Section 16: Processing of personal data outside India
Simple Explanation
Section 16 gives the Central Government power to regulate cross-border data transfers:
• Government Notification: The government can notify which countries are approved or restricted for transferring Indian personal data.
• Higher Standards Preserved: If any other Indian law provides stricter rules on data transfers, those stricter rules still apply.
This means businesses cannot freely transfer personal data outside India unless the destination country is approved by the government. The government may use criteria like adequacy of data protection laws in the destination country.
Key Points
- ✓Central Government can restrict data transfers to certain countries
- ✓Can notify approved or restricted destinations
- ✓Other laws with higher protection standards still apply
- ✓Creates a data localization and cross-border transfer framework
Official Text (Summary)
The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such countries or territories outside India as may be notified. Nothing in this section restricts any other law that provides a higher degree of protection or restriction on such transfers.
Source: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Ministry of Law and Justice.
Jump to any Section
More Sections in Chapter IV
All Chapters
Is your business DPDP compliant?
Avoid penalties up to ₹250 Crore. Let our experts help you implement consent management, grievance redressal, and data protection measures.
Get a Free Compliance Audit