Can personal data be transferred outside India?

Generally yes, subject to restriction. The Act permits transfer of personal data outside India except to countries or territories that the Central Government restricts by notification. This is a negative list approach rather than the adequacy model used in some jurisdictions, and it is more permissive than earlier draft bills. However, and this catches organisations out, sectoral localisation requirements continue to operate independently of the Act and are often stricter. Payment system data must be stored in India under RBI requirements, and securities, insurance and telecom regulators impose their own record location and localisation conditions. Health sector guidance similarly discourages transferring health data abroad. The DPDP position is the floor, not the ceiling.