Cross-Border Data Transfers: India DPDP, UAE, DIFC, ADGM and Saudi Rules

India: open by default, with a restriction list

The DPDP Act takes a relatively open approach to transfers. Section 16 lets the Central Government restrict transfers of personal data to countries it notifies, and Rule 15 of the DPDP Rules supports this. Unless a destination is restricted, transfers are generally possible. Rule 13 may, however, require Significant Data Fiduciaries to keep specified data within India. Reports in early 2026 also described MeitY plans to notify cross-border restrictions for Significant Data Fiduciaries, so watch for further notifications.

Hosting choices are also shaped by CERT-In, which already requires ICT system logs to be kept for a rolling 180 days within India. A team running its main database in Singapore can still meet this, but it must make sure the relevant logs are stored on infrastructure in India. Your privacy notice should disclose whether data goes outside India and commit to stopping transfers to any country the Government restricts. Write down the region of every database, backup and log store, because enterprise buyers and auditors will ask for it, and the answer must match what your notice says. A mismatch between the notice and the real hosting map is one of the easiest problems for a reviewer to spot.

UAE onshore, DIFC and ADGM

The three UAE regimes treat transfers differently, which surprises many teams. Under the onshore UAE PDPL, Articles 22 and 23 allow transfers to approved adequate countries or under listed exceptions such as explicit consent or contract necessity. The law has no route based on contractual safeguards alone, so standard contractual clauses by themselves are not enough for onshore UAE data.

The DIFC and ADGM regimes follow a GDPR-style model. Under DIFC Law Articles 26 and 27, a transfer can rely on an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a specific derogation. ADGM works in a similar way, but it does not treat onshore UAE as an adequate destination. That means a company in ADGM sending data to a sister company in mainland Dubai still needs safeguards for that transfer.

Saudi Arabia, Bahrain and Oman

Saudi PDPL Article 29 and the Regulations on Personal Data Transfers outside the Kingdom allow transfers based on adequacy or appropriate safeguards. A transfer risk assessment is needed for safeguard-based transfers and for large-scale sensitive data transfers. Only the minimum data needed may be transferred, and the transfer must not harm national security. Disclose each destination, its purpose and the mechanism in your policy.

Bahrain's Resolution No. 42 of 2022 sets a whitelist of 83 countries. Transfers elsewhere, including transfers within a corporate group, need a permit from the Personal Data Protection Authority, and breaching transfer rules is a criminal offence. Oman allows transfers only with explicit consent, unless an international agreement applies or the data is anonymised, and only to recipients giving protection no lower than its law. Oman's cross-border violations carry fines of up to OMR 500,000.

Building a transfer map

Start with your vendor list. For every cloud region, analytics tool, support desk, email service and AI model provider, record which personal data it receives, where it is stored and where it can be accessed from, including support staff locations. Then add a column for each market you serve and write the mechanism you rely on, such as adequacy, safeguards, explicit consent, whitelist or permit. Gaps in that table are your work list, and the table itself becomes the transfers section of your privacy notice. General information, not legal advice.

• India: check the Government's restricted country list and any Significant Data Fiduciary localisation duty.
• Onshore UAE: adequacy or listed exception; contracts alone are not enough.
• ADGM: safeguards are needed even for transfers to onshore UAE.
• Saudi Arabia: risk assessment where required and minimum data only.
• Bahrain: whitelist or PDPA permit, with the permit reference recorded.

Check your understanding

Turn what you learn into monthly income

Resell AI agents and apps under your own brand. Up to 30% off credits, up to 30% recurring share, and apps built by XDQ Labs for your clients. Free to join.