A modern Indian SaaS product can store its primary database in Mumbai and still send personal data to an overseas analytics platform, email provider, support tool, cloud service or AI API.
Section 16 of the DPDP Act gives the Central Government power to restrict transfers outside India to specified countries or territories. For certain Significant Data Fiduciaries, the Rules add further controls around specified personal data and related traffic data.
The practical requirement is simple: map the actual data flow.
Residency is not the same as transfer
“Hosted in India” tells you where one system stores data. It does not necessarily tell you where data is processed, accessed, supported, replicated or sent downstream.
For each vendor, record:
- Data categories
- Purpose
- Role
- Storage location
- Processing/access location
- Sub-processors
- Contractual controls
- Deletion path
AI makes this harder
A developer can add:
Support ticket
↓
AI API
↓
Model provider
in an afternoon. The privacy inventory may not change for months. AI procurement therefore needs the same transfer questions as every other vendor.
Ask where prompts are processed, how long they are retained, whether they are used for training, which sub-processors are involved, and how deletion works.
Do GDPR SCCs automatically solve DPDP?
No. SCCs can be useful contractual infrastructure for GDPR-covered transfers, but DPDP has its own statutory framework. Map the Indian requirements separately and identify the controls that can genuinely be shared.
Build one transfer map
User
↓
Application
↓
Data store
↓
Processor
↓
Sub-processor
↓
Region
Attach purpose, data categories and legal/contractual constraints to every material edge.
The self-test
Take five major vendors. Can you answer where personal data is stored, where it is processed, who can access it, which sub-processors receive it, and what happens after deletion? If not, your cross-border analysis is probably based on contracts rather than production reality.
Where Privra fits
Privra maps the technical flow first, then connects vendors, purposes, locations, retention and actions.