How to Transfer Personal Data Outside India Under Rule 15 of the DPDP Rules 2025
The received account of Indian cross border data law is that section 16 of the Digital Personal Data Protection Act, 2023 permits transfer anywhere except to a country the Central Government restricts. That is accurate as far as it goes, and it is not the whole provision set. Rule 15 of the Digital Personal Data Protection Rules, 2025 adds a second and quite different control where a data fiduciary seeks to transfer personal data outside India, one that turns on who receives the data rather than on where it goes.
Step 1: Note When Both Provisions Commence
Section 16 and rule 15 both commence with the eighteen month tranche. Under the commencement notification G.S.R. 843(E) dated November 13, 2025, sections 7 to 17 come into force eighteen months after publication, and rule 15 sits in the matching group under the Rules notified by G.S.R. 846(E) of the same date, so the operative date falls in May 2027.
Transfer arrangements are long lived, so a contract being signed now will still be running then. The sensible course is to build the clause set against both provisions today rather than to amend every data processing agreement later.
Step 2: Read Section 16(1) as a Power, Not a Permission
Section 16(1) provides that the Central Government may, by notification, restrict the transfer of personal data by a data fiduciary for processing to such country or territory outside India as may be so notified. The operative mechanism is a notification identifying a country or territory.
Two things follow. The restriction bites only where a notification exists, so the position has to be checked against whatever notifications are in force at the time of advice rather than assumed in either direction. And the control is country based, which means it is a mapping exercise: know the destinations, by processor and by sub-processor, and be able to produce that map.
Step 3: Read Rule 15, Which Works on the Recipient
Rule 15 provides that any personal data processed by a data fiduciary under the Act may be transferred outside the territory of India, subject to the restriction that the data fiduciary shall meet such requirements as the Central Government may, by general or special order, specify in respect of making such personal data available to any foreign State, or to any person or entity under the control of or any agency of such a State.
The rule is a single sentence and every part of it does work. The trigger is making personal data available to a foreign State, to a person or entity under the control of such a State, or to an agency of such a State. The instrument is a general or special order. The obligation is to meet the requirements that order specifies.
Step 4: Separate the Two Controls on the File
These are different tests and a transfer can pass one and engage the other. A transfer to a country not named in any notification under section 16(1) is unaffected by that provision, and the same transfer is caught by rule 15 if the recipient is a foreign State or an entity under its control.
So the file needs two columns rather than one: the destination, and the character of the recipient. State owned enterprises, sovereign funds, public research institutions and government controlled cloud providers are where the second column stops being theoretical, because an entity under the control of a State is a description of ownership and control and not of what the entity calls itself.
Step 5: Treat a Special Order as a Live Possibility
The phrase general or special order carries the possibility of an order addressed to a single fiduciary or a single arrangement. A general order can be monitored through the Gazette, while a special order arrives in the post and the recipient may be the only person who knows of it.
The practical consequence is for the internal protocol rather than the contract. Someone has to be responsible for recognising such an order as a legal instrument with consequences for existing transfers, and the register of cross border flows has to be accurate enough to answer what the order would affect.
Step 6: Do Not Let Section 16 Displace Sectoral Law
Section 16(2) provides that nothing contained in section 16 shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for, or restriction on, transfer of personal data by a data fiduciary outside India. That is a saving clause, not a ceiling.
For a regulated client this is the most important sentence in the section. Where a sectoral instrument imposes a stricter localisation or transfer condition, that condition survives the Act, and the DPDP analysis is the floor rather than the answer. An advice note that stops at section 16 will be wrong for a bank, an insurer or a telecom licensee for reasons that have nothing to do with the DPDP framework.
Step 7: Write the Clause Set to Both Provisions
The transfer clause should oblige the processor to disclose the countries and territories in which processing occurs and to seek consent before adding one, so that the section 16(1) map stays current. It should separately require disclosure of any onward making available of personal data to a foreign State or to an entity under the control of such a State, which is the rule 15 trigger.
Add a mechanism for compliance with a future order: an obligation to implement requirements specified by the Central Government within a defined period, a right to suspend the transfer if they cannot be met, and flow down to every sub-processor. Without flow down the fiduciary carries an obligation it has no means to perform.
Common Pitfalls to Avoid
Treating section 16 as the whole law: Rule 15 imposes a separate control that turns on the recipient rather than the destination.
Mapping destinations but not recipients: Rule 15 is triggered by making data available to a foreign State, an entity under its control, or its agency.
Assuming a position on notifications: Section 16(1) operates by notification, so what is restricted has to be checked at the time of advice.
Overlooking a special order: The rule contemplates a general or special order, and a special order may be known only to its recipient.
Reading section 16 as a ceiling: Section 16(2) preserves any law in force that provides a higher degree of protection or a stricter restriction.
Stopping at the processor: Without flow down to sub-processors the fiduciary cannot perform what rule 15 may require of it.
Treating either provision as presently operative: Section 16 and rule 15 both commence with the eighteen month group.
Key Statutory Provisions
Section 16 of the Digital Personal Data Protection Act, 2023: Sub-section (1) empowers the Central Government by notification to restrict the transfer of personal data by a data fiduciary for processing to a notified country or territory outside India, and sub-section (2) provides that nothing in the section restricts the applicability of any law in force in India that provides for a higher degree of protection for, or restriction on, such transfer.
Rule 15 of the Digital Personal Data Protection Rules, 2025: Personal data processed by a data fiduciary under the Act may be transferred outside the territory of India subject to the restriction that the data fiduciary shall meet such requirements as the Central Government may, by general or special order, specify in respect of making that personal data available to any foreign State, or to any person or entity under the control of or any agency of such a State.
Sources and References
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments