Data leaving India
Data may leave India unless the government says otherwise.
The Act does not set up a permission system for transfers. It lets the government restrict transfers to countries it notifies, and keeps any stricter Indian law in force. Your job is to know exactly where your data goes, so a new notification is a lookup, not an investigation.
Back to DPDP services01 · The default
Open by default, closed by notification
A negative list approach: restrictions arrive country by country.
What the Act does
- Lets the government restrict transfers to any country or territory it notifies
- Keeps any other Indian law with stricter transfer rules fully in force
- Through the Rules, lets the government set conditions on handing data to another country's government or to bodies that government controls
What it does not do
- Require approval before each transfer
- Publish a list of approved countries
- Prescribe a standard contract for transfers
- Move your duties to the overseas recipient: you stay responsible
We have not found any country notified under section 16(1). The transfer rule in the Rules is among those that start eighteen months after publication. Check both before every annual review.
02 · Four levers
Four places a restriction can come from
Two in the Act, two in the Rules, and each reaches a different set of data.
- S16(1)Country restrictionThe government may bar transfers to a notified country or territory. Applies to every fiduciary.
- S16(2)Stricter laws winAny Indian law giving more protection or a tighter restriction on transfers keeps applying.
- R15Foreign State accessConditions the government may impose, by order, before data goes to a foreign government or to a body that government controls.
- R13(4)Localisation for significant fiduciariesData the government specifies, on a committee's recommendation, must stay in India together with the traffic data about its flow.
The last lever only touches a significant data fiduciary, and only the categories a committee picks. The first three can reach anyone. None of them is a reason to stop a transfer today unless something has actually been notified or another law already bites.
03 · Sector rules
Why sector regulators can be stricter than the Act
Section 16(2) leaves existing localisation rules standing.
For many regulated firms the binding transfer limit is not in the DPDP Act at all. It sits in a direction from the sector regulator, which the Act leaves untouched. Read these instruments directly; do not rely on summaries.
| Instrument | What to check | Who it reaches |
|---|---|---|
| RBI directions on storage of payment system data | Whether payment data must be stored only in India, and what may be processed abroad | Payment system operators and their service providers |
| CERT-In directions under the IT Act | Where logs must be kept and for how long | Service providers, data centres and body corporates in scope |
| IRDAI information and cyber security guidelines | Where policyholder records and logs must sit | Insurers and intermediaries |
| SEBI cybersecurity framework (CSCRF) | Data localisation and log retention expectations | SEBI-regulated entities |
| Government and public-sector contracts | Clauses requiring data to stay in Indian data centres | Vendors to government buyers |
04 · Transfer inventory
A transfer inventory you can answer from
List every place data goes, not just every vendor.
| Where data goes | Common examples | What to record |
|---|---|---|
| Primary hosting | Cloud region running production | Region, provider, data categories, and whether a fail-over region sits abroad |
| Backups and recovery | Snapshot copies, disaster recovery site | Backup region, retention period, who can restore and from where |
| Support and ticketing | Helpdesk tools, chat widgets, call recording | Tool's hosting region, what customer data lands in tickets |
| Email and messaging | Transactional email, SMS gateways, WhatsApp providers | Provider location, message content kept, delivery logs |
| Analytics and telemetry | Product analytics, crash reporting, session replay | Identifiers sent, region, whether masking is on |
| Subprocessors' subprocessors | A vendor's own hosting or support partners | The chain as the vendor discloses it, and how you hear about changes |
| Remote access | Staff or contractors abroad who can view records | Who, from which country, to which systems; viewing data is processing |
| Group companies | Shared CRM, HR or finance systems with a parent abroad | Entity, role (fiduciary or processor), and the intra-group contract |
05 · What to document
What to have on file before anyone asks
Evidence that you know your flows and could change them.
- Transfer register. Each flow from the inventory with country, recipient, role and data categories.
- Processor contracts. Security, breach notice, deletion and subprocessor change clauses; you remain responsible for what processors do.
- Sector rule map. Which regulator instruments apply to which data, and the stricter rule recorded against the flow.
- Notification watch. An owner who checks for section 16 notifications and rule 15 orders, with a dated log.
- Exit plan. For each high-volume flow, how you would repatriate or re-route it if a country were restricted.
- Foreign access requests. How a request from a foreign government for Indian users' data is escalated and decided.
One more carve-out matters to Indian service companies. Where a firm in India processes the data of people outside India under a contract with a foreign party, section 16 and most of the Act's duties do not apply, though responsibility and reasonable security remain. Comparisons with the GDPR's transfer tools sit on our GDPR page.
Sources: the Digital Personal Data Protection Act, 2023 (sections 8, 16 and 17) and the Digital Personal Data Protection Rules, 2025 (rules 1, 13 and 15), as published by the Ministry of Electronics and Information Technology. Sector instruments are named for reference only.
Questions about transfers out of India
Do we need approval to use a cloud region outside India?
Not under the DPDP Act, unless that country is restricted.
The Act works by restriction, not approval. Unless the government has notified the destination, or a sector rule requires local storage, the Act does not stop the transfer. You stay responsible for the data wherever it sits.
Has any country been restricted yet?
We have not found a notification. Check before relying on that.
Restrictions arrive by government notification under section 16(1). Keep a dated check in your file, because a notification would apply to every fiduciary at once.
Does the Act force data localisation?
Only in narrow cases.
General localisation is not required. A significant data fiduciary may have to keep specified categories in India under the Rules, and some sector regulators already require local storage for their data.
Is a support engineer abroad viewing our records a transfer?
Treat it as one in your inventory.
Viewing personal data is processing, and the person doing it is outside India. Record who has that access and from where, so a future restriction can be checked against it quickly.
Know every place your data lands.
A DPDP readiness assessment builds the transfer inventory, maps sector rules against it and sets up the notification watch. Counsel should confirm how the law applies to your contracts.