Prepared by Shubhank Suma, AI, Privacy & IP Counsel

Issue

The issue is whether Personal Data transmitted to or processed through a data centre, cloud

vendors located outside India constitutes a “transfer” under Section 16 of the Digital

Personal Data Protection Act, 2023, especially where the foreign data-centre provider cannot access, read or decrypt the data.

For ex- An Indian company uploads encrypted employee records to a foreign cloud server. Although the cloud provider stores the records, it cannot access or decrypt them because the encryption keys remain in India. Has the Personal Data nevertheless been transferred outside India under the DPDP Act?

The DPDP Act does not define “transfer”. Section 2(x), however, expressly includes storage within “processing”, while Section 16 contemplates the transfer of Personal Data by a Data Fiduciary “for processing” to a country or territory outside India. Read together, these provisions strongly support treating the deliberate transmission and placement of Personal Data in a foreign data centre as a transfer outside India, including where the foreign operation consists only of storage, hosting, backup or replication.

The position can be understood more clearly by comparison with the GDPR. Under the GDPR, foreign processing and international transfer are not identical concepts. A data-centre operation constitutes a transfer only where a controller or processor subject to the GDPR transmits or otherwise makes Personal Data available to another controller, joint controller or processor located in a third country or to an international organisation.

The principal distinction is therefore:

Under the GDPR, the existence of a separate third-country importer is essential under the EDPB’s test. Under the DPDP Act, Section 16 does not expressly require a separate foreign recipient and is framed by reference to transfer for processing to a country or territory outside India.

This difference means that GDPR guidance is highly useful in understanding foreign data-centre arrangements, but its separate-importer test should not be imported into the DPDP Act as if it were part of the Indian statutory text.

Both the DPDP Act and the GDPR distinguish between processing and transfer.

Processing describes what is done with Personal Data. A transfer describes a particular cross-border data flow that may subject the processing to additional legal requirements.

This distinction is fundamental. The fact that data-centre storage constitutes processing does not, by itself, answer whether a transfer has occurred. A server may store Personal Data within India or within the European Economic Area without creating an international transfer. The transfer question arises where the data is transmitted, placed or made available outside the relevant territory.

The correct analysis therefore involves two stages:

1. Processing question: Is the data-centre operation a processing activity? 2. Transfer question: Does the architecture involve a cross-border movement or making available of Personal Data that falls within the applicable transfer provision?

Processing Under The DPDP Act

3.1 Statutory Definition

Section 2(x) of the DPDP Act defines “processing”, in relation to Personal Data, as:

“a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.”

The definition confirms that processing includes multiple operations relevant to data centres:

  • storage;
  • recording;
  • organisation and structuring;
  • retrieval;
  • indexing;
  • alignment and combination;
  • sharing;
  • disclosure by transmission;
  • otherwise making available;
  • restriction;
  • erasure; and
  • destruction.

Data-Centre Storage Is Processing

Hosting Personal Data on a server is processing because storage is expressly included in Section 2(x). This remains true where:

  • the data is stored automatically;
  • the provider does not ordinarily view it;
  • the data remains dormant;
  • the server is used solely for backup;
  • the database is a disaster-recovery copy;
  • the data is encrypted; or
  • the provider performs no analytical operation on the data.

The Act applies to wholly or partly automated operations. Human interaction with the data is therefore unnecessary for an operation to constitute processing.

Storage Alone Does Not Prove Transfer

Although storage is processing, the definition does not state that storage is necessarily a transfer. Personal Data stored at a data centre in India is processed, but it has not been transferred outside India merely because it is stored.

An additional cross-border element is required. The data must be deliberately transmitted to or placed for processing in a country or territory outside India.

The reasoning should therefore be framed as follows:

1.uploading data to a foreign data centre involves transmission outside India; 2.the data is then stored or otherwise processed outside India; 3.storage is expressly a form of processing under Section 2(x); and

4.Section 16 expressly contemplates transfer to a country or territory outside India for processing.

Together, these elements support classifying foreign data-centre storage as a transfer outside India.

Meaning Of Transfer Under The DPDP Act

Section 16

Section 16(1) provides:

“The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.”

Section 16 does not define transfer. It also does not state that a transfer requires:

  • disclosure to a separate Data Processor;
  • actual viewing or retrieval by foreign personnel;
  • loss of control by the Indian Data Fiduciary;
  • the recipient’s independent use of the data; or
  • possession of the decryption key by a foreign entity.

Nevertheless, the phrase “transfer … for processing to such country or territory outside India” contains three identifiable elements:

1.a Data Fiduciary transfers Personal Data; 2.the transfer is for processing; and 3.the processing destination is a country or territory outside India.

Geographical Character Of Section 16

Section 16 is framed geographically. It refers to transfer to a country or territory outside India, rather than solely to transfer to a foreign person.

