DPDPA Compliance in Kochi

Yes, by default. Section 16 works on a negative list — transfers are permitted unless the Central Government restricts a specific country, and no such list has been notified yet. But sectoral rules (RBI's payment data localisation, for instance) may still bind you, and a foreign client's own law, such as the GDPR, can apply to you through contract. Map where your data actually sits before assuming you are clear.

The DPDPA has no separate sensitive personal data tier — health records carry the same obligations as any other personal data. What changes is the practical risk: a breach of patient histories invites the higher end of penalties, up to ₹250 crore under Section 8(5) for failing reasonable security safeguards. Keep clinical records under retention rules tied to medical law, and hold consent evidence for anything used beyond treatment, such as marketing or research.

When the incident is noticed, not when your office reopens. CERT-In requires reporting covered cyber incidents within 6 hours of noticing them. Under the DPDPA, you must inform affected Data Principals without delay, intimate the Data Protection Board without delay, and file a detailed report with the Board within 72 hours. Build an out-of-hours escalation path with your processor — the contract should oblige them to alert you immediately.