Can a company transfer my data outside India?

What the Law Says

The Digital Personal Data Protection Act, 2023 (DPDP Act) governs cross-border transfers of personal data by companies operating in India.

Under the DPDP Act, 2023, a company (data fiduciary) may transfer personal data outside India only to countries or territories notified by the Central Government as 'adequate' — meaning they ensure a level of data protection comparable to India’s law.

If the destination country is not notified as adequate, transfer is still permitted if the data principal (you) has given explicit consent *and* the transfer is made under a contract or intra-group scheme approved by the Data Protection Board.

The Act prohibits transfer to countries specifically restricted by the Central Government — such restrictions must be published in the Official Gazette.

Statutory Text

A data fiduciary may transfer personal data outside India to any country or territory, except to such countries or territories as may be restricted by the Central Government by notification in the Official Gazette.

— Digital Personal Data Protection Act, 2023, s. 16(1) — Transfer of personal data outside India

Statutory Text

The Central Government may, by notification in the Official Gazette, restrict transfer of personal data to any country or territory where it is satisfied that such transfer may prejudice the sovereignty and integrity of India, the security of the State, friendly relations with foreign States or public order.

— Digital Personal Data Protection Act, 2023, s. 16(2)

Sources