DPDP cross-border data transfer: what section 16 allows and what can change

Cross-border transfer is a part of the DPDP Act that companies often worry about more than they need to change for. The Act does not ask you to host data in India, and it does not require approvals or special contracts for transfers. It gives the government powers to restrict transfers later, and none of those powers has been used.

That does not mean you can ignore it. Sectoral rules already require some data to stay in India, significant data fiduciaries may face localisation, and a single notification could restrict a country your vendors use. The work is mostly about knowing where your data goes, so you can respond quickly if the rules move.

What does section 16 of the DPDP Act say?

Section 16(1) lets the Central Government, by notification, restrict the transfer of personal data by a Data Fiduciary to any country or territory outside India. This is a negative list: everything is permitted unless a destination is notified. As of 13 November 2026, no country or territory has been notified.

Section 16(2) says the section does not limit any other Indian law that gives a higher degree of protection or a stricter restriction on transfers, for specific data or for specific fiduciaries. Sectoral rules continue alongside the Act.

Section 16 commences on 13 May 2027, with the rest of the core obligations. A breach of section 16 has no separate line in the penalty Schedule, so it falls under “any other provision”, with a ceiling of ₹50 crore.

Is data localisation required under DPDP?

Not as a general rule. Most companies can keep using cloud regions, SaaS tools and support teams outside India. Localisation can come from two places.

Significant data fiduciaries

Rule 13(4) requires a significant data fiduciary to make sure that personal data specified by the government, on the recommendation of a committee it constitutes, is processed without that data, or the traffic data about its flow, leaving India. No significant data fiduciary has been notified, and no data has been specified. If you could be designated, design so that a specific data set could be moved to Indian infrastructure without rebuilding the product. Our significant data fiduciary guide covers how designation works.

Sectoral rules

Under section 16(2), stricter sectoral laws keep applying. The best-known example is RBI's requirement that payment system data be stored in India. Other regulators in finance, insurance, telecom and government services have their own rules on where data sits or who may access it. If you operate in a regulated sector, those rules are your real localisation baseline, and DPDP sits on top. The fintech guide goes into how this works for lenders and payment companies.

What does Rule 15 add?

Rule 15 confirms that personal data processed under the Act may be transferred outside India, and adds one condition: the fiduciary must meet any requirements the Central Government sets, by general or special order, about making that personal data available to a foreign State, or to any person or entity under the control of, or an agency of, such a State.

No order has been issued. In the final Rules, this condition applies to all personal data. Until an order appears, the practical step is to know which of your vendors are subject to foreign government access laws, and to have a process for handling a foreign government request for Indian users' data, escalating it to legal before anything is disclosed.

Where each transfer rule stands today

What happens if a country is notified?

A section 16(1) notification would name a country or territory and restrict transfers of personal data by fiduciaries to it. The notification itself will set the scope and timing, so read it before acting. Expect three questions from your leadership on the day it appears: which of our vendors store or access data there, which data categories are involved, and how quickly can we move them. If you cannot answer those from a register, you will spend the first weeks finding out rather than fixing.

The same applies, on a smaller scale, to a Rule 15 order or a Rule 13(4) list. Each could affect a specific data set or a specific kind of recipient rather than a whole country. Designs that keep data sets separable, with clear tags for category and location, make all three changes cheaper to absorb. Teams that already run their cloud in an Indian region, with support access controlled by role, usually have the least to change.

Does DPDP apply to foreign companies and offshore processing?

Section 3(b) extends the Act to processing outside India if it is connected with offering goods or services to Data Principals in India. A foreign SaaS company, marketplace or app with Indian users is a Data Fiduciary for that processing, wherever its servers sit. Unlike GDPR, the Act has no separate trigger for monitoring behaviour; the test is offering goods or services.

When an Indian company sends data to an offshore processor, the Indian company stays responsible. Section 8(1) makes the fiduciary responsible for processing done on its behalf, whatever the contract says, and section 8(2) allows processors to be engaged only under a valid contract.

The reverse flow matters for Indian IT services and outsourcing firms. Under section 17(1)(d), most of Chapter II, Chapter III and section 16 do not apply when a person based in India processes the personal data of people outside India under a contract with a person outside India. The security duty in section 8(5) and the processor accountability in section 8(1) still apply, so offshore client data still needs reasonable safeguards.

What should contracts with offshore vendors cover?

The Act does not prescribe transfer clauses, but your processor contracts are where you keep control. Add these to every data processing agreement with a vendor that stores or accesses data outside India:

• Locations: the countries where data is stored and accessed, and prior notice before any change.
• Sub-processors: a current list, notice of changes, and the same terms flowed down.
• Security: the Rule 6 measures, including encryption, access control, logging and one-year log retention.
• Breach notice: notice to you within hours, so you can report to the Board within 72 hours. See breach notification.
• Government access: notify you of any foreign government request where lawful, and challenge overbroad ones.
• Change of law: if a destination is notified under section 16 or a Rule 15 order applies, the vendor helps you migrate or restrict access within an agreed period.
• Erasure and return: at your instruction and at contract end, with confirmation.

How to build a vendor-location register

A vendor-location register turns a future notification from a crisis into a lookup. Keep it with your data inventory and review it at least once a year and whenever you add a vendor.

With this in place, you can answer two questions in a day: which vendors would be affected if country X were notified, and which data would need to move if a sectoral rule or SDF list changed.

What to do next

1. Map flows. List every system and vendor that stores or accesses personal data outside India.
2. Check sectoral rules with counsel. These, not section 16, are the binding limits today.
3. Update contracts with the location, sub-processor, breach, government access and change-of-law clauses above.
4. Build the register and give it an owner.
5. Plan for SDF status if your volume or data sensitivity makes designation possible.
6. Watch for notifications under section 16, Rule 15 and Rule 13(4), and review the register when one appears.

Fold these into your compliance checklist. If you want help mapping vendors and rewriting processor contracts with your counsel, get in touch.

This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.