Cross-Border Data Transfers Under the DPDP Act: What Section 16 and Rule 15 Mean for Indian SMEs

If your startup stores customer data on AWS Singapore, sends invoices through a US accounting tool, or has a support team in the Philippines reading tickets, you are already doing cross-border data transfers under the DPDP Act. Most Indian SMEs I speak to have never listed these flows in one place. That is the thing to fix before May 2027.

The good news first: India has not built a wall around its data. The less comfortable news is that the rules can change by notification, and your sector regulator may already have its own.

What Section 16 of the DPDP Act actually says

Section 16 takes a "negative list" approach. A Data Fiduciary may transfer personal data for processing to any country or territory outside India, unless the Central Government has restricted that destination by notification. Transfers are allowed by default.

Contrast that with the GDPR, which blocks transfers unless a mechanism is in place (an adequacy decision, standard contractual clauses and so on). The DPDP Act has no equivalent paperwork requirement built into the statute. No approved-country list, no mandatory contract template.

Section 16(2) adds an important qualifier. If another Indian law imposes stricter conditions on moving data abroad, that law continues to apply. The DPDP Act does not loosen it.

Rule 15: what the Rules add

Rule 15 of the DPDP Rules, 2025 deals with transfers. As described in published commentary, personal data processed under the Act can go abroad subject to requirements the Central Government may set by general or special order. These concern making data available to a foreign State, or to an entity or agency controlled by one. Rule 15 does not prescribe standard contractual clauses, binding corporate rules or an adequacy assessment.

Significant Data Fiduciaries get extra attention. Under Rule 13, the government can require certain categories of personal data to stay in India. Those categories have not been specified yet. If you are a large consumer platform, a health-tech company or a fintech, treat this as a live risk rather than a theoretical one.

Where things stand today

As of the latest published commentary (Mondaq and Legal500, both covering mid to late 2026), the Central Government has not notified any restricted country or territory. So there is currently no list to check your vendors against.

On timing, the commentary reads the November 2025 commencement notifications as bringing Sections 11 to 17 of the Act, and Rules 3 and 5 to 16 including Rule 15, into force on or around 13 May 2027. Consent Manager provisions start earlier, around 13 November 2026. Confirm these dates against the Gazette notifications with your counsel, because they drive your project plan.

Until then, the older Information Technology (SPDI) Rules, 2011 still apply. Rule 7 of those permits transfer of sensitive personal data where the recipient ensures the same level of protection and the transfer is necessary for a lawful contract or is made with consent.

Sector rules that already restrict transfers

This is where Indian SMEs get caught. Section 16(2) keeps these in force:

• RBI payment data: payment system operators must store the entire payment system data in India. Processing abroad is allowed only in specified circumstances, and the data must come back within the prescribed period.
• SEBI and IRDAI: certain regulated intermediaries and insurers carry their own localisation or data-handling requirements for investor and policyholder information.

If you are a payments startup, a broking platform or an insurtech, your regulator's circulars come first. Check them with your compliance lead before you pick a cloud region.

A practical transfer audit for your team

You do not need a big project. A shared spreadsheet and two weeks will do for most companies under 200 people.

1. List every vendor that touches personal data. Cloud hosting, CRM, email tools, analytics, payroll, support desks, and your own offshore contractors. Do not forget remote access, since a developer in Dubai viewing a production database is a transfer in practice.
2. Record the destination country for storage and for access, plus the categories of data involved.
3. Flag sector-regulated data. Payment data, securities data and policyholder data go on a separate list.
4. Check your vendor contracts. Look for security commitments, sub-processor disclosure, breach notice timing and deletion on exit. The DPDP Act makes you responsible for what your processors do, so these clauses matter even where Section 16 asks for nothing extra. Our DPDP Act compliance page covers the wider set of duties.
5. Write a one-page contingency plan. If a destination is restricted tomorrow, which datasets would you move, how fast, and who decides? Companies using a single region with a single vendor will find this easy. Those spread across six tools will not.

Your consent notices should also be accurate. If you tell users their data stays in India while a vendor mirrors it to Europe, you have a notice problem regardless of Section 16. Use the DPDP readiness checklist to test your notice wording.

If you also serve EU customers

Indian SMEs selling into Europe live under two regimes. Under the GDPR, sending EU residents' data to India still needs a transfer mechanism, because India has no EU adequacy decision. The DPDP Act's permissive stance does not help you there. If that is you, our GDPR compliance consulting team can map both sets of obligations together, and a privacy impact assessment is a sensible way to document higher-risk flows.

What to do this month

Build the vendor and destination list. It takes a few hours, and it answers questions you will be asked sooner or later: by investors during due diligence, by enterprise buyers in security questionnaires, and eventually by the Data Protection Board. Penalties under the Act reach up to ₹250 crore for serious failures such as inadequate security safeguards, so knowing where your data sits is basic hygiene.

If you want a second pair of eyes, our services team does this kind of mapping for growing Indian businesses.

This article is general guidance for information only and is not legal advice. Check specific obligations against the DPDP Act, 2023, the DPDP Rules, 2025 and your sector regulator's rules. Ready to start? Work through our free DPDP checklist or contact us.