Rule 15
Transfer of personal data outside India
Subjects transfers abroad to any requirements the Central Government specifies for making data available to a foreign State or its agencies.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- 01
- Personal data may be transferred outside India subject to the restriction that the Data Fiduciary must meet such requirements as the Central Government may specify, by general or special order, in respect of making that data available to any foreign State, or to any person or entity under the control of or acting as an agency of such a State.
In practice
This is narrower than the transfer regimes most compliance teams are used to. There is no standard contractual clause requirement and no adequacy list; the constraint is about making data available to foreign States and their agencies. The harder localisation restriction sits in Rule 13(4) and applies only to Significant Data Fiduciaries.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Rule 15 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.