The Act does not list approved countries. Instead, the Central Government may, by notification, restrict transfer to a country or territory outside India (section 16). Such notifications must be laid before Parliament (section 41).
- Laws that give a higher degree of protection or restriction on transfers, such as sector rules, continue to apply (section 16).
- Data Fiduciaries must meet requirements the Government sets by order on making personal data available to a foreign State or entities under its control (rule 15).
- Significant Data Fiduciaries must keep personal data specified by the Government in India (rule 13).
- Processing of non-residents' data in India under a contract with a foreign person is exempt from section 16 and some other provisions (section 17).
We have not found any notification restricting transfers to a country. Section 16 and rule 15 come into force on 13 May 2027.