Lesson 6.1: The cross-border transfer rule

Module 6 · Lesson 6.1 of 6 · About 30 minutes · The cross border transfer rule

Can you use a foreign cloud or an overseas support team? Usually yes. Here is the rule. This DPDPA 2023 course page explains the cross border transfer rule in plain language.

the cross border transfer rule - DPDPA 2023 course lesson banner
Advertisement

What you will learn about the cross border transfer rule

  • State the Section 16 rule
  • Understand the negative list approach
  • Know how other laws interact

Section 16 and Rule 15 (the cross border transfer rule)

The Central Government may restrict transfer of personal data to specified countries or territories by notification. Everything else is allowed. Where another law gives higher protection or restricts transfer more strictly, that law continues to apply. Under Rule 15 transfers outside India are subject to the requirements the Government may specify by general or special order.

Transfer decision: click each step

Select a numbered box to read more.

11 Is dataleaving India?22 Is the countryrestricted?33 Does a sectorlaw restrict it?44 Are therespecified requirements?55 Contractand record
Tap or click a step to see exactly what to do.
Advertisement

Approach compared (the cross border transfer rule)

LawApproach
DPDPAAllowed unless country restricted
GDPRRestricted unless adequacy or safeguards
Some sector lawsLocal storage required

Worked example

A startup uses a US-based email service. Unless the US is restricted by notification or a sector rule requires local storage, the transfer is allowed, with the fiduciary still responsible for safeguards.

Activity (5 minutes) (the cross border transfer rule)

List every foreign vendor that touches personal data.

Key takeaway: Check the latest Government notifications each quarter. The list of restricted countries can change.

Check your understanding of the cross border transfer rule

Q1. Default under Section 16 is that transfer is:

Q2. A stricter sector law:

Q3. Rule 15 deals with:

← Module 6 homeMapping and managing cross-border flows →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for the cross border transfer rule: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.