Sections 16-17 of DPDP Act 2023 address cross-border transfer + breach notification. Section 16 Processing of Personal Data Outside India: Central Government may by notification restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be notified - effectively a negative list approach where transfers are permitted by default to all countries except those that the Government specifies as blacklisted/restricted. This is a SOFTER approach than GDPR Chapter V (which requires adequacy decisions or appropriate safeguards) + reflects India India-Stack-driven approach to global digital commerce. Sub-section (2): Where any other law for the time being in force in India provides for a higher degree of protection or restriction on the transfer of personal data by a Data Fiduciary outside India + the provisions of such law shall prevail (e.g. RBI Storage of Payment Systems Data 2018 which mandates onshore storage for payment data + RBI Master Direction NBFC-AA data localisation + CERT-In 180-day log retention in India + sectoral data localisation under TRAI/SEBI/IRDAI). Section 17 Exemptions: certain processing exempted from particular DPDP provisions per Section 17(1) including (a) preventing detection investigation prosecution of cognisable offences; (b) court proceedings; (c) defining or relating to merger demerger amalgamation; (d) prevention detection investigation of any other offence under law; (e) any function of State + governmental enterprises. Personal Data Breach Notification: Per Section 8(5) and DPDP Rules 2025 - within 72 hours of becoming aware of the breach (or such longer period as may be prescribed) the Data Fiduciary shall give intimation of such breach to the Data Protection Board of India (DPBI) and to each affected Data Principal in such form and manner as may be prescribed including (a) description of the breach + categories and approximate number of Data Principals affected + categories and approximate number of personal data records concerned + likely consequences + measures taken or proposed + name and contact details of DPO or other contact. Coordinates with CERT-In Directions 2022 (6-hour reporting separate from DPDP 72-hour) + RBI Cyber Framework + IT Act 43A (now repealed) + IT Rules 2011 SPDI (now repealed) + GDPR Arts 33 + 34 + 44-50 + UK GDPR + Singapore PDPA Notice of Notifiable Data Breach + APEC CBPR + India Stack DPI integration. DPDP Sec 16-17 Cross-Border + Breach applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.