# Digital Personal Data Protection Act IT-002 — Cross-Border Data Transfer Policy & Overseas Processor Contracts

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_dpdp_it002_5e8858a15a-digital-personal-data-protection-act-it-002-cross-border-data-transfer-policy-overseas-pro
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DPDP Act (India)](https://support.icompaas.com/support/solutions/c_gen_dpdpa) › [International Transfer](https://support.icompaas.com/support/solutions/folders/f_gen_cgendpdpa_internationaltransfer)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Digital Personal Data Protection Act · Control IT-002 · Priority: high · Component: International Transfer

### What this control covers

Implement a Cross-Border Data Transfer Policy governing: permissible transfer destinations, required contractual safeguards for overseas processors, transfer impact assessment procedure, and transfer register maintenance. Include DPDPA-specific data transfer clauses in all overseas processor contracts. Objective: Ensure all cross-border data transfers are governed by a documented policy and that overseas processors are contractually bound to DPDPA requirements.

### Why it matters

Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.

### How to implement

#### AWS

Default to **SSE-KMS** with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use **S3 Bucket Keys** and **S3 Block Public Access** at the account level, and turn on **S3 Object Lock** on backup buckets for ransomware resilience.

#### Azure

Store secrets in **Key Vault** (HSM-backed where required) with soft-delete + purge protection; use **customer-managed keys** for Storage, SQL, and Azure Disk Encryption. Tag PII data via **Microsoft Purview**.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.
-   `vendor_risk_management` — See the iCompaas Evidence library for the canonical source for this evidence type.

Signed policies, procedures, and registers document the safeguard. Processor due diligence, DPAs, and transfer registers evidence third-party controls. Focus: Cross-Border Data Transfer Policy & Overseas Processor Contracts.

### Quick checklist

-   Implement — Cross / Border Data Transfer Policy
-   Document — Cross / Border Data Transfer Policy
-   Ensure — Cross / Border Data Transfer Policy

### Related articles on this site

-   [GDPR Article 35: Data Protection Impact Assessment](https://support.icompaas.com/support/solutions/articles/62000236380-gdpr-article-35-data-protection-impact-assessment)
-   [3.1 Ensure that 'Secure transfer required' is set to 'Enabled'](https://support.icompaas.com/support/solutions/articles/62000219782-3-1-ensure-that-secure-transfer-required-is-set-to-enabled-)
-   [Data Privacy Regulations](https://support.icompaas.com/support/solutions/articles/62000225138-data-privacy-regulations)
-   [Vulnerability Management Procedure](https://support.icompaas.com/support/solutions/articles/62000225139-vulnerability-management-procedure)

## Related compliance guidance

- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): The DPDP Act and 2025 Rules explained as an implementation plan, including what is in force today.
- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): A GDPR programme covers most DPDP obligations; the guide shows the overlap and the India-specific gaps.