Rule 15 — Transfer of Personal Data Outside the Territory of India

Rule 15 is a single, short rule, and it's worth reading in full: any personal data a Data Fiduciary processes under the Act may be transferred outside India, subject to the restriction that the Data Fiduciary meets whatever requirements the Central Government specifies, by general or special order, for making that data available to a foreign State, or to any person or entity under the control of, or acting as an agency of, such a State.

What Rule 15 actually does

Two things follow directly from that wording. First, the default is permissive — personal data can move outside India's territory; the Act doesn't impose a general requirement to keep it in-country. Second, the government's power to condition that movement is narrower than "any cross-border transfer" — it's specifically aimed at data reaching a foreign State, or a person or entity under that State's control or acting as its agency. That's a sovereignty-facing power, not a general trade-and-commerce restriction on ordinary vendor relationships.

In practice, this means the government can specify requirements — which might cover particular countries, particular classes of foreign entities, or particular safeguards — before personal data becomes available to that kind of foreign recipient. Because the mechanism is a general or special order rather than a Schedule fixed in the Rules themselves, what counts as a covered transfer, and what conditions attach to it, can change without amending the Act or the Rules.

What Rule 15 doesn't do

It's not a data-localisation mandate — nothing in Rule 15 requires personal data to stay physically inside India by default, and it doesn't prohibit ordinary use of global cloud infrastructure. It also isn't primarily a security or encryption standard — encryption and offshore storage don't by themselves satisfy Rule 15, because the rule is concerned with who ultimately gets access and under whose control, not merely with how the data is technically protected in transit or at rest.

Why this matters in practice

The practical implication is that a cross-border data-transfer decision is a policy question, answerable only by checking what the Central Government has actually specified, not a technical or contractual one that engineering or legal can resolve on their own by pointing to standard clauses or a vendor's compliance certifications. Transfers permitted today under Rule 15 can become conditioned tomorrow through a fresh government order, without any change to the Act's text — so a compliance posture built once and left unreviewed can drift out of step with a live restriction.

Illustration: a company uses a global analytics vendor whose backend is partly operated by an entity under a foreign State's control. If the Central Government has issued an order under Rule 15 specifying requirements for personal data reaching entities under that State's control, the company has to meet those requirements before that data flows to the vendor — regardless of whether its contract with the vendor already includes standard data-protection clauses, and regardless of where the vendor's servers are physically located.

How Rule 15 connects to the rest of the Rules and the Act

Section 16 of the Act is the enabling provision behind this whole area — it lets the Central Government restrict transfers of personal data to specified countries or territories outside India by notification. Rule 15 is a related but distinct mechanism: it addresses the government's power to condition data reaching a foreign State (or an entity under its control) specifically, through general or special orders, rather than a country-by-country restriction list. Read them together, not as duplicates, for the full picture of cross-border transfer risk. Rule 13(4) is a third, narrower piece — it applies only to Significant Data Fiduciaries and only to categories of data the government has separately specified for outright localisation.