IndiaDigital Personal Data Protection Act, 2023, cross-border transfer restrictions
Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, cross-border transfer, s.16
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Under India's Digital Personal Data Protection Act, an app may transfer the personal data of an Indian data principal, including a voiceprint or other biometric identifier, to any country or territory by default, unless the Central Government has notified that destination as restricted.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Under challenge
- Yes
- Open questions
- Which instruments count as a 'law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data' under section 16(2), and does a sectoral regulator direction on where data is stored qualify?
- Which foreign State bodies does Rule 15 of the Digital Personal Data Protection Rules, 2025 reach when it makes a transfer that makes personal data available to a foreign State, or to a person or agency under its control, subject to requirements the Central Government specifies by order, and does Rule 15 bind before any such order is issued?
What it makes you log
Logging duty
Section 16 lets the Central Government restrict transfers of personal data to notified countries or territories and preserves any other law that gives a higher degree of protection for or restriction on transfer. It names no log or record. Rule 15 of the Digital Personal Data Protection Rules, 2025 adds requirements for making data available to a foreign State, and those Rules are a separate row.
- Kind
- None
- As of
What this law does
Section 16(1) sets a blacklist model: transfer of personal data outside India is permitted by default to any country or territory, except where the Central Government affirmatively notifies a restriction. This flips the 2019/2021 draft Bills' government-approved whitelist model. No data-localization mandate appears anywhere in the Act.
Section 16 sits inside the sections-3-to-17 bucket; Notification G.S.R. 843(E) () appoints eighteen months from its own publication date, , as this bucket's commencement date.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .