Template library

Cross-border data transfer agreement

Binds an overseas recipient of Indian personal data to India-law continuity, foreign-State access controls and a change-of-law fallback with repatriation machinery. Use it before personal data leaves India for a group company, vendor or cloud region abroad.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Agreement Date][Data Exporter Name][Exporter Registered Office][Data Importer Name][Importer Country of Incorporation][Importer Registered Office][Transfer Purpose][Government Demand Notice Hours][Repatriation Period Days][Breach Notice Hours][Erasure Execution Days][Rights Assistance Days][Termination Notice Period][Liability Cap Amount][Arbitration Seat City][Exporter Signatory Name][Exporter Signatory Title][Importer Signatory Name][Importer Signatory Title][Signature Date]

The document

The opening clauses — open to everyone

This cross-border data transfer agreement is made on [Agreement Date] between [Data Exporter Name], incorporated in India with its registered office at [Exporter Registered Office] (the Exporter), and [Data Importer Name], incorporated in [Importer Country of Incorporation] with its registered office at [Importer Registered Office] (the Importer).

1. The transfer this agreement governs

1.1 The Exporter will make available to the Importer the personal data described in Annex 1 — the data items, the Data Principals concerned and the purposes — for [Transfer Purpose].

1.2 For each purpose, Annex 1 records whether the Importer acts as the Exporter's Data Processor or as a Data Fiduciary in its own right; the clauses of this agreement apply according to that role.

1.3 Annex 2 lists every country where the data will be stored or accessed, including onward destinations. The Importer keeps Annex 2 accurate and obtains the Exporter's written approval before adding any destination.

2. Indian law follows the data

2.1 The DPDP Act, 2023 and the DPDP Rules, 2025 continue to bind the Exporter in respect of the transferred data wherever it sits. The Importer must therefore process the data in a way that lets the Exporter meet those duties in full — safeguards, erasure, breach response, retention and Data Principal rights included.

2.2 Section 16 (1) of the…