Section 16Special Provisions
Processing of personal data outside India
Official statutory text · Gazette of India
The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
Nothing in this section shall restrict the application of any other law for the time being in force relating to the transfer of personal data outside the territory of India, and where such other law provides for a higher degree of protection or restriction on such transfer, the same shall continue to apply.
Plain-language explanation
- DPDP takes a 'blacklist' approach to cross-border transfer, rather than the 'adequacy allowlist' model used elsewhere — transfers are permitted by default unless a specific destination is restricted by notification.
- Sector-specific data-localisation rules (e.g. for payments data under RBI norms) sit on top of, and are not weakened by, this section.
Reconstructed for readability from the publicly notified DPDP Act, 2023. Always verify exact wording against the official Gazette of India before relying on this for legal or compliance decisions.