The Premature Shift in Contract Drafting: A Closer Look at DPDP
Since the introduction of the Digital Personal Data Protection (DPDP) Rules, 2025 in November, there has been a noticeable trend among legal professionals and companies to prematurely adapt their contracts, treating Rule 15 as if it is already in effect. This rule, which pertains to the cross-border transfer of personal data, has sparked a wave of activity, including redrafting contract templates and adjusting data processing agreements, all under the guise of compliance with the yet-to-be-enforced regulation.
The Staggered Implementation of the DPDP Act
It’s crucial to recognize that Section 16 of the DPDP Act, which Rule 15 operationalizes, is not yet in force. The implementation of the Act is phased across three stages. The first stage, initiated in November 2025, established the Data Protection Board and enacted a few procedural provisions. The substantive obligations, including consent architecture, breach notification, protections for children’s data, and notably, cross-border transfer conditions, are slated for the third stage, anticipated around May 2027.
Understanding Rule 15
Once enforced, Rule 15 will employ a “negative list” model, permitting data transfers to any jurisdiction unless explicitly restricted by the Central government. This model contrasts with the GDPR’s approach, which involves mandatory standard contractual clauses (SCCs) and transfer impact assessments. Notably, no list of restricted countries has been published, and without the commencement of Stage 3, Rule 15’s cross-border obligations are not yet applicable.
The Misguided Adoption of GDPR Mechanisms
Despite the absence of a current requirement, many internal legal teams and external counsel are over-engineering by incorporating GDPR-style mechanisms into Indian commercial contracts. This approach not only adds unnecessary complexity but is also counterproductive, given the DPDP’s distinct framework. The GDPR’s model is transfer-specific, while DPDP’s negative list model asks only if a country is on a restricted list.
Practical Steps for Commercial Lawyers
For legal professionals, the focus should be on adaptability rather than prematurely locking in compliance mechanisms. Here are three actionable steps:
- Avoid importing GDPR frameworks: Instead of integrating Schrems-style assessments into contracts, draft cross-border clauses that are adaptable to future government restrictions.
- Utilize the preparation period effectively: The interim period allows organizations to map data flows and vendor arrangements before obligations are enforced.
- Monitor Stage 2 notifications: With Stage 2 set for November 2026, it will activate consent manager registration and enforcement mechanisms, offering insights into future regulatory actions.
Billing Transparency and Client Communication
There is also an ethical dimension to consider. Firms currently billing clients for “DPDP cross-border compliance” are charging for adherence to a regulation that isn’t yet binding. It’s essential to clarify that this work is preparatory rather than a current legal requirement, ensuring clients understand the difference between present obligations and future readiness.
Conclusion
India’s forthcoming cross-border data transfer regime is notably liberal, offering a positive outlook for businesses. However, the rush to comply prematurely is leading to unnecessary complexity and potential overcommitment. Legal professionals should use this period to focus on structural readiness rather than enforcing compliance with rules that have yet to take effect.
Pooja Dhumal is a corporate and commercial law expert specializing in technology and data transactions.
