Can you send personal data outside India under the DPDP Act? Yes, in principle: Section 16 of the Act and Rule 15 of the DPDP Rules, 2025 allow cross-border transfers by default, unless the Central Government restricts them or attaches conditions by order. For anyone calling a foreign AI or cloud API, that default comes with important caveats.
This guide explains how the rule works, where sector laws can be stricter, and what a practical checklist looks like for teams that use overseas LLM providers.
What the DPDP Act says about cross-border data transfer
The Digital Personal Data Protection Act, 2023 takes a different route from laws that rely on a whitelist of “adequate” countries. Section 16 lets the Central Government restrict transfers to specific countries or territories by notification. Everything else is open by default.
Rule 15 of the DPDP Rules, 2025 adds the operating detail. As reproduced on the dpdpa.com rules reference, it says personal data processed under the Act may be transferred outside India, subject to the data fiduciary meeting requirements the Central Government may specify by general or special order. Those orders can concern making data available to a foreign State, or to any entity under its control or any agency of that State.
One law firm summary (KSK & Co) phrases the rule as a simple negative list: transfers are fine except where the government restricts them. The two readings point the same way, but the exact wording should be checked against the Gazette notification.
Is data localisation required?
There is no general rule that all personal data must stay in India. However, obligations can tighten in two places.
Significant Data Fiduciaries and Rule 13
Significant Data Fiduciaries carry extra duties such as annual impact assessments and independent audits. Sources describe the transfer angle differently. One summary says Rule 13 requires that personal data and related logs are not transferred outside India unless allowed, while another describes restrictions on specified categories of data. Because the sources do not agree, treat this as an area to watch. Our explainer on Significant Data Fiduciaries and Rule 13 covers the wider duties.
Sector regulators
The DPDP Act does not switch off stricter sector rules. Commentary points to the RBI’s 2018 direction on storage of payment system data, which requires payment data to be stored in India, along with expectations from insurance and securities regulators. If you operate in a regulated sector, the stricter norm will usually be the one you plan around.
When does Rule 15 take effect?
The DPDP Rules were notified in November 2025 (most sources say 14 November; one says 13 November). Summaries state that Rules 1, 2 and 17 to 21 took effect immediately, and that Rules 3, 5 to 16, 22 and 23, including Rule 15, apply 18 months after publication. That points to roughly mid-May 2027. An industry timeline cited by India Briefing calls full enforcement around 13-14 May 2027 “indicative”, so confirm before relying on a date.
| Item | What the sources say |
|---|---|
| Default position | Transfers allowed unless restricted or conditioned by the Central Government |
| Who can be targeted | Foreign States and entities under their control or agencies |
| Extra layer | Possible limits for Significant Data Fiduciaries (Rule 13) |
| Sector overlay | RBI, IRDAI, SEBI and similar rules may demand local storage |
| Expected start | About 18 months after the November 2025 notification |
Using foreign AI APIs and cloud LLMs: what changes?
Whenever a prompt contains personal data and the provider processes it on servers abroad, you are making personal data available outside India. The provider is your data processor, and you remain accountable as the data fiduciary. Our post on AI agents under the DPDP Act goes deeper on that responsibility split.
Practical risks include prompt logs stored in another region, human review by vendor staff, fine-tuning on your inputs, and sub-processors you have never heard of.
A practical compliance checklist
- Map every AI and SaaS tool that receives personal data, and note the hosting region of each.
- Strip or pseudonymise personal data from prompts wherever the task allows it.
- Ask vendors for data residency options, zero-retention modes and a list of sub-processors.
- Put processor terms in writing covering security safeguards, breach notice and deletion.
- Check sector rules (payments, insurance, securities, telecom) before choosing a region.
- Track any Central Government order on restricted countries once the rule is in force.
- Keep records so you can show reasonable security safeguards if the Board asks.
Failures on safeguards are where the largest penalties sit, as explained in our guide to DPDP Act penalties.
Contracts, vendors and records: what to ask your AI provider
Because Rule 15 sets no fixed contract template, your vendor paperwork is where most of the real protection sits. Start with a data processing agreement that names the hosting regions, lists sub-processors and says how quickly you will be told about a breach. The DPDP Rules also expect reasonable security safeguards such as encryption, access control and logging, so ask the vendor to show how those are met for your workload.
Next, look at retention. Many AI providers keep prompts for abuse monitoring for a limited period. If your prompts contain customer names, phone numbers or health details, a zero-retention or regional endpoint is often worth paying for. Where that is not available, redact identifiers before the call and map them back after the response returns.
Keep your own records
Maintain a simple register that shows which systems send personal data abroad, for what purpose, under which contract and on what legal basis such as consent or a permitted legitimate use. If the Central Government later issues an order restricting a country or class of entity, a register lets you find affected flows in hours instead of weeks.
Think about training and fine-tuning separately
Sending data for inference is different from allowing a provider to train on it. Check that your agreement stops the vendor from using your prompts to improve its models unless you have a clear basis and have told people about it. Notices you give under the consent rules should be accurate about overseas processing, so update privacy notices when you add a new AI tool.
Frequently asked questions
Can Indian companies transfer personal data abroad under the DPDP Act?
Yes in principle. Section 16 and Rule 15 of the DPDP Rules, 2025 take a permissive approach: transfers are allowed unless the Central Government restricts them or sets conditions by order. Sector laws may still require data to stay in India.
Is there a data localisation requirement under the DPDP Act?
There is no blanket localisation rule for all businesses. Reported summaries of Rule 13 suggest Significant Data Fiduciaries may face limits on moving certain data and logs outside India, but sources describe this differently, so check the Gazette text.
Does using a foreign AI API count as a cross-border transfer?
If the prompts you send contain personal data and the provider processes it on servers outside India, that is generally treated as making personal data available abroad. You remain the data fiduciary and stay accountable.
When does Rule 15 come into force?
According to published summaries, Rules 3 and 5 to 16 (including Rule 15) apply 18 months after the November 2025 notification, which points to around mid-May 2027. Confirm the exact date in the Gazette.
Conclusion
India’s approach to cross-border transfer is open by default but backed by government power to restrict, plus stricter sector rules. Map your data flows now, prefer regional or zero-retention options for AI tools, and recheck the official text before the 18-month mark.
Not legal advice: this article is general information based on secondary sources and is not a substitute for advice from a qualified lawyer. Verify against the official Gazette notification.