Updated: 24 September 2026

Section 16 of Digital Personal Data Protection Act, 2023 - Processing of Personal Data Outside India

Section 16 of the Digital Personal Data Protection Act, 2023 deals with the transfer of personal data by a Data Fiduciary for processing outside India. It follows a restriction-based framework: cross-border processing is not prohibited merely because it occurs outside India, but the Central Government may restrict transfers to notified countries or territories, and stricter requirements under other applicable Indian laws continue to operate.

What Section 16 provides

Section 16(1): The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India that is so notified.

Section 16(2): Section 16 does not displace another law in force in India that provides a higher degree of protection for, or a stricter restriction on, transfer of personal data outside India in relation to particular personal data, a Data Fiduciary, or a class of Data Fiduciaries.

For the authoritative statutory text, see the Digital Personal Data Protection Act, 2023 on India Code.

Meaning and scope of Section 16

1. Cross-border transfer is subject to Central Government restrictions

Section 16(1) empowers the Central Government to identify, by notification, countries or territories to which a Data Fiduciary's transfer of personal data for processing may be restricted. The provision therefore makes the Government's notified restrictions central to the statutory cross-border transfer framework.

2. Stricter Indian laws continue to apply

Section 16(2) is a savings provision. If another Indian law imposes a higher standard of data protection or a stricter restriction on overseas transfer for particular data or regulated entities, Section 16 does not dilute that requirement. Organisations should therefore consider both the DPDP framework and any sector-specific legal requirements applicable to their activities.

3. Key expression: Data Fiduciary

Under the DPDP Act, a Data Fiduciary is a person who, alone or together with other persons, determines the purpose and means of processing personal data. Section 16 places the cross-border transfer obligation on the Data Fiduciary.

Digital Personal Data Protection Rules, 2025

The Digital Personal Data Protection Rules, 2025 supplement the Act. The Rules contain a provision on processing personal data outside India under which specified cross-border transfers are subject to requirements that the Central Government may prescribe by general or special order, including requirements concerning making such personal data available to a foreign State or to a person, entity or agency under its control.

See the Digital Personal Data Protection Rules, 2025 - Ministry of Electronics and Information Technology.

Practical compliance points

A Data Fiduciary proposing to process personal data outside India should identify the destination country or territory, check applicable Central Government restrictions or orders, determine whether another Indian law imposes stricter transfer or localisation requirements, and document the legal and operational controls governing the overseas processing. The general obligations imposed by the DPDP framework should also be considered wherever applicable.

Important: Section 16 should be read with the Act, the Digital Personal Data Protection Rules, 2025, applicable commencement notifications and any later notification, general order or special order issued by the Central Government. Sector-specific laws may impose additional restrictions.

Official resources

India Code - Digital Personal Data Protection Act, 2023
MeitY - Digital Personal Data Protection Rules, 2025 and related notifications