As businesses accelerate preparations for India's Digital Personal Data Protection (DPDP) framework, a growing debate has emerged around the premature redrafting of contracts for cross-border data transfers.
Legal commentators note that Section 16 of the DPDP Act, 2023 and Rule 15 of the DPDP Rules, 2025—which govern cross-border transfers of personal data—have not yet become operational. The provisions are expected to come into force during the final phase of the Act's staggered implementation, currently anticipated around May 2027.
Despite this, companies across sectors have begun revising vendor agreements, cloud-service contracts, outsourcing arrangements, and data processing addenda to include DPDP-specific transfer clauses. Privacy consultants and legal advisors are increasingly recommending contractual safeguards in anticipation of future regulatory requirements.
The DPDP framework adopts a "negative-list" approach to international data transfers. Under Section 16, personal data transfers outside India are generally permitted unless the Central Government specifically restricts transfers to particular countries or territories. This differs significantly from the European Union's GDPR regime, which relies on adequacy assessments, Standard Contractual Clauses (SCCs), and other transfer safeguards.
Experts argue that importing GDPR-style contractual mechanisms into Indian agreements may be unnecessary and, in some cases, counterproductive. Since no restricted-country list has yet been published and the transfer provisions remain inactive, organizations risk creating compliance obligations that exceed future legal requirements.
Instead of imposing rigid transfer frameworks, legal practitioners recommend drafting adaptable contractual provisions. These may include regulatory-change clauses, cooperation obligations for data mapping, and mechanisms allowing future amendments once the government clarifies the operational requirements of Rule 15.
The discussion highlights a broader challenge in privacy compliance: balancing preparedness with legal certainty. While businesses should inventory data flows, assess vendor relationships, and build governance frameworks, they must also distinguish between current legal obligations and anticipated future requirements.
Industry observers emphasize that organizations should continue complying with applicable sector-specific rules and existing data protection requirements while monitoring forthcoming notifications under the DPDP regime. Until the substantive provisions become effective, contractual readiness should focus on flexibility rather than mandatory transfer mechanisms.
The debate serves as a reminder that compliance planning should be driven by the law currently in force, while maintaining sufficient adaptability for the regulatory landscape expected to emerge in 2027.