Under Section 16 of the DPDP Act 2023, personal data may be transferred outside India to any country except those the Central Government specifically restricts by notification — a 'negative list' (blacklist) approach, unlike the EU's adequacy 'allow list'. As of now no countries have been restricted, so most transfers are permitted, but sector rules (RBI, insurance, telecom) may still mandate local storage. This checker flags the considerations for your destination country.
See whether you can transfer personal data to a given country under the DPDP Act, and what safeguards to apply.
The GDPR uses an 'allow list': you may only transfer to countries with an adequacy decision or with specific safeguards. The DPDP Act 2023 inverts this with a 'block list' in Section 16 — transfers are permitted everywhere except to countries the Central Government restricts by notification.
This makes DPDP transfers easier by default, but two cautions remain: the Government can add restrictions at any time, and sector regulators (RBI, IRDAI, TRAI) impose their own data-localisation rules that sit on top of the DPDP Act.
A practical guide to DPDP Section 16: transfer clauses, the localisation rules by sector, and a recordkeeping template.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
