---
title: "Cross-Border Data Transfer Under the DPDP Act | dpdpr.in"
description: "Transferring personal data outside India under DPDP Act Section 16 and Rule 15: what is allowed, what the Government can restrict."
url: "https://dpdpr.in/guides/cross-border-transfers/"
canonical: "https://dpdpr.in/guides/cross-border-transfers/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Cross-border transfers of personal data

The Act does not list approved countries. Instead, the Central Government may, by notification, restrict transfer to a country or territory outside India ([section 16](https://dpdpr.in/act/section-16/)). Such notifications must be laid before Parliament ([section 41](https://dpdpr.in/act/section-41/)).

- Laws that give a higher degree of protection or restriction on transfers, such as sector rules, continue to apply ([section 16](https://dpdpr.in/act/section-16/)).
- Data Fiduciaries must meet requirements the Government sets by order on making personal data available to a foreign State or entities under its control ([rule 15](https://dpdpr.in/rules/rule-15/)).
- Significant Data Fiduciaries must keep personal data specified by the Government in India ([rule 13](https://dpdpr.in/rules/rule-13/)).
- Processing of non-residents' data in India under a contract with a foreign person is exempt from section 16 and some other provisions ([section 17](https://dpdpr.in/act/section-17/)).

We have not found any notification restricting transfers to a country. Section 16 and rule 15 come into force on 13 May 2027.