Section 16
Cross-border transfers under DPDP law
The Act does not approve transfers abroad one by one. Instead, the Central Government may restrict transfers to countries it notifies.
Short answer
Section 16 of the DPDP Act lets the Central Government restrict the transfer of personal data to countries it notifies, a negative-list approach; no such list has been notified. Stricter sectoral laws on transfers continue to apply (s.16(2)). Rule 15 makes transfers subject to any requirements the government sets by order about making personal data available to a foreign State, and Rule 13 requires a Significant Data Fiduciary to keep specified personal data in India.
The negative-list approach in s.16
Section 16 lets the Central Government restrict the transfer of personal data by a Data Fiduciary to countries it notifies. This is a negative-list approach: the Act restricts transfers to listed places rather than approving transfers one by one.
As of 4 November 2026 no list has been notified. This page does not name any country, and you should be wary of any source that names one without a Gazette reference.
Because the approach is a negative list, the practical work is knowing where your personal data goes. Then you can act quickly if a notification appears.
Sectoral rules still apply (s.16(2))
Section 16 does not displace stricter rules. Where another law provides a higher degree of protection or restriction on transfers, that law continues to apply (s.16(2)).
Sector regulators such as RBI, IRDAI, SEBI and ABDM/NHA may have their own rules on where data is stored or processed. Check your regulator's directions alongside DPDP.
What the Rules add
| Provision | What it says | Who it affects |
|---|---|---|
| Rule 15 | Transfer outside India is subject to requirements the Central Government may set by general or special order about making personal data available to a foreign State or its agencies | Data Fiduciaries that transfer personal data outside India |
| Rule 13 | Personal data the Central Government specifies, on a committee's recommendation, and related traffic data are kept within India | Significant Data Fiduciaries only |
Rule 15 speaks of general or special orders about making personal data available to a foreign State or its agencies. Watch for any such order and check whether it touches your transfers. Both rules start on 13 May 2027 (Rule 1); see Rule 13 for the other SDF duties.
What to check for common set-ups
| Set-up | What to check |
|---|---|
| Hosting or backups outside India | Any s.16 notification covering the destination, a processor contract with security terms (s.8(2), Rule 6), and any sector rule (s.16(2)) |
| Overseas SaaS vendor, such as a CRM or support desk | The same checks, plus a contract term asking the vendor to report breaches to you without delay, so you can meet Rule 7 |
| Group company abroad | Whether it acts as your Data Processor or decides purposes itself as a Data Fiduciary, and the contract between you |
| Indian service provider handling a foreign client's data | Whether s.17(1)(d) applies, with counsel review |
| Designated SDF | Whether any of your data has been specified for keeping in India (Rule 13) |
Processing foreign data in India (s.17(1)(d))
Section 17(1)(d) covers personal data of Data Principals outside India, processed in India under a contract with a person outside India. For that processing, Chapter II (except s.8(1) and s.8(5)), Chapter III and s.16 do not apply.
This matters to BPOs and global capability centres. Have counsel confirm the exemption fits each contract; see DPDP for BPOs and GCCs.
A transfer checklist for fiduciaries
- Map every flow of personal data leaving India: systems, vendors, destinations and purposes.
- Put each overseas processor under a valid contract with security terms (s.8(2), Rule 6).
- Watch the Gazette for any s.16 notification and any order under Rule 15.
- Check your sector regulator's rules (s.16(2)).
- If you are designated an SDF, check which data must stay in India (Rule 13).
- Record your conclusions so you can show your reasoning later.
The cross-border checklist expands each step.
How TruePrivacy helps
Cross-border transfers in TruePrivacy let you keep a country restriction list and warn you when a vendor or transfer destination matches a restricted country. DPDP has no notified list yet, so the list is yours to keep current.
Vendors and processors hold vendor records, risk levels, assessments and contract (DPA) tracking, and records of processing keep your processing activities in one exportable register.
Does the DPDP Act allow transferring personal data outside India?
Yes, unless the Central Government restricts transfers to a country it notifies under s.16. Stricter sectoral laws still apply (s.16(2)).
Which countries are restricted under s.16?
None had been notified as of 4 November 2026. Check the Gazette rather than relying on unofficial lists.
Do RBI and other sector rules still apply to transfers?
Yes. Where another law sets stricter protection or restrictions, it continues to apply (s.16(2)). Check your regulator's directions.
Must a Significant Data Fiduciary store data in India?
Rule 13 requires an SDF to keep personal data the Central Government specifies, and related traffic data, within India.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin