Is cross-border data transfer allowed under the DPDP Act?

Yes, unless the destination is restricted. Sec. 16(1) does not ban transfers; it lets the Central Government restrict transfer of personal data by a Data Fiduciary to countries or territories it notifies. Rule 15 adds that the Data Fiduciary must meet any requirements the Government specifies about making the data available to a foreign State or entities under its control.

Does the DPDP Act require data localisation?

Not for Data Fiduciaries in general. The only localisation duty in the Act and Rules is Rule 13(4), which applies to Significant Data Fiduciaries: personal data the Central Government specifies, on the recommendation of a committee, must be processed so that neither it nor its traffic data is transferred outside India.

Is there a list of restricted countries under Sec. 16?

Nothing in the Act or the Rules names one. Sec. 16(1) works only through a notification by the Central Government, so the restricted list is whatever has been notified. Check the current notifications before relying on any country being open or closed.

Do sectoral laws still apply to cross-border transfers?

Yes. Sec. 16(2) says the section does not restrict any Indian law that gives a higher degree of protection for, or puts a greater restriction on, transfer of personal data outside India. A transfer must satisfy the DPDP Act and any stricter sectoral rule that applies to you.

When do the DPDP cross-border rules take effect?

Rule 15 commences on 13 May 2027 with the other rules listed in Rule 1(4), and Rule 13(4) commences on the same date. Sec. 16 itself operates through notification, so it has effect only for countries the Central Government notifies.

DPDP Cross-Border Data Transfer: Sec. 16

You can send personal data outside India under the DPDP Act unless the destination has been restricted. Sec. 16(1) does not set up an approved-country list or require contracts or assessments before a transfer. It gives the Central Government a power to restrict transfers to countries it notifies, and two further conditions sit around it: Rule 15, and any stricter Indian law that already governs your sector.

That makes this a short provision with an unusual shape. The rule you comply with is not in the Act text. It is in notifications and orders that may or may not have been issued, so the practical work is knowing where your data goes and being able to react when something is notified.

What Sec. 16 says

Sec. 16(1) reads in two parts. The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India that it so notifies. The default is open; the restriction is the exception.

Two points about the wording are easy to miss.

It is about transfer "for processing". A transfer of data to a foreign Data Processor, or to a group company abroad that processes on your behalf, is the standard case.
It is addressed to the Data Fiduciary. You remain responsible for the data under Sec. 8(1) wherever your Data Processor holds it, so the restriction follows the data through your vendor chain.

Sec. 16(1) is also conditional on a notification that the Act and the Rules do not themselves contain. Neither document names a restricted country, and this page does not either. If a notification has been issued by the time you read this, it is the controlling text.

Rule 15: conditions around foreign States

Rule 15 allows personal data processed under the Act to be transferred outside India, subject to one restriction. The Data Fiduciary must meet any requirements the Central Government specifies, by general or special order, about making the personal data available to a foreign State, or to any person or entity under the control of, or any agency of, such a State.

Read together with Sec. 16, there are two separate gates:

Where the data is going. If the destination country or territory is notified under Sec. 16(1), the transfer is restricted.
Who gets access to it. If the data would be made available to a foreign State or an entity it controls, any requirements the Government has specified by order apply, whatever the country.

The second gate matters for ordinary commercial arrangements. A cloud region abroad is not a foreign State. A cloud provider or analytics vendor controlled by a foreign State, or a disclosure to a foreign government agency, is the situation Rule 15 addresses. As with Sec. 16, the requirements arrive by order; the Rule itself sets none.

Rule 15 commences on 13 May 2027 under Rule 1(4), together with the rest of the substantive duties.

Rule 1(2), 1(3) and 1(4) of the DPDP Rules, 2025. The Rules were published on 13 November 2025, and the two later dates are measured from that publication.

Sectoral laws that apply stricter rules

Sec. 16(2) is a savings clause: nothing in Sec. 16 restricts the applicability of any Indian law that provides a higher degree of protection for, or restriction on, transfer of personal data outside India. It can apply to any personal data, any Data Fiduciary, or any class of either.

So passing the DPDP test does not clear a transfer. If a regulator that supervises your sector already limits where certain data may be stored or processed, that limit continues. Sec. 38(1) says the DPDP Act is in addition to, not in derogation of, other laws, and Sec. 38(2) says the DPDP Act prevails only where there is a conflict. On transfers, Sec. 16(2) preserves a stricter sectoral rule expressly.

We have not listed sectoral localisation rules here, because that requires checking each regulator's current text. Make a list for your own organisation: which regulators supervise you, and what each says about where data is stored and processed. The DPDP applicability guide is a starting point for working out which rules reach you.

Significant Data Fiduciaries and Rule 13(4)

Rule 13(4) is the one localisation duty. It applies only to a Significant Data Fiduciary, which is a Data Fiduciary or class that the Central Government has notified under Sec. 10(1). Such a Fiduciary must undertake measures to ensure that personal data specified by the Central Government, on the recommendation of a committee it constitutes, is processed subject to the restriction that neither the data nor the traffic data pertaining to its flow is transferred outside India.

This is different in kind from Sec. 16. It is not a condition to satisfy abroad; it is a prohibition on transfer of the specified data. And it needs a specification before it bites: the data has to be specified by the Government, on the committee's recommendation. Rule 13(5) says the committee must include officials from the Ministry of Electronics and Information Technology and may include officials from other Ministries or Departments. If you are not notified as a Significant Data Fiduciary, Rule 13(4) does not apply to you.

When Sec. 16 does not apply at all

Sec. 17(1) switches off several Chapters for particular kinds of processing, and Sec. 16 is on the list. The exemptions in Sec. 17(1) include processing necessary to enforce a legal right or claim, processing by a court or regulatory body in the performance of its function, and processing to prevent, detect, investigate or prosecute an offence.

One that matters commercially is Sec. 17(1)(d). It covers personal data of Data Principals who are not within India, processed pursuant to a contract with a person outside India by a person based in India. An Indian outsourcing company handling overseas customers' data is the standard example. That data falls outside Chapter II (except Sec. 8(1) and 8(5)), Chapter III and Sec. 16. Reasonable security safeguards under Sec. 8(5) still apply.

What to do before 13 May 2027

The law does not yet tell you which destinations are closed, so the preparation is mapping.

List every place personal data goes outside India: your own infrastructure, cloud regions, support tools, analytics, email and messaging providers, and group companies.
Identify who controls each recipient. Rule 15 is triggered by control by a foreign State or one of its agencies, so ownership and government-access questions belong in vendor due diligence.
Record the purpose for each transfer. Your notice under Sec. 5 has to state the purpose of processing, and a transfer abroad for processing is processing.
Check the sector. Ask whether any regulator of your sector limits location of data storage or processing.
Keep the map current. When a Sec. 16 notification arrives, the question is "do we send anything there?", and it should be answerable from the register.

A processing register that records the recipient and location for each flow does most of this work. It is the same inventory the rest of the Act needs, which is why the processing register is where we start. The security safeguards and breach notification pages cover the other two parts of the security cluster. For the timetable of everything else, see the Rules timeline.

Penalty exposure

The Act has no cross-border-specific penalty. A breach of Sec. 16 or the Rules falls into the Schedule's residuary entry, up to 50 crore rupees. Separately, the Sec. 8(5) entry (up to 250 crore rupees) attaches to failing to take reasonable security safeguards, and Sec. 8(5) covers data processed on your behalf by a Data Processor wherever it sits. See DPDP penalties for how the Board imposes them.

Sending personal data outside India