Skip to content
TrustOS

DPDP Act guide

Transferring personal data outside India under the DPDP Act

The DPDP Act lets personal data move outside India unless the Central Government restricts transfers to a country or territory it notifies. Sector laws that are stricter still apply. For most organisations the work is knowing where data goes today and being ready to act if a notification or order changes the position.

The law as of October 2026.

In shortAs of October 2026

  1. Section 16 lets the Central Government restrict transfers to countries or territories it notifies.
  2. Stricter Indian laws, such as RBI payment data storage rules, still apply.
  3. The Rules allow the government to set requirements by order on making data available to foreign States.
  4. You need an accurate list of where data goes, including vendors and their sub-processors.

What section 16 says

Section 16(1) allows the Central Government, by notification, to restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as it notifies. This is often called a negative list approach: transfers are allowed in general, and restrictions attach to the places the government names.

Check the MeitY site for any notification under section 16 before you treat a destination as open.

Stricter laws still apply

Section 16(2) says the section does not restrict any other law in India that provides a higher degree of protection for, or restriction on, transfers of personal data outside India. Sector rules therefore continue alongside the Act.

A familiar example is the Reserve Bank of India's direction on storage of payment system data, which requires payment system operators to store the entire data relating to payment systems only in India. A payments company can comply with the DPDP Act and still breach that direction if it moves the data abroad. Insurance, telecom and government contracts may carry their own conditions too.

What the Rules add

The DPDP Rules say that transfers outside India may be subject to requirements the Central Government specifies by general or special order, in particular on making personal data available to a foreign State or to any person or entity under its control.

Separately, a Significant Data Fiduciary may have to ensure that certain personal data, identified on the recommendation of a committee the government sets up, is processed subject to the restriction that it and the related traffic data are not transferred outside India.

Where transfers hide

Transfers are rarely one big export. A hospital chain may use a cloud email service hosted abroad, a support desk tool with servers in another region, and an analytics script that sends patient app events to a foreign vendor. Each is a transfer that should be on your list.

  • Cloud hosting and backup regions
  • SaaS tools for email, CRM, support and HR
  • Analytics, advertising and crash reporting SDKs in apps
  • Group companies and shared service centres abroad
  • Sub-processors used by your vendors

How TrustOS helps

The data inventory and processor records note where each system and vendor processes data, including sub-processors, so you can list every destination country in minutes. If a restriction is notified, you can see which purposes, data sets and contracts it touches and assign the work.

TrustOS does not decide whether a transfer is lawful under the Act, a sector direction or a contract. That call stays with your legal counsel, and TrustOS does not replace legal advice.

Official sources

This guide explains the law in plain words as of October 2026. It is not legal advice. Dates that depend on notifications can change, so check the official text before you rely on them.

Where TrustOS fits

The modules that help with this

Module

Data inventory

A working record of what personal data you hold, where it sits and who touches it.

Learn more

Module

Processors and assessments

Know which vendors handle your personal data, on what terms, and what could go wrong.

Learn more

Questions

Common questions

Has the government notified any restricted countries?

Check the MeitY data protection page for current notifications under section 16. The position can change by notification at any time.

Do we need consent to transfer data abroad?

The Act has no separate consent requirement for transfers. The transfer must still serve a purpose for which you have a valid ground, and your notice should be accurate about how data is processed.

We are a bank. Which rule wins?

Both apply. Section 16(2) preserves any law that gives a higher degree of protection or restriction, so RBI directions on data storage continue to bind you alongside the Act.

More on the Act

See it with your data

Show us where your personal data lives. We will show you TrustOS running on it.

A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.

Book a demoTake the gap assessment
Or get a rollout proposal in two minutes
  1. Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
  2. Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
  3. Step 3A first phase you can planModules, owners and effort, written down for you to keep.