# Lesson 10: Sending data outside India | Learn DPDP | FOCTTA > Transfers abroad are allowed unless the Government restricts a country, with extra conditions possible under Rule 15 and for SDFs. Web page: https://foctta.com/learn/cross-border This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 10 Lesson 10 of 12 · 4 min read # Sending data outside India Transfers abroad are allowed unless the Government restricts a country, with extra conditions possible under Rule 15 and for SDFs. Jump to the quiz ## Where things stand - Not yet in force. Sections 16 and 17 and Rules 13 and 15 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) - No country had been notified under section 16(1), and no Rule 15 order was located. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## The default: allowed unless restricted Section 16(1) lets the Central Government, by notification, restrict transfers of personal data for processing to countries or territories it notifies. Section 16 does not itself bar transfers to places that are not notified, and the Act names no restricted country. Sources: Act s.16(1) ## Stricter sector laws still apply Section 16 does not weaken any other Indian law that gives higher protection, or restricts transfers more tightly, for any data, Fiduciary or class. So a sector rule that requires some data to stay in India continues to apply alongside DPDP. Sources: Act s.16(2) ## Rule 15: foreign State access Rule 15 allows transfers subject to requirements the Central Government may set by general or special order. Those requirements concern making personal data available to a foreign State, or to any person, entity or agency under a foreign State's control. The Rules do not themselves list those requirements. Sources: Rules r.15 ## SDFs and data localisation Rule 13(4) goes further for SDFs: personal data the Government specifies, on a committee's recommendation, and the traffic data about its flow, must not be transferred outside India. Which data is covered depends on that later specification. Sources: Rules r.13(4) ## Processing foreigners' data in India Most duties do not apply where a person in India processes personal data of people outside India under a contract with someone outside India, as in outsourcing. Security safeguards and overall responsibility still apply, as for every section 17(1) exemption. Sources: Act s.17(1)(d) ## Key points - Transfers abroad are allowed unless the Government restricts a country. - Stricter sector rules on transfers continue to apply. - Rule 15 allows Government orders on foreign State access. - SDFs may have to keep specified data in India. - Outsourced processing of foreigners' data is largely exempt. ## In practice A checklist for your organisation. - List every country where your data, or vendors' copies, are stored. - Check sector regulators' localisation rules for your data types. - Add a contract clause letting you move data if a country is restricted. - Watch the Gazette for section 16 and Rule 15 notifications. ## Check what you learned 4 questions. Choose an answer to see why it is right. 0 of 4 answered 1. Question 1 of 4 ### Under section 16, when is a transfer abroad restricted? - When the destination is a country or territory notified by the Central Government - Only for SDFs - Always - Never Show the answer **A. When the destination is a country or territory notified by the Central Government** Section 16(1) lets the Central Government, by notification, restrict transfers to such country or territory outside India as may be notified. Act s.16(1) 2. Question 2 of 4 ### A sector law requires some data to stay in India. Does section 16 override it? - Only for banks - No, stricter laws continue to apply - Yes - Only after five years Show the answer **B. No, stricter laws continue to apply** Section 16(2) keeps in place any law giving a higher degree of protection for, or restriction on, transfer of personal data outside India. Act s.16(2) 3. Question 3 of 4 ### What does Rule 13(4) require of a Significant Data Fiduciary? - Delete all foreign data - Nothing - Store all data abroad - Keep personal data specified by the Government, and its traffic data, inside India Show the answer **D. Keep personal data specified by the Government, and its traffic data, inside India** Rule 13(4) requires that personal data specified by the Government on a committee's recommendation, and its traffic data, is not transferred outside India. Rules r.13(4) 4. Question 4 of 4 ### An Indian firm processes data of people in Europe under a contract with a European company. Which provision applies? - Section 9 on children - The exemption in section 17(1)(d) - No exemption exists - Rule 10 Show the answer **B. The exemption in section 17(1)(d)** Section 17(1)(d) exempts processing of personal data of Data Principals outside India under a contract with a person outside India, except s.8(1) and s.8(5). Act s.17(1)(d) Try again[Next lesson: Board, penalties and appeals](https://foctta.com/learn/board-penalties-appeals) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 9 **Rights and duties of people**](https://foctta.com/learn/rights-and-duties) [Lesson 11 → **Board, penalties and appeals**](https://foctta.com/learn/board-penalties-appeals) **In this lesson** 1. Where things stand 2. The default: allowed unless restricted 3. Stricter sector laws still apply 4. Rule 15: foreign State access 5. SDFs and data localisation 6. Processing foreigners' data in India 7. Key points 8. In practice 9. Quiz Take the quiz