India DPDPA: Article 16 – Processing of personal data outside India
16. Processing of personal data outside India
(1) The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
(2) Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.
What Article 16 Means for Your Business
Article 16 governs cross-border transfers of personal data from India to other countries. The DPDPA adopts a “negative list” approach, transfers are permitted by default to all countries except those specifically restricted by the Central Government. This is the opposite of the GDPR’s adequacy-based framework and means that most international data transfers from India are currently unrestricted.
- Cross-border transfers of personal data are permitted unless the destination country has been placed on a restricted list notified by the Central Government, no such list has yet been published as of early 2026.
- Businesses must monitor Central Government notifications, as restrictions on specific countries or data categories could be introduced at any time without advance notice.
- Unlike GDPR, there is no requirement for adequacy decisions, Standard Contractual Clauses, or Binding Corporate Rules to transfer data internationally, though contractual safeguards remain good practice.
- The Central Government retains the power to impose data localisation on specific categories of data, particularly for Significant Data Fiduciaries, build flexibility into your data architecture to accommodate this.
- Review all international data transfer flows and document the legal basis on which data leaves India so you can demonstrate compliance if restrictions are later introduced.