The default: allowed unless restricted
Section 16(1) lets the Central Government, by notification, restrict transfers of personal data for processing to countries or territories it notifies. Section 16 does not itself bar transfers to places that are not notified, and the Act names no restricted country.
Sources: Act s.16(1)
Stricter sector laws still apply
Section 16 does not weaken any other Indian law that gives higher protection, or restricts transfers more tightly, for any data, Fiduciary or class. So a sector rule that requires some data to stay in India continues to apply alongside DPDP.
Sources: Act s.16(2)
Rule 15: foreign State access
Rule 15 allows transfers subject to requirements the Central Government may set by general or special order. Those requirements concern making personal data available to a foreign State, or to any person, entity or agency under a foreign State's control. The Rules do not themselves list those requirements.
Sources: Rules r.15
SDFs and data localisation
Rule 13(4) goes further for SDFs: personal data the Government specifies, on a committee's recommendation, and the traffic data about its flow, must not be transferred outside India. Which data is covered depends on that later specification.
Sources: Rules r.13(4)
Processing foreigners' data in India
Most duties do not apply where a person in India processes personal data of people outside India under a contract with someone outside India, as in outsourcing. Security safeguards and overall responsibility still apply, as for every section 17(1) exemption.
Sources: Act s.17(1)(d)
Key points
- Transfers abroad are allowed unless the Government restricts a country.
- Stricter sector rules on transfers continue to apply.
- Rule 15 allows Government orders on foreign State access.
- SDFs may have to keep specified data in India.
- Outsourced processing of foreigners' data is largely exempt.
In practice
A checklist for your organisation.
- List every country where your data, or vendors' copies, are stored.
- Check sector regulators' localisation rules for your data types.
- Add a contract clause letting you move data if a country is restricted.
- Watch the Gazette for section 16 and Rule 15 notifications.
Check what you learned
4 questions. Choose an answer to see why it is right.
0 of 4 answered
Question 1 of 4
Under section 16, when is a transfer abroad restricted?
Show the answer
A. When the destination is a country or territory notified by the Central Government
Section 16(1) lets the Central Government, by notification, restrict transfers to such country or territory outside India as may be notified.
Act s.16(1)Section 16(1) lets the Central Government, by notification, restrict transfers to such country or territory outside India as may be notified.
Act s.16(1)Question 2 of 4
A sector law requires some data to stay in India. Does section 16 override it?
Show the answer
B. No, stricter laws continue to apply
Section 16(2) keeps in place any law giving a higher degree of protection for, or restriction on, transfer of personal data outside India.
Act s.16(2)Section 16(2) keeps in place any law giving a higher degree of protection for, or restriction on, transfer of personal data outside India.
Act s.16(2)Question 3 of 4
What does Rule 13(4) require of a Significant Data Fiduciary?
Show the answer
D. Keep personal data specified by the Government, and its traffic data, inside India
Rule 13(4) requires that personal data specified by the Government on a committee's recommendation, and its traffic data, is not transferred outside India.
Rules r.13(4)Rule 13(4) requires that personal data specified by the Government on a committee's recommendation, and its traffic data, is not transferred outside India.
Rules r.13(4)Question 4 of 4
An Indian firm processes data of people in Europe under a contract with a European company. Which provision applies?
Show the answer
B. The exemption in section 17(1)(d)
Section 17(1)(d) exempts processing of personal data of Data Principals outside India under a contract with a person outside India, except s.8(1) and s.8(5).
Act s.17(1)(d)Section 17(1)(d) exempts processing of personal data of Data Principals outside India under a contract with a person outside India, except s.8(1) and s.8(5).
Act s.17(1)(d)
Official sources for this lesson
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)
- G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force
A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the DPDP dictionary.