Skip to content
Spectra Forensics, Investigation Specialist

Regulatory framework · Investigations, data and evidence

Cross-border investigations

The matter spans India and other countries: whose rules govern the investigation, the data and the disclosures?

Spectra Forensics7 laws and regulators

Short answer

Several at once. Indian law governs conduct, data and evidence in India; foreign law follows the group’s listings, subsidiaries, staff and data abroad. The practical answer is to map every jurisdiction at the start, agree who leads, run collection to the strictest data and evidence standard that applies, and decide the order of any disclosures before talking to any authority. The commonest failures are moving data out of a country without a basis, losing privilege, and telling one regulator something another hears first.

The landscape

Laws and regulators in play

Digital Personal Data Protection Act 2023 (s.16)
Allows personal data to be transferred out of India unless the government restricts a destination by notification, while preserving stricter sector-specific rules. The section commences with the Act’s main provisions, around May 2027.
EU GDPR (Arts 44–49)
Restricts transfers of personal data out of the EU to adequate countries or under safeguards such as standard contractual clauses, with narrow derogations.
Bharatiya Sakshya Adhiniyam 2023 (ss.132–134)
Protect confidential communications with advocates and legal advisers. Privilege rules differ abroad, especially for in-house counsel.
Bharatiya Nagarik Suraksha Sanhita 2023 (s.112)
Lets an Indian court issue a letter of request to a foreign authority for evidence abroad in a criminal investigation (the former letters rogatory under CrPC s.166A).
US FCPA and UK Bribery Act 2010
Reach Indian companies with US-listed securities or UK business, for conduct anywhere, including books-and-records duties for US issuers and the UK offence of failing to prevent bribery.
UK Economic Crime and Corporate Transparency Act 2023 (s.199)
Since 1 September 2025, large organisations with a UK nexus can be liable for failing to prevent fraud by associated persons.
Prevention of Money Laundering Act 2002 (s.50)
Gives the Enforcement Directorate power to summon people, compel documents and record statements, which the Supreme Court upheld in Vijay Madanlal Choudhary (27 July 2022).

Step by step

Decision framework

  1. 01

    Map the jurisdictions

    Where the conduct happened, where the people and data are, where the group is listed or regulated, where the money moved, and where any authority may already be looking.

  2. 02

    Decide who leads and under what privilege

    Appoint lead counsel and decide whether the investigation runs under legal privilege. Privilege that holds in India may not hold in another country, particularly for in-house lawyers, so structure instructions accordingly.

  3. 03

    Collect locally, transfer deliberately

    Image and process data in the country where it sits where possible. Move personal data across borders only with a legal basis in the sending country, and record it.

  4. 04

    Apply the strictest standard to evidence

    Hashing, chain of custody and documentation good enough for an Indian court under s.63 of the BSA and for the most demanding foreign forum likely to see it.

  5. 05

    Sequence any disclosure

    Decide, with advice in each country, whether and when to approach each authority. A disclosure in one place can be shared with or requested by another.

  6. 06

    Coordinate remediation and messaging

    Discipline, control changes and public statements should be consistent across the group; a statement made for one market will be read in every other.

Duties and deadlines

Who must do what, and by when

  • Data Fiduciary in India

    Transfer personal data abroad only to destinations not restricted by notification, and comply with any stricter sectoral rule.

    By whenFrom commencement of s.16, around May 2027

    DPDP Act s.16

  • Controller in the EU

    Transfer personal data out of the EU only under an adequacy decision, appropriate safeguards or a listed derogation.

    By whenBefore any transfer

    GDPR Arts 44–49

  • US issuer (including Indian companies with listed ADRs)

    Keep accurate books and records and adequate internal accounting controls across the group.

    By whenContinuously

    15 U.S.C. 78m(b)(2)

  • Persons summoned by the Enforcement Directorate

    Attend, give statements and produce documents as required.

    By whenAs specified in the summons

    PMLA s.50

  • Investigating agency or court in India

    Seek evidence abroad through a letter of request to the foreign authority.

    By whenDuring a criminal investigation or inquiry

    BNSS s.112

Analysis

How the regimes interact

Why this question matters

Indian companies increasingly have foreign subsidiaries, foreign investors, foreign listings or foreign customers, and frauds follow the money across borders. An investigation that is well run under Indian law can still fail abroad: data moved without a basis, privilege lost, or a disclosure made in one country that triggers questions in another. The work is less about any single law than about sequencing several.

How the regimes interact

Data rules apply at both ends. A transfer needs a basis in the country the data leaves and must be handled lawfully where it arrives. The EU is strict about exports. India's DPDP Act takes a negative-list approach once section 16 commences, but sector-specific rules can be stricter. Reviewing data in the country where it sits avoids many of these questions.

Privilege is local. The BSA protects communications with advocates and legal advisers. Other systems draw the line differently, notably for in-house counsel and for factual investigation reports. A document privileged in India may be producible elsewhere, so decide early who instructs the investigators and how reports are structured.

Enforcement is parallel, not sequential. Indian agencies such as the Enforcement Directorate have strong powers to compel statements and documents; the Supreme Court upheld them in 2022, although review proceedings were admitted later that year. Foreign authorities can act on the same facts at the same time, and many cooperate. The company's account of events must be the same for all of them.

