Rule 15: Transfer of personal data outside the territory of India

Rule 15 explains how a Data Fiduciary (an entity that determines the purpose and means of processing data) can transfer personal data outside India. Generally, the rule allows personal data to be transferred internationally under the Act.\n\nHowever, there is a specific restriction when the data is made available to a foreign government. If the data will be accessible to a foreign State, its agencies, or any person or entity controlled by that State, the Data Fiduciary must follow special requirements.\n\nThe Central Government will define these exact requirements later through a general or special order. The rule establishes that these specific government-related transfers will be regulated by those future orders.

Key points

• A Data Fiduciary may transfer personal data outside the territory of India.
• Transfers are restricted if the data is made available to a foreign State, its agencies, or entities under its control.
• The Central Government will specify the requirements for these restricted transfers through a general or special order.

Common misreadings

• People might think all international data transfers are blocked, but the rule generally allows them subject to specific government orders regarding foreign States.
• People might assume the requirements are already listed in this rule, but the Central Government will specify them later by order.