Can you send personal data outside India? Section 16 and Rule 15

Using a cloud region outside India, an overseas email platform or a group company’s shared HR system sends personal data abroad. The Digital Personal Data Protection Act, 2023 does not ban this. It lets the Central Government restrict it. A Data Fiduciary is the person or business that decides why and how personal data is processed. Three layers apply to every transfer it makes: Section 16 of the Act, Rule 15 of the DPDP Rules, 2025, and any other Indian law that is stricter. A fourth applies to Significant Data Fiduciaries.

Layer 1: Section 16(1), restriction by notification

Section 16(1) says the Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to any country or territory outside India that it notifies.

The model is a restriction list. Transfers are not limited to approved countries; instead, the government can name countries or territories to which transfers are restricted. For you, that means:

• No list of “safe” countries exists in the Act or the Rules for you to rely on.
• The position can change by notification. A destination that is unrestricted when you sign a contract can be notified later.

Before relying on any destination, check the Gazette for notifications under Section 16(1), and re-check on a schedule you set.

Layer 2: Rule 15, data made available to a foreign State

Rule 15 confirms that personal data processed under the Act may be transferred outside India, subject to one restriction. The Data Fiduciary must meet any requirements the Central Government specifies, by general or special order, about making that data available to a foreign State. The same applies to any person or entity under the control of such a State, and to any of its agencies.

Rule 15 does not itself list those requirements; they come from orders. So each transfer raises two questions. Could the data be made available to a foreign State or a body it controls? Has an order been issued that applies? Record whether each recipient is a foreign State, or controlled by or an agency of one, so you can answer the second question when orders appear.

Layer 3: stricter Indian law still applies

Section 16(2) preserves any other law in force in India that gives a higher degree of protection for, or restriction on, transfers of personal data outside India. Section 16 does not limit such a law. If a sector law, or a regulation or direction with the force of law, requires data to stay in India or sets conditions on transfers, that requirement continues alongside the Act.

Significant Data Fiduciaries: a localisation duty

Rule 13(4) adds a duty for Significant Data Fiduciaries. The Central Government may specify personal data, on the recommendations of a committee it constitutes. A Significant Data Fiduciary must take measures to ensure that such data, and the traffic data about its flow, is not transferred outside India. This applies only to notified Significant Data Fiduciaries and only to data the government specifies.

Processing abroad and the Act

Section 3(b) applies the Act to processing outside India when it is connected with offering goods or services to Data Principals in India. Moving that processing offshore does not end your obligations. For other offshore processing, such as staff data hosted abroad, the text is not explicit, so take advice.

Your responsibility for vendors also travels with the data. Section 8(1) keeps you responsible for processing done on your behalf by a Data Processor, and Section 8(5) requires reasonable security safeguards for that processing. Where Section 8(2) applies, you need a valid contract with the processor; see what goes in a Data Processing Agreement.

The reverse case: foreign clients’ data processed in India

Section 17(1)(d) covers a person based in India who processes the personal data of Data Principals not within India, under a contract with a person outside India. For that processing, Chapter II (other than Sections 8(1) and 8(5)), Chapter III and Section 16 do not apply. Security safeguards and overall responsibility still do.

Checking each transfer

A transfer you have never checked should count as unchecked, not as permitted.

Transfers already running

Sections 3, 8, 16 and 17, and Rules 13 and 15, apply from 13 May 2027 (clause (c) of G.S.R. 843(E); Rule 1(4)). Transfers already running on that date are covered from then, so the register should be ready before it.