Processing of personal data outside India
Transfer of personal data outside India is permitted except to a country restricted by Central Government notification. Sectoral laws providing higher protection continue to apply.
Section 16DPDP Act, 2023Data Fiduciary
What this requires
Transfer of personal data outside India is permitted except to a country restricted by Central Government notification. Sectoral laws providing higher protection continue to apply.
Evidence a regulator would accept
- Cross-border transfer register
- Destination country assessment
How this product discharges it
core (primary)
Our position
Changing this recalculates the readiness score immediately.
- Current
- Gap
- Residual risk
- High
- Owner
- Priya Nair
- Last reviewed
- 22 May 2026
- Next review due
- 10 Dec 2026
Open gaps (2)
Gaps raised against this obligation. Closing one moves this clause forward.
Evidence (1)
Documents indexed against this obligation in the evidence vault.
History
- Clause status updated following remediationyesterday06 Aug 2026, 00:30Deepika Joshi
- Clause status updated following remediation4 days ago03 Aug 2026, 17:30Rohit Verma
- Clause status updated following remediation6 days ago01 Aug 2026, 10:30Naveen Kulkarni
- Clause status updated following remediation8 days ago30 Jul 2026, 06:30Vikram Saxena
- Clause status updated following remediation10 days ago28 Jul 2026, 00:30Imran Sethi
- Clause status updated following remediation13 days ago25 Jul 2026, 16:30System
- Position reviewed and recorded3 months ago22 May 2026, 11:55Priya Nair
Related obligations
- S.8(1)Accountability, including through a ProcessorGap
- S.8(9)Publish contact for the DPO or responsible personCompliant
- S.28Procedure to be followed by the BoardIn progress
- Sch.Monetary penaltiesCompliant
- R.9Contact information for questions about processingPartially compliant
- R.14Processing of personal data outside IndiaGap