Section 16

Processing of personal data outside India

Lets the Central Government restrict transfers of personal data to notified countries, and preserves stricter transfer rules found in other laws.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1): The Central Government may, by notification, restrict the transfer of personal data to any country or territory outside India that it notifies.
(2): Nothing in this section restricts the operation of any other law that gives a higher degree of protection or a stricter restriction on cross-border transfer.

In practice

India took the negative-list approach: transfer is permitted unless the destination is notified as restricted, which is the opposite of the adequacy model. That makes s.16 lighter than it first reads, but it does not stand alone. Rule 13(4) separately bars a Significant Data Fiduciary from transferring specified categories at all, and sub-section (2) leaves sectoral rules such as the RBI’s payment-data localisation fully intact.

Rule 15Transfer of personal data outside IndiaSubjects transfers abroad to any requirements the Central Government specifies for making data available to a foreign State or its agencies.Rule 13Additional obligations of Significant Data FiduciarySets the twelve-month DPIA and audit cycle, the report to the Board, algorithmic due diligence, and a hard localisation restriction.s.3Application of the ActSets the territorial and material reach: digital personal data processed in India, and offshore processing tied to offering goods or services into India.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 16 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next