InfraVeritas360DPDPiqDPDP Insights › The law › Section 16 · Rule 15
The law
Section 16 · Rule 15: Data going outside India
Personal data may go outside India unless the government restricts a country. A sector law or regulator that sets a stricter rule still applies. No country had been restricted when this page was last reviewed.
What it means in your sector
- Banking, financial services and insurance: Payment system data must stay in India under RBI's direction, even though DPDP itself allows transfers.
- Central government: ministries and departments: Most government data sits on NIC or empanelled Indian cloud, but check vendor support access from abroad.
Questions where this section matters
Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.
Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.