Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsConcept
Cross-border transfer is the movement of personal data outside India for processing. The Central Government may restrict transfers to notified countries.
TL;DR
Cross-border data transfer (Section 16) is the movement of personal data outside India for processing. The DPDP Act takes a negative-list approach: transfers are generally allowed unless the Central Government notifies a country as restricted, and any stricter sector law still applies.
The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
The DPDP Act takes a 'negative list' approach: transfers abroad are generally allowed unless the government notifies a country or territory as restricted.
Where another Indian law imposes a stricter transfer rule, that stricter rule continues to apply. So sector regulations can still tighten this baseline.
A company may host Indian customer data with an overseas provider unless that country has been notified as restricted, and subject to any stricter sector law.
Is data transfer abroad banned?
No. It is allowed unless the government notifies a restricted country or territory.
Can other laws be stricter?
Yes. Section 16(2) preserves any higher protection or restriction under other Indian laws.
Consultant-led and partner-backed.