DPDP Act 2023, s.16: transfers abroad are allowed unless the government restricts a country (Digital Personal Data Protection Act, 2023 (22 of 2023), s.16)
India uses a negative list: transfer is allowed unless the government notifies a country. The text names no country and the US is not named in anything I read. Stricter sector laws (for example the RBI payment data rule) still apply on top.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified. ... Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.”
Where it was read
Also read from the same source
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide