Section 16: Cross-Border Data Transfers

Statutory Text (Official Gazette)

(1) The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.

(2) Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.

What Section 16 Means in Plain English

India’s DPDP Act adopted a “Negative List” (Blacklist) approach to international data transfers:

1. Transfers are permitted by default: Unlike the strict Standard Contractual Clauses (SCC) framework under European GDPR, Indian companies can store and process data in foreign cloud regions (e.g., AWS US-East, Google Cloud Singapore) unless the Indian government specifically blacklists that destination.
2. Rule 15 condition: Rule 15 of the DPDP Rules 2025 (in force from May 13, 2027) adds that, when transferring data abroad, you must meet any requirements the government sets by order about making personal data available to a foreign State or entities it controls. As of October 2026, no country has been restricted by notification under Section 16.
3. SDF localisation: Under Rule 13(4), Significant Data Fiduciaries can be required to keep specified personal data inside India.
4. Sectoral laws still supersede: Sub-section (2) preserves sectoral data localization mandates. If the Reserve Bank of India (RBI) mandates that domestic payment transaction data must reside strictly in India, or IRDAI mandates local storage of insurance records, those stricter rules continue to apply regardless of Section 16.