Retention and transfers
Can I store personal data outside India?
- Short answer
- Yes, by default. The DPDP Act permits transfer to countries outside India except those the Central Government restricts by notification. It is a negative list, which is considerably more permissive than the data localisation many people expect.
This surprises people who remember earlier draft bills and sector rules that pushed towards localisation. The Act as passed allows transfers unless a destination is restricted.
Two qualifications matter. Sector regulators such as the RBI or IRDAI may impose stricter localisation, and the Act does not displace those. And a Significant Data Fiduciary may be required to keep specified data and its traffic data within India once that is notified.
So the answer for most organisations is that ordinary cloud hosting abroad is permitted, while a regulated firm should check its own regulator first.
Where this comes from
- Section 16, DPDP Act 2023
- Rule 15, DPDP Rules 2025
The mistake people make
Assuming DPDP mandates data localisation and re architecting infrastructure that did not need to move.