Chapter 4 · Special Provisions
Section 16 - Processing of personal data outside India
Cross-border transfers and government restrictionsThis section governs sending personal data abroad.
Download full Act (PDF)In plain English
This section governs sending personal data abroad. The default is open - transfers are allowed - but the Central Government may notify specific countries or territories to which transfers are restricted (a 'blacklist' rather than a 'whitelist' model). It also makes clear that any stricter transfer rules in other Indian laws - say, sectoral rules for banking or health data - continue to apply on top of this section.
A bank may transfer data to a cloud region abroad unless that country is on a restricted list - but sectoral rules requiring local storage still bind it.
Key points
- Cross-border transfers are permitted by default.
- The Government may restrict transfers to specified countries or territories.
- Stricter transfer rules in other Indian laws continue to apply.
Official section text
Section 16. Processing of personal data outside India.
The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.