Short answer: The DPDP Act does not ban transfers of personal data outside India. From 13 May 2027, transfers are allowed except to countries the Government notifies as restricted (s.16(1)), subject to any Rule 15 conditions on making data available to foreign States, and to stricter sector laws (s.16(2)). No restricted-country list or Rule 15 order had been found as of 21 October 2026.
How does the DPDP Act regulate cross-border transfers?
The DPDP Act takes a negative-list approach: personal data may be transferred outside India unless the Central Government, by notification, restricts transfers to a particular country or territory (s.16(1)).
- Negative list: a list of restricted destinations, rather than a list of approved ones. None has been notified.
- Sector laws: any other law that imposes stricter transfer restrictions or localisation, such as rules from sectoral regulators, continues to apply (s.16(2)).
What does Rule 15 add?
Rule 15 allows personal data to be transferred outside India subject to the Data Fiduciary meeting any requirements the Central Government specifies, by general or special order, about making personal data available to any foreign State or any person or entity under its control or any of its agencies (Rule 15). No Rule 15 order had been found as of 21 October 2026.
Can an app store user data on servers outside India?
Yes, as things stand. Interpretation: with no restricted-country notification and no Rule 15 order issued, the Act itself does not stop an app from using cloud regions or vendors outside India, subject to sector laws and any future notification (s.16, Rule 15).
- The app remains responsible for processing by its overseas processors (s.8(1)).
- Interpretation: security, breach, retention and rights obligations follow the data, so they apply wherever it is stored.
Who faces stricter rules?
Significant Data Fiduciaries may be required to keep specified personal data, and the traffic data pertaining to its flow, inside India (Rule 13(4)). The data is to be specified by the Central Government on the recommendation of a committee (Rule 13(5)). No such specification had been found as of 21 October 2026. See significant data fiduciaries.
Cross-border rules at a glance
| Instrument | What it does | Status as of 21 October 2026 |
|---|---|---|
| s.16(1) | Government may restrict transfers to notified countries | No notification found |
| s.16(2) | Stricter sector laws continue to apply | In effect through those laws |
| Rule 15 | Conditions on making data available to foreign States | No order found |
| Rule 13(4) | SDFs may have to keep specified data in India | No data specified; no SDF notified |
| s.17(1)(d) | Non-residents' data under foreign contracts exempt from s.16 | Exemption in the Act |
Commencement for s.16 and Rule 15 is 13 May 2027. Statements that no notification was found rest on searches and trackers, not an exhaustive e-Gazette search.
Has the timeline for transfer rules changed?
Not in law. At a MeitY stakeholder meeting on 23 January 2026, MeitY reportedly proposed shortening the 18-month window to 12 months, at least for large businesses or Significant Data Fiduciaries, and enforcing Rules 13(4) and 15 immediately (reported by S.S. Rana & Co. via Chambers). No amending Gazette notification had been found as of 21 October 2026, and Rule 1 as published still gives 13 May 2027. Check the timeline for updates.
Does the Act apply to processing outside India?
Yes, in part. The Act applies to processing outside India in connection with any activity related to offering goods or services to Data Principals in India (s.3(b)). An app run from abroad for Indian users is therefore within scope. Conversely, processing in India of non-residents' data under a contract with a person outside India is exempt from s.16 and most of Chapter II (s.17(1)(d)).
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider mapping where each data set is stored and processed, including the regions used by SDK and cloud vendors.
- A common approach is to keep the data map current so that, if a restricted-country notification is issued, affected flows can be found quickly.
- Check sector rules that may apply to your app (for example in financial services) for stricter localisation.
- Consider contract clauses that let you require vendors to change region or stop transfers if a notification is issued.
- If your app could be designated a Significant Data Fiduciary, plan for possible Rule 13(4) localisation.
- Track progress in the readiness checklist and confirm sources on the sources page.