Rule 15: Transfer of Personal Data Outside the Territory of India

Quick summary

What Rule 15 says

• Personal data processed by a Data Fiduciary under the Act may be transferred outside India, subject to the Data Fiduciary meeting requirements the Central Government specifies, by general or special order, in respect of making that data available to a foreign State, or a person or entity under the control of such a State.

Breaking it down

This single sub-rule confirms and operationalises the Act's overall approach to cross-border data flows:

“Restricted list”, not “approved list”. The Act's model is permissive by default: transfers are allowed unless the government specifically restricts them, rather than requiring pre-approval for every destination country the way some other jurisdictions' data-protection laws work. Rule 15 doesn't change that model — it confirms the Central Government's power to add conditions on top of it.

The restriction targets foreign States and state-controlled entities specifically. The rule's language is about making data available to a foreign State, or a person/entity under that State's control — a framing aimed more at geopolitical/national-security-type risk than at ordinary commercial cloud-vendor relationships, though the precise scope of any future order would need to be read carefully when issued.

This is a rule to monitor, not a fixed compliance checklist. Because the actual restrictions come from future general or special orders rather than being listed in the Rule itself, an organisation's cross-border data map needs to be revisited whenever the government issues a new order under this Rule — it isn't a “set once and forget” compliance item.

Why this rule matters

Almost every modern software business relies on overseas infrastructure somewhere in its stack — cloud hosting, analytics, customer-support tooling. Rule 15 is the hook by which the government can, at any point, restrict specific destinations for specific categories of data, so tracking it is part of ongoing vendor and infrastructure risk management, not a one-time legal review.

Real-world example

Who needs to care about this rule

• Data infrastructure and vendor-management teams maintaining a cross-border data-flow inventory.
• Legal and compliance teams monitoring for new government orders under this Rule.

Common questions

Related rules