s.16 · Rule 15 · Rule 13
Cross-border transfer
Section 16 allows personal data to be transferred outside India except to countries the Central Government restricts by notification, and preserves any stricter rule in another law.
The Act takes a blacklist approach rather than the GDPR’s whitelist: transfer is permitted unless the destination is notified as restricted. Rule 15 adds that a transfer must meet any requirement the Government specifies about making the data available to a foreign State or its agencies.
Sectoral rules can be stricter. The RBI’s payment data localisation and similar requirements survive under Section 16(2). Rule 13 adds a localisation restriction for Significant Data Fiduciaries on specified data.
The Gevox scanner flags a site whose forms or scripts send personal data to servers outside India without the notice saying so; the transfer may be lawful, but the notice must describe it.
Questions people ask
- Can we use a US cloud provider?
- Yes, unless the Government notifies that country as restricted and subject to any sectoral rule that applies to you. The notice should still say where the data goes.
- Has any country been restricted yet?
- None had been notified as of September 2026. The power exists; it has not been exercised.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.