Foreign regimes change the risk calculus. The FCPA's accounting provisions, the UK's failure-to-prevent offences and the EU's whistleblowing rules can impose duties an Indian-only analysis would miss. See our guides on corporate liability for bribery and whistleblower protection.

How Spectra Forensics can help

We have run investigations in more than 11 countries, combining anti-bribery investigations, digital forensics and eDiscovery and cross-border asset tracing. Speak to us in confidence.

Warning signs

Red flags

  • Data copied to a head-office server abroad before anyone checked the transfer rules.
  • In-house counsel running interviews abroad on the assumption that Indian privilege rules apply.
  • Different stories told to auditors, lenders and regulators in different countries.
  • A foreign regulator’s request arriving before the Indian board has been briefed.
  • Payments routed through third countries with no commercial link to the work.
  • Local management in a subsidiary controlling the collection of their own data.

Checklist

What good looks like

  • A jurisdiction map on day one, updated as facts emerge.
  • A written protocol on privilege, with outside counsel instructed where in-house privilege is doubtful.
  • A data-transfer log recording the legal basis for each cross-border movement.
  • Collection and processing in-country where possible, with hash values and custody records.
  • A single fact base used for every audience: board, auditors, lenders and authorities.
  • A disclosure plan agreed across jurisdictions before any authority is approached.

Myths and corrections

Common misreadings

Misreading

Group data can move freely within the group.

Better reading

Data protection laws regulate transfers between companies in the same group. The EU requires a transfer mechanism; India’s s.16 regime applies once in force, alongside sectoral rules.

Misreading

Privilege works the same way everywhere.

Better reading

Indian privilege under the BSA protects communications with advocates and legal advisers; other countries treat in-house lawyers and investigation reports differently. Plan for the narrowest rule that may apply.

Misreading

An Indian company is outside the FCPA and UK Bribery Act.

Better reading

Listed ADRs, a UK business or US-territory acts are enough to bring an Indian company within reach.

Misreading

A foreign authority will get Indian evidence only through formal channels.

Better reading

Formal requests exist, but companies often produce documents voluntarily or under foreign compulsion. Decide deliberately what is produced, from where, and under which law.

For the board pack

Takeaways

  • 01Map every jurisdiction at the start; the map decides the rules for data, privilege and disclosure.
  • 02Collect locally, transfer only with a basis, and record each transfer.
  • 03Build the evidence to the strictest standard any forum may apply.
  • 04Sequence disclosures across countries; never let one regulator hear first by accident.

Questions we are asked

Can we send Indian employee data to our overseas parent for review?

Today the IT Act’s rules on sensitive personal data apply. When the DPDP Act’s s.16 commences, around May 2027, transfers are allowed unless the destination is restricted by notification, subject to stricter sectoral rules. Purpose limitation and security duties still apply, so send only what the review needs.

How do Indian investigators obtain evidence from abroad?

In criminal matters, an Indian court can issue a letter of request to a competent authority abroad under s.112 of the BNSS, usually through treaty or reciprocal arrangements. In civil and internal matters, evidence is usually gathered voluntarily or through the courts of the country where it sits.

Has the US paused FCPA enforcement?

A February 2025 executive order paused new FCPA enforcement pending new guidelines, which the Department of Justice issued in June 2025, prioritising serious misconduct. The law itself remains in force, and enforcement continues under the new priorities.

Sources

  1. Digital Personal Data Protection Act 2023, s.16 link
  2. Regulation (EU) 2016/679 (GDPR), Chapter V link
  3. Bharatiya Sakshya Adhiniyam 2023 link
  4. Bharatiya Nagarik Suraksha Sanhita 2023 link
  5. UK Bribery Act 2010 and Economic Crime and Corporate Transparency Act 2023 link
  6. Supreme Court of India, Vijay Madanlal Choudhary v Union of India, 27 July 2022 link

This guide is general information on the law as stated above, not legal advice. Facts change outcomes; take advice on your own matter.

Go deeper

Further reading

Anti-bribery & corruption5 Oct 2026

FCPA and UK Bribery Act: When Foreign Anti-Bribery Laws Reach Indian Companies

When can the US FCPA or UK Bribery Act apply to an Indian company? The jurisdictional hooks, 2025 FCPA enforcement changes and the UK fraud offence.

Litigation support17 Sept 2026

eDiscovery for Indian Litigation and Arbitration: A Practical Guide for Law Firms

How eDiscovery works in Indian commercial suits and arbitration: Order XI disclosure duties, electronic-record declarations, legal holds and the EDRM stages.

Asset tracing27 Aug 2026

How Asset Tracing Works in India: Sources, Techniques and Legal Routes to Recovery

How investigators find assets in India through MCA, land, CERSAI and court records, and the legal routes from attachment before judgment to PMLA.

Confidential consultation

Facing this question on a live matter? Talk to us.

Tell us what has happened. A senior member of our team will help you work out who must do what, and in what order, in strict confidence.

Speak to an expertAll regulatory frameworks
Confidential enquiry