Therefore, the following distinctions are not determinative by themselves:

  • whether the provider is incorporated in India or abroad;
  • whether the infrastructure is owned or leased;
  • whether the server is operated by the Data Fiduciary or a Data Processor; or
  • whether the foreign infrastructure belongs to a group company.

The location of the processing infrastructure remains central. For example, an Indian cloud provider may operate servers in Singapore, while a foreign cloud provider may operate a data-centre region in India. The provider’s nationality does not necessarily establish the location of processing.

Better Interpretation

The stronger interpretation is that Personal Data deliberately transmitted to a server located outside India for storage, hosting, backup or replication is transferred outside India for processing.

This interpretation preserves a distinction between processing and transfer:

  • storage identifies the processing operation;
  • transmission and placement outside India supply the cross-border transfer element; and
  • Section 16 supplies the legal framework for restrictions on that transfer.

However, because transfer is undefined, this remains a statutory interpretation rather than an express technical rule stated in the Act.

How The GDPR Analyses The Same Data-Centre Arrangement

Processing Under The GDPR

The GDPR also treats storage as processing. Article 4(2) defines processing broadly to include collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, restriction, erasure and destruction.

Accordingly, storing Personal Data in a data centre is processing under both the GDPR and the DPDP Act.

The significant difference arises at the second stage, namely whether the foreign data-centre processing constitutes an international transfer.

Article 44 and Chapter V

Article 44 of the GDPR applies to a transfer of Personal Data that is undergoing processing or is intended for processing after transfer to a third country or international organisation. Chapter V seeks to ensure that the protection guaranteed by the GDPR is not undermined when Personal Data is transferred outside the EEA legal framework.

Like the DPDP Act, the GDPR does not define “transfer”. However, the European Data Protection Board has issued detailed guidance explaining when Chapter V applies.

The EDPB’s Three Cumulative Criteria

Under EDPB Guidelines 05/2021, a processing operation constitutes a transfer where all three of the following criteria are satisfied:

1. a controller or processor acting as exporter is subject to the GDPR for the relevant processing; 2. the exporter discloses by transmission or otherwise makes the Personal Data available to another controller, joint controller or processor acting as importer; and 3. the importer is located in a third country or is an international organisation, regardless of whether the importer is itself subject to the GDPR under Article 3.

If any of these criteria is absent, the operation is not a Chapter V transfer under the EDPB’s test. The foreign processing may nevertheless remain subject to other provisions of the GDPR and may create heightened risks that must be addressed separately.

Foreign Cloud Provider: Processing And Transfer

Assume that an EEA controller uploads customer information to a data centre in India operated by a separate Indian cloud provider.

The cloud provider stores the data on behalf of the EEA controller. The operation is processing because storage is included within the GDPR definition. It is also a Chapter V transfer because:

1. the EEA controller is subject to the GDPR; 2. it transmits or makes the data available to another person, the Indian cloud provider acting as processor; and 3. the processor is located in a third country.

Actual viewing by an employee of the Indian provider is unnecessary. The transfer arises from transmission or making available to the separate third-country processor, not from evidence that an individual employee has opened the relevant file.

If a transfer occurs, Article 44 requires compliance with Chapter V. Depending on the relevant country and arrangement, this may require:

  • an adequacy decision under Article 45
  • appropriate safeguards under Article 46, including applicable Standard Contractual Clauses
  • Binding Corporate Rules under Article 47 for qualifying intra-group transfers

No Actual Human Access

The EDPB’s test does not require proof of actual human access. It requires the exporter to disclose by transmission or otherwise make Personal Data available to a separate third-country importer.

A foreign cloud or hosting provider may receive and automatically store data without any employee reading it. That remains a transfer if the three cumulative criteria are met. The relevant event is the transmission or making available of the data to the processing environment of the separate importer.

The following facts do not independently prevent transfer classification:

  • no employee has viewed the data;
  • routine access is contractually prohibited;
  • storage is fully automated;
  • access is permitted only during an emergency;
  • data is held only as a backup; or
  • the provider has not exercised its technical access rights.

Position Under The DPDP Act

The same practical conclusion should ordinarily apply under the DPDP Act, although through different reasoning.

Section 16 does not expressly adopt the EDPB’s “another controller or processor” criterion. Instead, the Indian reasoning is based on:

  • the deliberate transmission of Personal Data outside India;
  • its placement in a foreign country or territory;
  • storage or other processing at the foreign destination; and
  • Section 16’s express reference to transfer for processing outside India.

Accordingly, the absence of actual foreign access should not ordinarily prevent transfer classification under either framework. The legal route to that conclusion, however, is different.

Encrypted Data In A Foreign Data Centre

Encryption does not ordinarily prevent an operation from being a transfer where the EDPB’s three criteria are otherwise met. If an EEA controller uploads encrypted Personal Data to a separate cloud provider in a third country, the data has still been transmitted or made available to that importer.

