DPDP Glossary

Cross-Border Transfer

Transfer of personal data outside India, which Rule 15 permits subject to requirements the Central Government may specify for making data available to a foreign State or related entities.

Rule 15

What it means

Rule 15 addresses transfer of personal data outside India. It permits such transfer subject to requirements the Central Government may specify for making personal data available to a foreign State or to any person or entity under the control of a foreign State. It is not a blanket ban on all cross-border processing, nor a full “adequacy” regime copied from other laws.

Worked example

A SaaS Fiduciary hosting Indian customer data on servers outside India should read Rule 15 against its facts and watch for any government-specified requirements — not assume either “transfers are forbidden” or “transfers need no further thought.” Contractual and security controls still sit under other Act duties.

In practice

Inventory where personal data leaves India, who receives it, and for which purpose. Track Rule 15 commencement and any specified requirements. SDF designation does not by itself rewrite Rule 15 — see the dedicated Rule 15 page for operational framing.

Rule 15: Cross-Border Transfer →

Source

Rule 15 · Official text (PDF)

Educational summary based on the Digital Personal Data Protection Act, 2023 and Rules, 2025. Not legal advice.

Further reading

Data FiduciaryAny person who alone or with others determines the purpose and means of processing of personal data.Personal DataAny data about an individual who is identifiable by or in relation to such data.Significant Data FiduciaryA Data Fiduciary or class of Data Fiduciaries notified as such by the Central Government, with additional obligations under Section 10 and Rule 13.

← Back to glossary