DPDP Rules status: compliance window active. Read the update

Skip to content
Data Privacy · Transfers

Cross-Border Data Transfers

If you use a foreign cloud, SaaS tool, or analytics service, chances are Indian user data is already leaving the country. DPDP has something to say about that.

Educational only · not legal adviceLast updated: 5 October 2026Written and edited by Sandesh Kokate

Short answer

You may send personal data outside India. The government can block transfers to a country by notification (Section 16(1)). It can also set rules for sharing data with a foreign State (Rule 15). These start on 13 May 2027.

What it means for you

  • Law: Do not send data to a country the government restricts (Section 16(1)). We have not seen any such notification.
  • Law: If you are a Significant Data Fiduciary, some data named by the government must stay in India (Rule 13(4)).
  • Law: Stricter Indian laws still apply on top (Section 16(2)). For example, CERT-In logs must be kept within India for 180 days (CERT-In Directions, 28 April 2022, direction (iv)).
  • Good practice: List every foreign tool that holds Indian user data, and where it stores it.

How it works

India uses a "blacklist" model. Transfers are allowed unless a country is named. Rule 15 adds one more condition. If the government sets requirements for sharing data with a foreign State or its agencies, you must meet them.

Official text — DPDP Act, 2023, Section 16
16. (1) The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified. (2) Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.
Official text — DPDP Rules, 2025, Rule 15
15. Transfer of personal data outside the territory of India.— Any personal data processed by a Data Fiduciary under the Act may be transferred outside the territory of India subject to the restriction that the Data Fiduciary shall meet such requirements as the Central Government may, by general or special order, specify in respect of making such personal data available to any foreign State, or to any person or entity under the control of or any agency of such a State.
Official text — DPDP Rules, 2025, Rule 13(4)
(4) A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India.

What's still open

  • No restricted-country list has been notified that we have seen.
  • The committee under Rule 13(4) and its list of data have not been published that we have seen.
  • RBI's payment-data storage rule: primary source not yet confirmed.

Sources

Source
MeitY — DPDP Act (Gazette PDF)

Section 16

Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).

Source
MeitY — DPDP Rules, 2025 (Gazette PDF)

Rules 13(4) and 15

Notified — checked 2026-10-06. Opened the DPDP Rules, 2025 (Gazette PDF).

Source
CERT-In Directions, 28 April 2022

Direction (iv): 180-day logs within Indian jurisdiction

Status unverified — no status check recorded

Quick self-check

Am I a Data Fiduciary?

Reading about DPDP obligations? Run the 2-minute self-check to see exactly what applies to your product.

Run it now
← Back to Data Privacy hubGoing Global hub →

How does this apply to you?

Take the 2-minute self-check to find out whether you're a Data Fiduciary, Data Processor, or both — with your personalised action checklist.

Take the DPDP Applicability Check

Your answers stay in your browser. If you choose "Email me this report", we send your email address and result type to our report service.