Section 16 — Processing of personal data outside India

What this section requires

Cross-border transfer is allowed by default. The Central Government can, by notification, restrict transfer of personal data to specific named countries or territories — but until it does, transfer for processing outside India is permitted.

This doesn't override any other Indian law that sets a stricter standard for particular data or a particular fiduciary — a sector-specific data-localisation rule elsewhere still applies on top.

Who it applies to

Every Data Fiduciary transferring personal data outside India — the default permission applies to all of them, subject to any country-specific restriction notified and any stricter sectoral law.

Checklist

• Check whether the Central Government has notified any restricted country or territory before transferring to it — the list, once any exists, is the only thing that narrows the default permission.
• Separately confirm no other Indian law (sectoral data-localisation rules, for instance) sets a stricter requirement for the specific data or sector involved — Section 16 doesn't override those.

Penalty exposure

No Schedule item names Section 16. Transferring to a notified restricted destination in breach of that notification falls under the residual item 7 — up to ₹50 crore.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).