Cross-border transfer rules vary more than any other privacy rule across India and the Gulf. India allows transfers unless the government restricts a country, Bahrain whitelists 83 countries, Oman needs explicit consent and fines violations up to OMR 500,000, and onshore UAE has no contractual route for unapproved countries. This table-led guide compares the models so you can plan hosting and vendors.
Four transfer models
The regimes in this guide use four broad models. India uses a restriction model, where transfers are allowed unless the government blocks a destination. Bahrain uses a whitelist. The DIFC, ADGM and Saudi Arabia use adequacy plus safeguards. Onshore UAE and Oman lean on adequacy or consent with fewer contractual options. The model decides whether a standard cloud contract is enough or whether you need consent, a permit or a risk assessment.
Comparison table
Use this table to check each destination before you sign a hosting or vendor contract. Read across the row for the country where the data is collected, not where your company is headquartered, since the source country's law decides which routes are open. Where a cell names a permit or consent, plan the time to obtain it.
| Jurisdiction | Model | Main routes | Key point |
|---|---|---|---|
| India (DPDP) | Restriction list | Allowed unless the Government restricts the country (Section 16, Rule 15) | SDFs may have to keep specified data in India (Rule 13) |
| UAE onshore | Adequacy or exception | Approved adequate country, explicit consent, contract necessity (Articles 22, 23) | No contractual safeguard route for unapproved countries |
| DIFC | Adequacy plus safeguards | Adequacy, safeguards such as SCCs, derogations (Articles 26, 27) | GDPR-style toolkit |
| ADGM | Adequacy plus safeguards | Adequacy, safeguards such as SCCs, derogations | Onshore UAE is not adequate |
| Saudi Arabia | Adequacy plus safeguards | Adequacy or appropriate safeguards (Article 29, Transfer Regulations) | Risk assessment for safeguard-based or large sensitive transfers |
| Bahrain | Whitelist | 83 listed countries or a PDPA permit (Resolution No. 42 of 2022) | Permit needed even for intra-group transfers |
| Oman | Consent led | Explicit consent unless an international agreement applies or data is anonymised | Recipient protection no lower than the PDPL |
India: open by default, with limits
Section 16 of the DPDP Act lets the Central Government restrict transfers to notified countries, and Rule 15 of the DPDP Rules 2025 deals with transfers. Your policy should disclose whether data goes outside India and confirm it will not go to any restricted country. These duties apply from 13 May 2027. Rule 13 may require Significant Data Fiduciaries to keep specified data in India. In January 2026, MeitY also consulted on notifying cross-border restrictions for SDFs, so large platforms should watch for further notifications.
UAE onshore, DIFC and ADGM
Onshore, Articles 22 and 23 of the PDPL permit transfers to approved adequate countries or under exceptions such as explicit consent or contract necessity. With no contractual safeguard route, standard clauses alone do not cover an unapproved destination. The DIFC (Articles 26 and 27) and ADGM allow adequacy, safeguards such as standard contractual clauses, or derogations. ADGM does not treat onshore UAE as adequate, so an ADGM entity sending data to a Dubai mainland affiliate needs a mechanism.
Saudi Arabia
Article 29 of the PDPL and the Regulations on Personal Data Transfers outside the Kingdom allow transfers based on adequacy or appropriate safeguards. A risk assessment is needed for safeguard-based transfers and for large-scale transfers of sensitive data. Only the minimum data needed may leave the Kingdom, and transfers must not harm national security. The privacy policy must disclose the transfer, its purpose and the mechanism relied on.
Bahrain and Oman
Bahrain's PDPL Articles 12 and 13 restrict transfers, and breaching them is a criminal offence. Resolution No. 42 of 2022 whitelists 83 countries and requires a PDPA permit for others, including transfers within a group of companies. Oman requires explicit consent for transfers unless an international agreement applies or the data is anonymised, and the recipient must offer protection no lower than the PDPL. Violations carry fines of up to OMR 500,000. The research behind this guide did not cover Qatar's transfer rules, so check them separately.
Practical steps
List every system that stores or accesses personal data, including backups, support tools and analytics, and record the country where each runs. Then match each flow to the route its source country allows. Disclose transfers in your privacy policy for each country you serve. XDQ xAgents (https://xagents.xdqlabs.com) checks whether a policy states the transfer basis each regime requires. This guide is general information, not legal advice. Confirm with a qualified lawyer.
- Map hosting, backup and support locations
- Check Bahrain destinations against the whitelist
- Collect explicit consent for Oman transfers
- Run Saudi risk assessments where required
- Add a transfer mechanism for ADGM to onshore UAE flows
Frequently asked questions
Can Indian companies transfer personal data abroad under DPDP?
Yes, in general. Section 16 lets the Central Government restrict transfers to notified countries, and transfers to those countries are not allowed. Significant Data Fiduciaries may also have to keep specified data in India under Rule 13.
Do standard contractual clauses work in the UAE?
In the DIFC and ADGM, yes, as an appropriate safeguard. Onshore UAE PDPL has no contractual safeguard route for unapproved countries, so transfers rely on adequacy or exceptions such as explicit consent or contract necessity.
Which countries can receive data from Bahrain?
The 83 countries on the whitelist in Resolution No. 42 of 2022. Transfers to any other country, including within the same group of companies, need a permit from the Personal Data Protection Authority.
Does Oman require consent for data transfers?
Yes. Transfers outside Oman need explicit consent unless an international agreement applies or the data is anonymised, and fines reach OMR 500,000. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Digital Personal Data Protection Act, 2023 (India Code), India Code, Legislative Department, 2023
- Mondaq: MeitY plans to cut short DPDP compliance timeline (proposal), Mondaq, 2026
- Bird & Bird: UAE Federal Decree-Law on Personal Data Protection compared with GDPR, Bird & Bird, 2021
- DIFC Data Protection Law No. 5 of 2020 (official text, government.ae), UAE Government Portal (government.ae), 2020
- CMS: ADGM Data Protection Regulations, what businesses need to know, CMS
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- Secure Controls Framework: Saudi PDPL article mapping, Secure Controls Framework, 2023
- Trowers & Hamlins: Bahrain enhances its data protection regime (2022 resolutions), Trowers & Hamlins, 2022
- Clyde & Co: Oman issues Executive Regulations to the PDPL, Clyde & Co, 2024
- Al Tamimi: New Omani Personal Data Protection Law comes into force, Al Tamimi & Company, 2023
