Section 16: Processing of Personal Data Outside India

Quick summary

What Section 16 says

• Sub-section (1) — the Central Government may, by notification, restrict a Data Fiduciary from transferring personal data for processing to such country or territory outside India as may be so notified.
• Sub-section (2) — nothing in this section restricts the applicability of any other law in force in India that provides a higher degree of protection for, or restriction on, transfer of personal data outside India, in relation to any personal data or Data Fiduciary or class thereof.

Breaking it down

• Sub-s. (1)

  Open by default

  Transfers are allowed unless the destination is notified as restricted.

• Sub-s. (2)

  Stricter laws still win

  Any other law with a higher degree of protection or a stricter restriction continues to apply.

This is a blocklist model, not a general cross-border-transfer licensing regime. Rather than requiring approval for every international transfer, Section 16 works by exception: transfers are generally permitted unless the destination country or territory has been specifically notified as restricted. This is a notably lighter-touch approach compared to adequacy-decision or standard-contractual-clause regimes used elsewhere.

The restriction targets destinations, not specific transfer mechanisms or safeguards. The notification power in sub-section (1) is about where data can't go, not about imposing conditions like contractual clauses or certification schemes on transfers to countries that aren't restricted.

Sector-specific transfer rules elsewhere aren't overridden. Sub-section (2) is a deliberate carve-out: if, say, financial or health-sector regulation already imposes a stricter data-localisation or transfer-restriction requirement, that stricter rule continues to apply on top of whatever this section does or doesn't restrict.

Why this section matters

Cross-border data flows are central to how most digital businesses operate — cloud infrastructure, global SaaS tools, offshore support teams. Section 16 tells you the compliance question isn't “do we need approval to send data abroad” by default; it's “has the destination been specifically notified as restricted,” and separately, “does a sector-specific law impose a stricter rule that still applies regardless.”

Real-world example

Who needs to care about this section

• Infrastructure and vendor-selection teams — need to track the list of notified restricted countries/territories as it's published, since it can change which cloud regions or vendors are usable.
• Compliance teams in regulated sectors (finance, health, telecom) — need to check sector-specific transfer or localisation rules separately, since Section 16 doesn't override the stricter ones.
• Legal teams negotiating vendor and outsourcing contracts — cross-border processing clauses should account for the possibility of future country-specific restrictions being notified.

Common questions

Related sections