Rules 15 and 13 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 15 allows personal data to be transferred outside India, subject to requirements the Central Government may specify by order for making the data available to a foreign State or its agencies. Rule 13(4) separately requires a Significant Data Fiduciary to keep data of a kind the Central Government specifies inside India.
Rules 13 and 15 are in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. Rule 15: personal data may be transferred outside India, subject to the Data Fiduciary meeting requirements the Central Government may specify by general or special order for making it available to a foreign State or entities under its control. Rule 13(4): a Significant Data Fiduciary must ensure that data specified by the Central Government on a committee's recommendation, and its traffic data, is not transferred outside India. No order or list is in the Rules.
The Act behind both rules
Section 16 of the Act allows transfer of personal data outside India except to countries the Central Government restricts by notification, and says that stricter laws on such transfer continue to apply. The Act's text is covered in Section 16 of the DPDP Act: transfer of personal data outside India. Rule 15 is the Rules' companion to that section. Rule 13(4) and (5) sit in the rule on Significant Data Fiduciary duties; see section 10 and our article on rule 13(1) to (3).
Rule 1(4) places rules 13 and 15 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. See rules 1 and 2.
Businesses with overseas cloud hosting, group companies or foreign vendors may need a legal consultation to map what the Rules do and do not say today.
Rule 15: transfer subject to requirements
"Any personal data processed by a Data Fiduciary under the Act may be transferred outside the territory of India subject to the restriction that the Data Fiduciary shall meet such requirements as the Central Government may, by general or special order, specify in respect of making such personal data available to any foreign State, or to any person or entity under the control of or any agency of such a State."
Read piece by piece:
| Element | Text |
|---|---|
| What may move | "Any personal data processed by a Data Fiduciary under the Act" |
| Where | "outside the territory of India" |
| The restriction | The Data Fiduciary "shall meet such requirements as the Central Government may, by general or special order, specify" |
| Which requirements | Those "in respect of making such personal data available to any foreign State, or to any person or entity under the control of or any agency of such a State" |
The rule is permissive in form: personal data "may be transferred". The restriction attaches to one situation, making the data available to a foreign State or to a person or entity under its control, or an agency of such a State. The requirements are whatever the Central Government specifies by general order (for all) or special order (for particular cases). No such order is in the Rules, so this article does not describe any requirement. Whether and when an order will be made is not stated; a business should check for orders before relying on a transfer.
What rule 15 does not do: it does not say that a transfer to a private overseas vendor needs any approval, and it does not list countries. It does not repeat or alter the Act's own treatment of transfers; for that, read the section 16 article. For older general reading, see cross-border data transfer under the DPDP Act, written before the Rules.
Example (invented): InvoiceHub, an accounting app, stores customer data on a cloud server in another country. Rule 15 does not stop that on its face. If the Central Government issues an order setting requirements for making such data available to a foreign State or its agencies, InvoiceHub must meet them for that kind of availability.
Rule 13(4): data that must stay in India
"A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India."
Four features:
- Who: only a Significant Data Fiduciary. Rule 15 applies to every Data Fiduciary.
- What data: "personal data specified by the Central Government", on a committee's recommendations. The specification is not in the Rules, so the category of data is not known from the text.
- What is restricted: the personal data "and the traffic data pertaining to its flow", which must not be "transferred outside the territory of India".
- What is required: "measures to ensure" the restriction, not just compliance after the fact.
Because no list of specified personal data is in the Rules, rule 13(4) has nothing to apply to on the text alone. Until the Central Government specifies data, it is a rule without a defined subject.
Rule 13(5): the committee
"In this rule, 'committee' means a committee constituted by the Central Government for the purpose of this rule, which shall include officials from the Ministry of Electronics and Technology and may include officials from other Ministries or Department of the Central Government."
The committee must include officials from that Ministry and may include officials from others. Drafting slip: the Ministry is printed as "the Ministry of Electronics and Technology", where "and Information" is missing; it is quoted as printed. The committee's recommendations are not in the Rules.
How rule 15 and rule 13(4) fit together
| Feature | Rule 15 | Rule 13(4) |
|---|---|---|
| Applies to | Every Data Fiduciary | A Significant Data Fiduciary |
| Effect | Transfer permitted, subject to Central Government requirements about making data available to a foreign State or its agencies | Specified data and its traffic data not to leave India |
| Depends on | A general or special order | A specification by the Central Government on a committee's recommendation |
| In the Rules | No order | No specified data; no recommendations |
If both apply, a Significant Data Fiduciary must keep specified data in India (rule 13(4)) and must meet any order requirements for other data it makes available to a foreign State or its agencies (rule 15). The Act's own statement that existing laws with higher protection continue to apply is explained in the section 16 article; the Rules do not alter it.
Neither rule states a penalty; see the Schedule to the Act. Later amendments, orders and notifications should be checked.
Need help with cross-border data flows?
Where your data sits, who can see it and under what contract are the facts that matter once any order is made. Speak to our legal team about mapping data flows and vendor contracts now.
Key takeaways
- Rules 13 and 15 start eighteen months after the date of publication of the Gazette (rule 1(4)).
- Rule 15: personal data may be transferred outside India, subject to Central Government requirements for making it available to a foreign State or its agencies.
- Rule 13(4): a Significant Data Fiduciary must ensure that data specified by the Central Government, and its traffic data, is not transferred outside India.
- No order under rule 15 and no specified data under rule 13(4) are in the Rules.
- Rule 13(5) says the committee includes officials of the Ministry of Electronics and Technology (as printed).
- Later amendments and notifications should be checked.
Read next
- Rule 13(1) to (3): impact assessment, audit and algorithm diligence
- Rule 6: reasonable security safeguards
- Section 16 of the DPDP Act: transfer of personal data outside India
- Cross-border data transfer under the DPDP Act
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.