Processing of personal data outside India
- Status
- Upcoming
- Applies from
- 13 May 2027G.S.R. 843(E)
- Penalty
- Up to Rs 50 croreSchedule, item 7
- Binds
- Every Data Fiduciary
In plain English
A Data Fiduciary may transfer personal data to any country or territory outside India except those the Central Government restricts by notification. Where another Indian law sets a higher bar for a kind of data, that law prevails. Rule 14 adds that a transfer must meet any requirement the Government sets for making the data available to a foreign State or its agencies.
What you must do
Check the Government's notifications before transferring data to a new country, and keep checking: the list can change.
Apply any sector rule that is stricter, such as RBI's payment data localisation.
Gazette text · s. 16The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
- (1)The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
- (2)Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.
Source: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy)
Rules and tools that apply
Sources: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy); DPDP Act 2023, s. 16 · Change log