Digital Personal Data Protection Rules, 2025. Notified 13 November 2025. Verify against the notified Gazette text before external use.
Personal data processed by a Data Fiduciary under the Act may be transferred outside the
territory of India, subject to the restriction that the Data Fiduciary shall meet such
requirements as the Central Government may, by general or special order, specify in respect of
making that personal data available to any foreign State, or to any person or entity under
the control of, or any agency of, such a State.
Reading:
- Confirms the permissive default. There is no adequacy regime, no SCCs, no transfer impact
assessment under DPDP.
- The specific concern addressed is onward availability to foreign governments, not commercial
transfer as such.
- Act s.16(1) negative-list notifications remain the mechanism for restricting named countries,
and s.16(2) preserves stricter sectoral law.