Transfer to Restricted Countries
How Section 16 governs international data flows.
🎯 Learning Objectives
- ▸ Understand the scope of Section 16
- ▸ Learn how the government restricts transfers
- ▸ Analyze the default position on data transfers
The "Blacklist" Approach
The DPDPA takes a significantly different approach to data transfers than the European Union. Under the GDPR, you can only transfer data to a country if the EU Commission has declared that country "adequate" (meaning it has strong privacy laws). This is a "whitelist" approach.
India has adopted a "blacklist" approach. Under Section 16, the Central Government can notify specific countries or territories to which data transfers are restricted. If a country is not on the restricted list, transfers are allowed.
As of now, the government has not notified any restricted countries under Section 16. So, currently, data can flow freely out of India.
Conditions on Transfer
The government is not just limited to banning countries. It can also impose conditions on transfers. For example, it could require companies to ensure that the receiving entity implements specific security safeguards before the data can be transferred.
📖 Glossary
- Adequacy Decision
- A finding by a regulatory body that a foreign country provides an adequate level of data protection.
- Blacklist
- A list of countries or entities that are subject to specific restrictions.
🔑 Key Takeaways
- Transfers are allowed by default unless a country is on the restricted list.
- The government can impose conditions on transfers.
- The government can restrict transfers based on national security or public interest.
📚 Further Reading
- DPDPA Section 16 — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...