SCENARIO D03 · GOVERNANCE & TRANSFERS
A team assumes the DPDP framework always prohibits transfers outside India. What should it track instead?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Act section 16 restrictions and Rule 15 conditions concerning access by foreign States or related entities.
Maintain a current transfer register and monitor actual government notifications/orders rather than assumptions.
WHY THE OTHER INSTINCTS MISS
Act section 16 restrictions and Rule 15 conditions concerning access by foreign States or related entities.
Correct. The two provisions address different government restrictions/requirements and should not be collapsed into a blanket ban.
A universal localisation rule for every category of personal data.
The cited provisions do not create that universal statement.
No transfer controls because the Act permits all destinations.
Section 16 allows notified restrictions, and future Rule 15 permits specified requirements.
BUILD THIS EVIDENCE
Transfer register, destination/recipient facts, restriction monitor and legal review trigger.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- fact-dependent
- Pinpoint
- Act s. 16; Rule 15; G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)