IndiaDigital Personal Data Protection Act, 2023, cross-border transfer restrictions
Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, cross-border transfer, s.16
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force in 232 days, effective 13 May 2027.
A cross border transfer rule binding public and private bodies.
As of 29 August 2026.
What it requires
- India's cross-border transfer restriction on personal data, including a voiceprint or other biometric identifier, has not yet commenced and is scheduled to take effect 13 May 2027. Once in force, an app may transfer the personal data of an Indian data principal to any country or territory by default, unless the Central Government has notified that destination as restricted.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 16(1) sets a blacklist model: transfer of personal data outside India is permitted by default to any country or territory, except where the Central Government affirmatively notifies a restriction. This flips the 2019/2021 draft Bills' government-approved whitelist model. No data-localization mandate appears anywhere in the Act.
Section 16 sits inside the sections-3-to-17 bucket; Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as this bucket's commencement date. No restricted-country list has been notified because the enabling section is not yet in force.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometricsprocesses_voice
Read the law
official statute text, Ministry of Electronics and Information Technology (MeitY)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.