Data localisation concerns resurface as DPDP Rules allow govt to restrict overseas data transfers

India’s new Digital Personal Data Protection (DPDP) Rules, 2025 have revived industry concerns over data localisation, with experts warning that a key provision could introduce fresh uncertainty for global technology companies operating in India.

The rules, which officially operationalise the DPDP Act, 2023, empower the government to set up a committee that can decide which categories of personal data may not be transferred outside India. While the framework currently permits cross-border data flows, the possibility of future restrictions has…