DPDP reference
Section 16: Processing of personal data outside India
Last checked 6 Nov 2026
The Central Government may by notification restrict the transfer of personal data to a country or territory it names (s.16(1)). Any other Indian law giving a higher degree of protection or restriction on transfers keeps applying (s.16(2)).
- Applies to
- Every Data Fiduciary that transfers personal data outside India.
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- Up to ₹50 crore (s.33, Schedule item 7).
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 16; G.S.R. 843(E), commencement
Questions
Can personal data leave India under the DPDP Act?
The Act restricts transfers to countries the Central Government notifies (s.16(1)). Rule 15 adds requirements for making data available to a foreign State or its agencies, and other laws may go further (s.16(2)).
Related
- Rule 15: Transfer of personal data outside the territory of India
- Rule 13: Additional obligations of Significant Data Fiduciary
- Section 38: Consistency with other laws
Next
Not legal advice.