Section 16: Processing of personal data outside India

Section 16 of the Digital Personal Data Protection Act addresses the transfer of personal data outside of India. It grants the Central Government the authority to issue official notifications that restrict a Data Fiduciary, the person or entity determining the purpose and means of processing data, from sending personal data to specific countries or territories for processing.\n\nThe section also clarifies how this law interacts with other Indian laws regarding international data transfers. If another law currently in force in India provides a higher degree of protection or places stricter restrictions on a Data Fiduciary transferring personal data abroad, that other law will continue to apply. This ensures that the Act does not accidentally weaken or override existing, stronger rules about sending specific types of personal data outside the country.

Key points

• The Central Government has the power to restrict Data Fiduciaries from transferring personal data to specific countries or territories outside India. (1)
• These restrictions will be established through official government notifications. (1)
• This section does not override any other Indian law that imposes stricter restrictions or higher protections on transferring personal data outside India. (2)

Common misreadings

• People might assume the Act automatically bans all data transfers outside India, but it only restricts transfers to specific countries if the Central Government notifies them.
• People might think this Act overrides all other data transfer laws, but it explicitly allows other Indian laws with stricter restrictions to remain in force.