From Statute To Notification: Executive Discretion And The Unfinished Architecture Of India’s Cross-Border Data Transfer Regime
Saveri Sourabh Sharma, NMIMS Kirit P. Mehta School of Law, Mumbai (2021-2026)
ABSTRACT
The Digital Personal Data Protection Act, 2023 replaced a decade of tiered, mirror-and-localise proposals with a single negative-list rule: personal data may leave India freely unless the Central Government names a destination as restricted. Read on its own, Section 16 looks like liberalisation. Read against the sectoral rules that survive it and against the discretion it hands the executive to define the negative list on unspecified terms, it looks narrower: a transfer of localisation power away from Parliament and into notification- making authority that Parliament barely constrains. This article asks whether the DPDP Act has produced a coherent cross-border transfer regime or has moved localisation decisions from legislative drafting to executive discretion. It traces the regulatory history that produced Section 16, places India’s negative-list model within the comparative taxonomy of localisation instruments, and examines how the Reserve Bank of India, the Securities and Exchange Board of India, the Insurance Regulatory and Development Authority of India, and the telecommunications framework continue to impose transfer restrictions whether or not the Central Government ever exercises its Section 16 power. It also considers the Draft Digital Personal Data Protection Rules, 2025, whose Rule 12(4) reintroduces category-based localisation for Significant Data Fiduciaries that the Act’s headline architecture appeared to have retired. The article argues that legal certainty, not the choice between openness and restriction, is the DPDP Act’s principal deficit, and it proposes statutory criteria for the Section 16 power, coordination of the sectoral stack, and a more active Indian posture in multilateral data governance negotiations.
Keywords: data localisation, cross-border data transfer, digital sovereignty, DPDP Act 2023, executive discretion, data protection law, India
