DPDP cross-border rules aren’t live yet: how to prepare wisely

A column published by Bar and Bench on 18 September 2026 makes a point many compliance teams need to hear: India’s cross-border transfer rule under the Digital Personal Data Protection (DPDP) framework is not yet in force, yet contracts across the market are being rewritten as though it were. With the first anniversary of the DPDP Rules approaching in November, now is the right moment to separate what is required today from what is sensible preparation.

Where the DPDP timeline actually stands

India’s Digital Personal Data Protection Rules, 2025 were notified in November 2025 and commence in phases. As summarised by Hunton’s privacy team, the definitions and the provisions constituting the Data Protection Board took effect immediately; registration and obligations of consent managers follow after one year; and the substantive obligations, including notice, individuals’ rights and breach notification, apply after 18 months.

The Bar and Bench column describes this as three stages: November 2025 for the Board and procedural provisions, November 2026 for consent manager registration and enforcement machinery, and May 2027 for substantive obligations, including the conditions on cross-border transfers.

Why the cross-border point matters

The column argues that India’s model is very different from the GDPR. Under Rule 15, as described in the piece, transfers outside India are permitted by default unless the Central Government restricts transfers to particular countries. There are no standard contractual clauses, no transfer impact assessments and no adequacy whitelist.

That has two practical consequences for multinational groups, particularly UK and EU businesses with Indian operations or suppliers:

• Copying GDPR transfer machinery into Indian contracts is not required and may create obligations that do not match the eventual Indian regime.
• The real risk is a future restriction. If the Government notifies a restricted country, data flows into that jurisdiction would need to change. Contracts should make that change easy, not assume it will never happen.

The author recommends “regulatory change” clauses that require good-faith renegotiation once Rule 15 and any restriction notification take effect, alongside clear distinctions between present obligations and forward-looking preparation.

What to do now

The months before May 2027 are best spent on work that pays off whatever the final detail looks like.

1. Map your data flows. Identify which Indian personal data leaves India, where it goes and which suppliers touch it. This is the foundation for every later decision.
2. Audit your vendor chain. Know which processors and sub-processors handle Indian data, and secure audit and cooperation rights in contracts now.
3. Add flexible transfer clauses. Use regulatory change provisions rather than hard-coding mechanisms that may never apply.
4. Prepare for consent managers. From November 2026, registered consent managers will begin operating. Consider how your consent capture and withdrawal will interoperate with them.
5. Build breach and rights workflows. Notification, access, correction and erasure processes take time to design, test and staff. Do not leave them to 2027.
6. Be honest internally. Label work as “required now” or “preparation” so budgets and priorities reflect real deadlines.

With teams in London and Hyderabad, Praeferre supports organisations operating across the UK, EU and India. Our GRC automation platform maps DPDP requirements to controls you may already have for GDPR and ISO 27001, and our Third-Party Risk Management service helps you understand where Indian data travels. Read our DPDP framework overview.

Common questions

Sources

1. The DPDP cross-border transfer rules aren’t live yet; so why are contracts being redrafted as if they are? — Bar and Bench, 18 September 2026
2. India Enacts Data Protection Rules, Introducing New Privacy Regime — Hunton Andrews Kurth, 26 November 2025