Concept
Cross-border transfer is the movement of personal data outside India for processing. The Central Government may restrict transfers to notified countries.
The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
The DPDP Act takes a 'negative list' approach: transfers abroad are generally allowed unless the government notifies a country or territory as restricted.
Where another Indian law imposes a stricter transfer rule, that stricter rule continues to apply. So sector regulations can still tighten this baseline.
A company may host Indian customer data with an overseas provider unless that country has been notified as restricted, and subject to any stricter sector law.
Is data transfer abroad banned?
No. It is allowed unless the government notifies a restricted country or territory.
Can other laws be stricter?
Yes. Section 16(2) preserves any higher protection or restriction under other Indian laws.