, TIA outcomes, adequacy status
  - [ ] Update quarterly or when transfers change

- [ ] **Maintain Transfer Impact Assessment (TIA) records**
  - [ ] One TIA per destination country
  - [ ] Review annually or when laws change in destination
  - [ ] Document supplementary measures if needed

### DPDPA Demonstrating Compliance

- [ ] **Maintain consent audit trail**
  - [ ] Section 6(10) burden of proof on Data Fiduciary
  - [ ] Store consent records with timestamp, purpose, language, method
  - [ ] Retain for duration of processing + statute of limitations

- [ ] **Maintain processor contract repository**
  - [ ] All Data Processor agreements with Rule 6(1)(f) security provisions
  - [ ] Audit reports from processors
  - [ ] Evidence of processor security safeguards

### Unified Compliance Evidence Package

- [ ] **Create GDPR-DPDPA evidence matrix**
  - [ ] Map each GDPR requirement to DPDPA equivalent
  - [ ] Document where single control satisfies both
  - [ ] Document where separate controls needed
  - [ ] Store evidence centrally (compliance GRC tool or shared drive)

- [ ] **Prepare for audits**
  - [ ] GDPR: Prepare for EU DPA audit
  - [ ] DPDPA: Prepare for India Board inquiry (if SDF)
  - [ ] Independent audits: Prepare for ISO 27001, SOC 2, etc.
  - [ ] Test evidence retrieval (can you produce docs in 24 hours?)

---

## Phase 8: Continuous Compliance (Ongoing)

### Monitoring & Maintenance

- [ ] **Monitor regulatory changes**
  - [ ] Subscribe to EU DPA guidance updates
  - [ ] Subscribe to MeitY and Data Protection Board notifications
  - [ ] Monitor for new Section 16 restrictions
  - [ ] Monitor for changes to EU adequacy decisions
  - [ ] Review and update controls when regulations change

- [ ] **Quarterly compliance review**
  - [ ] Review all cross-border data flows
  - [ ] Verify SCCs are current
  - [ ] Verify Rule 6 security safeguards are in place
  - [ ] Verify no transfers to newly restricted countries
  - [ ] Update RoPA and consent records

- [ ] **Annual deep audit**
  - [ ] Engage independent auditor for GDPR accountability review
  - [ ] Engage independent auditor for DPDPA (if SDF per Section 10(2)(b))
  - [ ] Review all TIAs
  - [ ] Review all processor audits
  - [ ] Remediate findings before next cycle

### Metrics & Reporting

- [ ] **Track transfer compliance metrics**
  - [ ] Number of cross-border transfers (EU→India, India→EU, other)
  - [ ] Number of SCCs executed vs. needed
  - [ ] Number of TIAs conducted
  - [ ] Number of transfer denials (due to restrictions or failed TIA)
  - [ ] Number of processor audit findings

- [ ] **Report to Board/Executive Committee**
  - [ ] Quarterly compliance posture report
  - [ ] Include regulatory change impact
  - [ ] Include transfer volume and risk metrics
  - [ ] Escalate compliance gaps with remediation plans

---

## SDF-Specific Requirements (If Applicable)

If your organization is designated as a Significant Data Fiduciary under DPDPA Section 10, add these requirements:

- [ ] **Appoint India-based DPO (Section 10(2)(a))**
  - [ ] DPO reports to Board of Directors
  - [ ] DPO contact published in privacy notice
  - [ ] DPO oversees cross-border transfer governance

- [ ] **Conduct periodic DPIA (Section 10(2)(c))**
  - [ ] Once every twelve months (Rule 13(1)) + trigger events (new cross-border processing, new processor)
  - [ ] Use independent assessor
  - [ ] Have the assessor furnish a report of significant DPIA and audit observations to the Data Protection Board (Rule 13(2))

- [ ] **Track SDF localisation (Rule 13(4))**
  - [ ] Monitor Central Government specifications of personal data that must not be transferred outside India
  - [ ] Keep specified personal data and its traffic data in Indian regions

- [ ] **Engage independent data auditor (Section 10(2)(b))**
  - [ ] Annual audit of cross-border transfer controls
  - [ ] Verify Rule 6 safeguards with processors
  - [ ] Verify Section 11-12 rights support
  - [ ] Remediate findings within SLA

---

## Appendix: Common Dual Compliance Pitfalls

### Pitfall 1: Assuming GDPR compliance = DPDPA compliance
**Reality:** The frameworks are different. GDPR focuses on transfer mechanisms (SCCs), DPDPA focuses on security outcomes (Rule 6). You need both.

### Pitfall 2: Hardcoding "no restrictions" for India
**Reality:** Section 16 allows dynamic restrictions. Build for change, not for current status.

### Pitfall 3: Forgetting onward transfers
**Reality:** If your Indian processor uses a sub-processor, GDPR requires SCCs at that tier too. DPDPA requires you to ensure security throughout the chain.

### Pitfall 4: Confusing consent requirements
**Reality:** GDPR allows processing without consent if another legal basis applies. DPDPA primarily requires consent (Section 6). For cross-border processing, verify you have BOTH.

### Pitfall 5: Single-region backup strategy
**Reality:** If you back up EU data to India (or vice versa), that's a cross-border transfer. Your backup architecture must be compliant.

### Pitfall 6: Ignoring sectoral regulations
**Reality:** If you're in finance (RBI), securities (SEBI), or insurance (IRDAI), sector-specific India regulations may impose stricter cross-border rules than DPDPA.

---

## Sign-Off

**Compliance Owner:** ____________________
**DPO (GDPR/DPDPA):** ____________________
**CISO:** ____________________
**Date of Completion:** ____________________

**Next Review Date:** ____________________

---

## Resources

- **Full Article:** [GDPR SCCs vs. DPDPA Cross-Border Transfer Rules](/dpdpa-cross-border-data-transfer)
- **Comparison Matrix:** `gdpr-dpdpa-comparison-matrix.csv`
- **Code Templates:** See `code-templates/` directory (AWS, Azure, Python governance)
- **Quick Reference:** `quick-reference-card.md`

**Support:** For assistance with dual GDPR+DPDPA compliance, contact StateCheck Security at [contact@statechecksecurity.com](mailto:contact@statechecksecurity.com) or request a [compliance assessment](/contact).