Rule 15 — DPDP Rules, 2025
(1) The Central Government may, by notification, specify certain countries or territories to which the transfer of personal data is restricted. (2) A Data Fiduciary shall not transfer personal data to a country or territory specified under sub-rule (1) or to any entity under the control of the government of such country or territory.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 15 is the cross-border data transfer rule — and it is not blanket data localisation. Transfer is restricted only to countries specifically notified by the Central Government as restricted. As of October 2026, no country or territory has been so notified. Until the restricted list is published, there is no Rule 15 restriction on cross-border transfers. When the list is notified, the prohibition covers transfers to the country AND to entities under the control of that country's government — so a transfer to a private company incorporated in a restricted country but under government control is also prohibited.
A company that transfers customer data to AWS us-east-1 or Google Cloud EU is not in violation of Rule 15 as of October 2026. The restricted country list has not been notified. The obligation to monitor for the notification and adjust data routing accordingly is a prudent preparation step.
If Country X is notified as restricted, a Data Fiduciary must immediately cease transferring personal data to servers, entities, or affiliates located in Country X, including entities headquartered elsewhere but under the control of Country X's government. Review of cloud provider infrastructure for data residency in restricted countries will become necessary.
Rule 15 does not require all personal data to be stored in India. It only prohibits transfer to specifically restricted countries. A company can host data in the EU, Singapore, US, or any other non-restricted country without a Rule 15 compliance obligation.