Encryption is principally relevant to the protection of the transferred data. It may constitute a supplementary technical measure where the exporter exclusively controls the keys and the third-country provider or public authorities cannot obtain intelligible data. The EDPB’s supplementary-measures guidance requires exporters relying on Article 46 tools to assess whether third-country law or practice affects the effectiveness of the safeguards and, where necessary, implement additional technical, contractual or organisational measures.

The analysis must therefore separate:

  • transfer classification: Has encrypted Personal Data been transmitted or made available to a separate third-country importer?
  • effectiveness of protection: Can the importer, a subprocessor or a foreign authority decrypt or otherwise access intelligible Personal Data?

Strong encryption may make a transfer legally safer or, in an appropriate architecture, provide an effective supplementary measure. It does not necessarily cause the underlying transfer to disappear.

8.2 Does Encryption Prevent A DPDP Act Transfer?

The DPDP Act does not expressly address this issue. However, if the information remains Personal Data and is transmitted to a data centre outside India for storage, it should ordinarily be mapped as a transfer.

The fact that the foreign provider lacks the key affects accessibility, confidentiality and security. It does not alter the facts that:

1.the data has been transmitted outside India; 2.the data is stored in another country; 3.storage is processing under Section 2(x); and

4.Section 16 regulates transfer outside India for processing. 5.The GDPR comparison therefore reinforces, rather than conclusively determines, the Indian interpretation: a restriction on intelligible access is generally a safeguard, not necessarily a reason to deny that a cross-border transfer occurred.

Remote Access To An Indian Or Eea Data Centre

A transfer may arise without relocating the primary server.

GDPR Position

If Personal Data remains stored in the EEA but a separate support provider in India can remotely access it, the data may be made available to a separate processor located in a third country. The EDPB’s criteria focus on disclosure or making available, not merely on the location of the storage medium.

DPDP Act Position

If Personal Data remains stored in India but is accessed by a separate foreign support team, provider or group entity, the arrangement should prudentially be mapped as a cross-border transfer or foreign making available.

The DPDP Act does not expressly explain whether remote foreign access constitutes a transfer. Nevertheless, Section 2(x) includes retrieval, use, disclosure by transmission and otherwise making available within processing. If a foreign person retrieves or accesses the Personal Data from outside India, substantive processing occurs outside India.

The data-centre assessment must therefore examine both:

  • where the data is stored; and
  • from where the data can be accessed or administered.

Application To Data-Centre Scenarios

Scenario 1: Separate Foreign Cloud Provider

An Indian Data Fiduciary uploads customer records to a Singapore cloud provider.

  • DPDP Act: Strong case for transfer because the data is transmitted to Singapore for storage.
  • GDPR equivalent: Transfer if a GDPR-regulated exporter makes the data available to the separate Singapore processor.
  • Access: Actual human access is unnecessary.
  • Encryption: Relevant safeguard, but does not ordinarily eliminate transfer classification.

Scenario 2: Same Company’s Foreign Servers

An Indian company stores Personal Data on servers in the United States owned directly by the same legal entity.

  • DPDP Act: Safer position is to classify the movement as a transfer, although the issue is not expressly resolved.
  • GDPR equivalent: May be foreign processing without a Chapter V transfer because no separate importer exists.
  • Residual obligations: Security, accountability and foreign-law risks continue under both frameworks.

Scenario 3: Foreign Subsidiary

An Indian company stores data on infrastructure operated by its Singapore subsidiary.

  • DPDP Act: Ordinarily a transfer to a foreign group entity.
  • GDPR equivalent: Transfer because the subsidiary is a separate legal person, assuming the other EDPB criteria are satisfied.
  • Corporate group: Common ownership does not eliminate separate legal identity.

15. Conclusion

The GDPR provides the clearest analytical distinction between foreign processing and international transfer.

Under the GDPR, processing Personal Data through a data centre outside the EEA constitutes a Chapter V transfer where a GDPR-regulated exporter transmits or otherwise makes the data available to a separate controller, joint controller or processor located in a third country. Actual human access is not required. Storage by a separate third-country cloud provider can be sufficient. Encryption may protect the transferred data but does not necessarily prevent the operation from being classified as a transfer.

Where the foreign data centre is operated entirely by the same legal entity and no Personal Data is made available to another controller or processor, the EDPB’s second criterion may not be satisfied. The operation may then constitute foreign processing without being a Chapter V transfer. Other GDPR obligations and foreign-processing risks continue to apply.

Under the DPDP Act, storage is expressly processing, and Section 16 contemplates transfer to a country or territory outside India for processing. The stronger interpretation is therefore that deliberate transmission of Personal Data to foreign data-centre infrastructure for hosting, storage, replication or backup constitutes a transfer outside India.

However, Section 16 and Rule 15 do not define transfer or require a separate importer. Consequently, the GDPR’s same-entity exception cannot automatically be imported into Indian law. Personal Data moved to the same legal entity’s foreign infrastructure should prudentially be mapped as a transfer under the DPDP Act, while recognising that the issue has not been expressly resolved.