Cross-border data transfer When personal data leaves India, including inside a prompt to a cloud AI.
Short answer. A cross-border data transfer is any movement of personal data to a server, company or person outside India, including when staff send it to an AI service hosted abroad. India’s Digital Personal Data Protection Act, 2023 takes a negative-list approach: section 16(1) lets the Central Government restrict transfers to countries or territories it notifies, so the Act itself does not bar transfers elsewhere. Section 16(2) keeps any other Indian law with stricter limits in force, and rule 15 of the DPDP Rules, 2025 adds requirements the Government may set on making data available to foreign States. Significant data fiduciaries may have to keep specified data in India under rule 13(4). The EU GDPR works the other way: transfers out of the EU need an adequacy decision or other safeguards, and India has no adequacy decision. This is general information, not legal advice.
01
What Indian law says
Provision
Effect
Section 16(1)
The Central Government may, by notification, restrict transfer of personal data to any country or territory outside India that it notifies.
Section 16(2)
Any other law providing a higher degree of protection, or a restriction on transfers, continues to apply.
Rule 15
Transfers are subject to requirements the Government may specify, by general or special order, on making data available to a foreign State or entities under its control.
Rule 13(4)
A significant data fiduciary must keep personal data specified by the Government, and its traffic data, inside India.
Section 17(1)(d)
Section 16 and most fiduciary duties do not apply when a person in India processes non-residents’ data under a contract with a person outside India.
02
Where AI tools send data
Cloud AI assistants process prompts and files in data centres the vendor chooses, under terms that differ by plan. Before staff paste client data into one, check where it is processed and stored, whether a sector regulator or a client contract limits transfers for that data, and whether the vendor uses sub-processors in other countries.
A model that runs on hardware in your office involves no transfer for that processing step, which is one reason regulated offices look at local AI. ANVE runs models on a device in the office; cloud models are optional, added by an administrator, and their answers are labelled.
03
How the GDPR differs
Article 44 of the GDPR allows transfers out of the EU only if the conditions in its Chapter V are met. Article 45 lets the European Commission decide that a country ensures an adequate level of protection. The Commission’s list, checked in October 2026, includes Japan, the Republic of Korea, the United Kingdom, Brazil and the United States for organisations in the Data Privacy Framework, among others, but not India. Transfers from the EU to India therefore need one of the other routes in Chapter V.
04
Questions before using a foreign-hosted AI tool
In which country are prompts, files and chat history processed and stored?
Is the data covered by a sector rule or a client contract that requires it to stay in India?
Has the Government notified a restriction under section 16 for that country?
Can the vendor’s staff or sub-processors in other countries access the data?
How long are prompts and outputs kept, and can you delete them?
05
Questions people ask
Does the DPDP Act require data to stay in India?
Not in general. Section 16 lets the Government restrict transfers to notified countries; beyond that, sector laws and rule 13(4) for significant data fiduciaries can require local storage.
Is using a cloud chatbot a cross-border transfer?
If the service processes your prompt outside India, sending personal data in that prompt moves it abroad. Check the vendor’s data residency terms for your plan.
Is India on the EU’s adequacy list?
No. The European Commission’s list of adequacy decisions, checked in October 2026, does not include India.
Does local AI remove transfer questions?
For processing that stays on hardware in India, yes. Updates, optional cloud models and remote support can still move data abroad, so check each one.
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
