Cross-Border Transfer Rules for Model Inference

Inference feels like compute. In law it is often processing of personal data in a place you do not control. The packet does not care that you called it a prompt.

This is the single most common undeclared processing we see in otherwise careful public-sector stacks. The application is on-prem. The model is not. Nobody wrote a transfer note because nobody thought a HTTPS call was a transfer. It is.

What leaves on a single call

• The prompt, including pasted records and retrieved chunks.
• System instructions that may contain staff names or internal identifiers.
• Embeddings, if the API embeds on the vendor side.
• Logs, traces, and any content-moderation copy the vendor retains.
• Account metadata: IP, officer identity, project name, sometimes the department's legal name.
• Attachments: PDFs, images, voice, which are often the richest personal data in the case.

Any of those items can be personal data under Section 2 if an individual is identifiable by or in relation to them. A foreign model host that stores logs for abuse review is storing that personal data outside India. A content-moderation copy kept for thirty days is a thirty-day store you do not operate.

The DPDP transfer rule

Section 16, implemented by Rule 15, says personal data processed by a Data Fiduciary may be transferred outside India, subject to requirements the Central Government may specify about making that data available to a foreign State or to a person under that State's control. Until a restriction order exists for a destination, the Act does not by itself prohibit the transfer.

That is the most misunderstood sentence in current vendor decks. Allowed is not the same as free. You still need a lawful basis, purpose limitation, a processor contract, security, and any sector localisation that is stricter than DPDP. You still need to be able to tell a citizen, later, where their data went.

As of August 2026, practitioners were still reporting that no public country restriction list had been notified. That fact will change when it changes. Build a process that can absorb a notification in days, not a hope that it will never come.

When sector rules override the deck

Payment data of RBI-authorised payment system operators must be stored in India. Sending that data to a foreign model for a pretty summary is not saved by Rule 15. CERT-In log-retention in India is not saved by it either. Health, telecom and securities files may add their own overlays.

Map the class first. Then talk about the model. A transfer that is lawful under DPDP can still be a breach of a circular, a licence condition, or the department's own policy. The strictest operational rule wins for that class.

How to record a transfer decision

1. Identify the data classes on the wire, including metadata and attachments.
2. State the lawful basis for the underlying processing and for the transfer.
3. Name the destination country and the legal entity receiving the data.
4. Attach the processor terms, retention, training ban, and sub-processor list.
5. Record why a local model was rejected, if it was, with a capacity or quality reason a secretary can read.
6. Name the officer who accepted residual compulsion risk.
7. Revisit the note if the vendor changes region, subprocessors, log retention or fallback behaviour.

If you cannot write that note in one page, do not make the call. Run inference where the records already live. A missing note is not a small documentation gap. It is how a transfer becomes invisible until a journalist or an auditor makes it visible.

Engineering controls that match the note

• An egress proxy that can prove what left.
• A DLP rule that blocks known identifiers on unlisted endpoints.
• Separate projects so a public-content agent cannot see citizen case files.
• No shared vendor tenant with other customers' prompts.
• A kill switch for the endpoint that does not require the vendor's consent.

Metadata is still a transfer

Officers sometimes redact the prompt and think the problem is solved. The API still sees the account id, the IP, the project name, the department, the timestamp, and often the retrieved document ids. A determined recipient can re-identify from those alone, especially in a small district or a specialised scheme. Redaction of names is minimisation. It is not a finding that no personal data left.

If you redact, record what you redacted and what still travels. Then run the transfer note on what still travels. If the note is still uncomfortable, do not make the call.

Streaming and retries multiply copies

A single logical answer can be many HTTP requests: embed, retrieve, rerank, generate, moderate, log. Each is a transfer if it leaves India. Retries on timeout multiply the copies. Streaming tokens may be logged on the vendor side even if you do not store them. Count the hops, not the user-visible turn.

When a restriction order arrives

Rule 15 allows the Central Government to specify requirements or restrict destinations. Build so you can cut a destination in days. That means no hard-coded keys in application servers, a central egress proxy, and a model layer you can point at a local alternative. A stack that needs a six-month rewrite to stop calling a newly restricted country is not a stack. It is a hostage.

Assign an owner today for the watch on Gazette notifications. Watching is a job. Jobs need names.

Draw every hop before the next go-live

This week, sit with the orchestrator config and draw every outbound hop for one user-visible answer. Embed, retrieve, rerank, generate, moderate, log, licence. Mark each hop local or foreign. Count retries as extra hops. File the drawing.

Next week, write a transfer note for every foreign hop or kill the hop. Notes without an officer's name are drafts. Drafts are not decisions. If you cannot find an officer who will sign, the hop dies. That is a product constraint, not a legal nicety.

This month, put the hops behind a proxy you control and assign a Gazette watcher for Section 16 notifications. A restriction order should be a configuration change, not a rewrite. If it would be a rewrite, you are not ready for a notification, and notifications do not wait for readiness.

Objections you will hear — and what to do with them

Engineers will say the prompt is not stored, only streamed. Streaming is still making data available outside India. Storage on their side is a second question. Do not let the first question be skipped because the second is denied.

Vendors will say DPDP allows transfers, so a note is bureaucracy. Allowed is not the same as decided. The note is how you prove a human chose the hop. Without it, the hop is an accident that happens to be lawful until a circular or a restriction order arrives.

A consultant will offer anonymisation as a blanket fix. Anonymisation that leaves rare facts, join keys or embeddings next to ids is not anonymisation. Ask them to write the re-identification test they are willing to sign. Most will retreat to minimisation, which is the honest word.

Operations will say killing a hop will drop quality. Fund the local replacement or accept the drop in writing. Quality that depends on an unsigned hop is quality you do not own.

Someone will ask whether encryption in transit makes it not a transfer. Encryption protects the path. It does not change the destination. A well-encrypted transfer is still a transfer.

• Streamed, not stored — still a transfer.
• DPDP allows it — still write the note.
• Anonymised — demand a signed re-identification test.
• Quality — fund local or accept the drop.
• Encrypted — destination still counts.

How this shows up in the file

Draw the hops for one user-visible answer before the next go-live. Count retries. File the drawing. A hop without a named officer on a transfer note dies. That is a product constraint, not a legal nicety.

Encryption in transit does not change the destination. Streaming does not change the destination. Redacting names does not finish the analysis if metadata and rare facts still travel.

Assign a Gazette watcher for Section 16 notifications. A restriction order should be a configuration change. If it would be a six-month rewrite, you are not ready, and notifications do not wait.

What the next noting must contain

“Cross-Border Transfer Rules for Model Inference” belongs in a file, not only in a search result. A P6 Compliance/DPO should be able to point at one artefact that proves “cross border data transfer AI India”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

If a token representing a citizen leaves India so a model can answer, you have transferred personal data. Most stacks do this on every call and never write it down. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C1 Sovereignty & Data Residency: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “cross border data transfer AI India”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.