The DPDP Act takes a permissive approach to sending personal data abroad. Section 16 lets the government restrict transfers to notified countries, and rule 15 says transfers are subject to requirements the government may set by order. Significant Data Fiduciaries can face localisation of specified data under rule 13(4).
What the text says
Act section 16(1): the Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as it notifies. That is a blacklist style mechanism, not a general ban.
Act section 16(2): the section does not restrict any other Indian law that gives a higher degree of protection or restriction on transfer. Sector rules can be stricter and still apply.
Rule 15: personal data processed under the Act may be transferred outside India subject to the Data Fiduciary meeting requirements the government may specify, by general or special order, for making the data available to a foreign State or to any person or entity under the control of or any agency of such a State.
Rule 13(4): a Significant Data Fiduciary must make sure that personal data specified by the government, on a committee's recommendation, is processed subject to the restriction that the data and its traffic data are not transferred outside India.
What I could not confirm
I did not find a published list of restricted countries or any orders under rule 15 and rule 13(4) while preparing this post. Check the current MeitY notices before you decide on a design.
Engineering consequences today
- Map data flows: which regions hold personal data, which processors and sub processors are abroad, where backups and logs replicate, where support staff can view data from.
- Make region a configuration, not a hardcoded fact. If a restriction appears, you want to move a tenant or a dataset without a rewrite.
- Tag records by data subject location or tenant, so you can route storage.
- Remember sector rules. Section 16(2) keeps stricter laws alive, and Indian financial regulators have their own expectations, which later posts touch on.
- Track processors. Rule 6 expects the Fiduciary to keep safeguards in the processor contract.
Logs travel too
The CERT-In FAQ says logs may be stored outside India if you can produce them quickly. That is a different instrument from the DPDP transfer rules, so check both for any log that contains personal data.
Quick check
Is personal data of Indian users banned from leaving India?
Not under the text of section 16. Transfers are allowed unless a country is notified as restricted, subject to rule 15 conditions and any stricter sector law.
Does rule 13(4) apply to a small startup?
It applies to Significant Data Fiduciaries, which is a notified status.
Sources
- Digital Personal Data Protection Act, 2023 (MeitY)
- Digital Personal Data Protection Rules, 2025 (MeitY)
- CERT-In FAQs on the Cyber Security Directions, May 2022
Last reviewed: 19 October 2026.
