Transfer of personal data outside the territory of India
- Status
- Upcoming
- Applies from
- 13 May 2027Rule 1(4)
- Penalty
- Up to Rs 50 croreAct, Schedule, item 7
- Binds
- Every Data Fiduciary
In plain English
Personal data may be transferred outside India, subject to whatever requirements the Central Government specifies by general or special order about making the data available to a foreign State or to a person or entity under its control or an agency of it. The Act's s. 16 lets the Government restrict transfers to notified countries; this rule adds a second, order-based layer aimed at foreign government access. No such order has been issued yet.
What you must do
Keep a register of cross-border transfers and the foreign jurisdictions involved, so an order under this rule can be applied quickly.
Watch the tracker for restricted-country notifications under s. 16 and orders under Rule 15.
Gazette text · Rule 15Any personal data processed by a Data Fiduciary under the Act may be transferred outside the territory of India subject to the restriction that the Data Fiduciary shall meet such requirements as the Central Government may, by general or special order, specify in respect of making such personal data available to any foreign State, or to any person or entity under the control of or any agency of such a State.
- Any personal data processed by a Data Fiduciary under the Act may be transferred outside the territory of India subject to the restriction that the Data Fiduciary shall meet such requirements as the Central Government may, by general or special order, specify in respect of making such personal data available to any foreign State, or to any person or entity under the control of or any agency of such a State.
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)
Act sections and tools that apply
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy) · Change log