Can personal data be stored or accessed outside India?

Short answer: Yes, unless a sector rule says otherwise

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

What the law says

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states.

Section 16 · Rule 15: Personal data may go outside India unless the government restricts a country. A sector law or regulator that sets a stricter rule still applies. No country had been restricted when this page was last reviewed.
Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.

Steps

List where each system is hosted and where support teams log in from.
Check sector rules for localisation.
Put location and access terms in cloud and vendor contracts.
Keep the list current; new SaaS tools change it quietly.
Tell people in your notice if data goes abroad.

Evidence to keep

Hosting and access-location list
Contract clauses
Sector rule check

Common mistakes

Forgetting email, CRM and helpdesk SaaS
Ignoring overseas support logins
Assuming 'Indian vendor' means 'data in India'

How it plays out by sector

Banking, financial services and insurance: Payment system data must be stored only in India. Check overseas support access to core systems.
IT, ITeS, BPO and GCC: Global HR and collaboration tools are often hosted abroad. Clients may restrict where their data goes.
Central government: ministries and departments: Hosting is usually in India; check support access by vendors' overseas teams.
Public sector undertakings and utilities: Check vendor support access from abroad, especially for smart-meter and ticketing platforms.
Healthcare and hospitals: Teleradiology and some software vendors use teams abroad; this is a transfer.

From each seat

CISO / Security head: Look at where admins and support staff log in from, not only where servers sit. Overseas support access is a transfer.
CIO / IT head: SaaS tools bought by departments are the usual surprise. Ask Finance for the list of software subscriptions.
Chief risk officer: Record every system or support team outside India, and check each against sector localisation rules.
IT department: List cloud regions and overseas support logins. Keep the list current.
Finance department: Check where finance and payroll SaaS is hosted.
Legal department: Track sector localisation rules and add location clauses to contracts.
Procurement department: Ask every vendor where data is hosted and where support staff sit.

What a good answer from management sounds like

“We know where every system is hosted and who logs in from abroad. Nothing breaks a sector rule.” Effort and time: Light to medium · 4 to 8 weeks.