Section 16 · Rule 15
Cross-border personal data transfers (DPDP)
DPDP lets personal data leave India unless the Central Government restricts a destination. TruePrivacy checks your vendors and transfers against a list you keep.
Sample workspace
Transfer check
- Example Analytics · Country XOn your list
- Example Mailer · Country YNo match
- Example Cloud Hosting · Country ZNo match
- Restriction lists.16
Restriction list
- List updated by legal team
- Vendor destinations checked
- Review Example Analytics with counsel
Short answer
Under s.16 of the DPDP Act, the Central Government may restrict transfers of personal data to countries it notifies, and stricter sectoral laws still apply (s.16(2)). Rule 15 makes transfers subject to any requirements the Central Government sets by order about making personal data available to a foreign State or its agencies. No list of restricted countries has been notified, so TruePrivacy lets you keep your own restriction list and warns you when a vendor or transfer destination matches it.
What transfer checks do
DPDP takes a negative-list approach: transfers are allowed unless the Central Government restricts a country by notification (s.16(1)). Until a list is notified, the practical work is knowing where your personal data goes and who holds it.
Keep a list of countries you treat as restricted, and update it as orders are notified.
When a vendor's country matches the list, TruePrivacy warns you.
The same warning applies when a transfer destination matches the list.
The warning sits with the vendor's risk level, assessments and contract in vendors and processors.
How to check a transfer
- 01List where data goes
Record your vendors and transfer destinations, including where your processors host data. Use vendor assessments to ask processors where they store and access it.
- 02Keep the restriction list current
Add a country when the Central Government notifies a restriction, and add any country your sector rules restrict.
- 03Review warnings
When a vendor or destination matches, review the transfer with counsel before it goes ahead.
- 04Check special cases
For an SDF, Rule 13 lets the Central Government specify personal data and traffic data to keep in India. For processing of data of people outside India under a foreign contract, s.17(1)(d) may apply; see BPO and GCC.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Do not transfer to a country the Central Government restricts | s.16(1) | Your restriction list, with warnings on vendor and destination matches |
| Be responsible for processing by your Data Processors, wherever they are | s.8(1) | Vendor records with risk levels, assessments and contract (DPA) tracking |
| Follow stricter sectoral laws on transfers | s.16(2) | Add countries your sector rules restrict to the same list |
| Meet requirements on foreign State access set by order | Rule 15 | Vendor assessments to ask where data is held |
| Keep specified personal data in India (SDFs) | Rule 13 | Record the designation in the SDF workspace; the data to keep in India is specified by the government |
The list is yours to keep
DPDP has no notified list of restricted countries yet. The restriction list in TruePrivacy is yours to maintain and keep current, and a warning means only that a vendor or destination matched your entry. Check transfers with counsel and against your regulator's directions.
Do not rely on unofficial lists that name restricted countries; under s.16 a restriction comes by government notification. The cross-border checklist walks through the questions to ask before data leaves India.
Works with
Vendor records, assessments and contract (DPA) tracking.
Records of processingProcessing activities that show where data flows.
SDF: DPIA, DPO and data auditYearly clocks and records for Significant Data Fiduciary duties.
Data discoveryFind which systems hold the personal data that may leave India.
Does DPDP have a whitelist of countries?
No. Section 16 works the other way: the Central Government may restrict transfers to countries it notifies. No such list has been notified yet.
Do sector rules still apply to transfers?
Yes. Section 16(2) keeps stricter sectoral laws in force. Check your regulator's directions alongside DPDP.
What does TruePrivacy do when a vendor matches my list?
It warns you when a vendor or transfer destination matches a country on your list. The decision to proceed stays with your team and counsel.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin