Cross-Border Data Transfer Clause Template

CROSS-BORDER DATA TRANSFER CLAUSE

(For incorporation into a Data Processing Agreement, Data Sharing Agreement, or other commercial contract)

1. BACKGROUND
This Clause governs the transfer of personal data by [Organization Name] ("Transferring Party") to [Recipient Name], located in [Country/Territory] ("Recipient"), in the course of [describe processing activity]. This Clause is intended to give effect to the Transferring Party's obligations under Section 16 of the DPDP Act, 2023, which permits transfer of personal data outside India except to countries or territories restricted by notification of the Central Government.

2. REPRESENTATION ON PERMITTED TRANSFER
The Transferring Party confirms that, as of the Effective Date of this Clause, [Country/Territory] is not a country or territory to which transfer of personal data has been restricted by notification of the Central Government under Section 16 of the DPDP Act. The Parties agree to monitor for any such notification and to suspend transfers promptly if [Country/Territory] becomes restricted.

3. SCOPE OF DATA TRANSFERRED
The categories of personal data transferred under this Clause are set out in Annexure A, and shall be limited to what is necessary for [state purpose, e.g., "cloud storage and processing", "customer support operations", "global HR administration"].

4. RECIPIENT OBLIGATIONS
The Recipient agrees to:
   a. Process the transferred personal data solely for the purpose stated in Annexure A and on the documented instructions of the Transferring Party;
   b. Apply security safeguards for the transferred data that are no less protective than those required of the Transferring Party under Section 8 of the DPDP Act and the DPDP Rules, 2025, including encryption in transit and at rest, and access logging;
   c. Not further transfer the personal data to any other jurisdiction or third party without the Transferring Party's prior written consent;
   d. Cooperate with the Transferring Party to fulfil Data Principal rights requests (access, correction, erasure) notwithstanding the data's location outside India;
   e. Notify the Transferring Party of any Personal Data Breach affecting the transferred data without undue delay and in any event within [X hours], to enable timely intimation to the Data Protection Board of India and affected Data Principals under Section 8(6);
   f. Submit to reasonable audit and inspection by the Transferring Party or its appointed auditor regarding handling of the transferred data.

5. GOVERNMENT AND REGULATORY ACCESS
Where the Recipient is subject to a legally binding request from a public authority in [Country/Territory] for access to the transferred personal data, the Recipient shall, to the extent legally permitted, promptly notify the Transferring Party before complying, and shall limit disclosure to what is strictly required by that request.

6. DATA LOCALISATION OVERRIDE
Notwithstanding this Clause, where any sectoral law applicable to the Transferring Party (e.g., in financial services or critical infrastructure) mandates that specific categories of data be stored exclusively within India, such categories shall be excluded from the scope of transfer under Annexure A.

7. TERMINATION AND RETURN OF DATA
Upon termination of the underlying agreement, the Recipient shall, at the Transferring Party's election, return or certify deletion of all transferred personal data within [X days], except to the extent retention is required by applicable law.

8. CHANGES IN LAW
If the Central Government issues a notification restricting transfers to [Country/Territory], or amends the DPDP Rules, 2025 in a manner affecting this Clause, the Parties shall promptly amend or suspend this Clause to the extent necessary to maintain compliance.

9. GOVERNING LAW
This Clause is governed by the laws of India, without prejudice to any additional data-protection law applicable to the Recipient in [Country/Territory].

ANNEXURE A: Description of Transferred Data (Categories, Purpose, Volume, Frequency)