Cross-Border Data Privacy Laws In The Global South
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
CROSS-BORDER DATA PRIVACY LAWS IN THE
GLOBAL SOUTH
Chayan Shree Upadhyay, LLM (IP), Amity University, Noida
ABSTRACT
As data becomes increasingly integral to economic and social functions, the Global South faces unique challenges in designing and implementing data protection regulations that meet both local and global demands. In recent years, numerous countries across Asia, Africa, and Latin America have enacted legislation to protect personal data, with India’s Digital Personal Data Protection Act of 2023 standing as a notable example. This paper examines key themes and insights from the 2023 Global Technology Summit (GTS) in New Delhi, where data protection regulation was a primary focus. The summit emphasized the importance of regionally harmonized governance frameworks to support developing countries in managing cross-border data flows and safeguarding individual privacy, while fostering economic growth.
A techno- legal approach was proposed as a viable pathway to achieving this harmonization, blending technical safeguards with legal structures to build adaptable, secure, and scalable frameworks. By exploring the perspectives and recommendations shared at the GTS, this paper provides an in-depth analysis of the challenges faced by the Global South in establishing effective data protection laws. It also offers potential strategies for ensuring these regulations align with global standards while addressing the specific needs of developing economies. This analysis aims to contribute to ongoing conversations around inclusive and equitable data governance in the digital age. Keywords: Data Protection, Global South, Cross-Border Data Flows, Digital Personal Data Protection Act (DPDP) 2023, Regional Harmonization, Techno- Legal Approach, Global Technology Summit (GTS).
CHAPTER 1:-
INTRODUCTION
In recent years, data regulation has become a central issue in the global policy landscape, driven by the rapid digitalization of economies and the increasing importance of data in both commercial and governmental activities. This is especially true for countries in the Global South, where data protection legislation has gained significant traction over the past decade. Many of these nations have enacted laws to safeguard personal data and assert sovereignty over their citizens' information. A recent milestone in this trend occurred in August 2023, when the Indian Parliament passed the Digital Personal Data Protection Act after more than five years of intense deliberation and public consultation. This legislation represents a pivotal step in India's approach to data governance, aiming to balance individual privacy rights with the needs of a growing digital economy.
The topic of data protection regulation was also a focal point at the 2023 Global Technology Summit (GTS), held in New Delhi, where representatives from developing countries gathered to discuss challenges and innovations in data governance. Discussions at the summit highlighted the unique perspectives of the Global South, with participants examining the complexities of designing and implementing data protection regulations that account for diverse economic, technological, and cultural contexts. Notably, participants proposed that regionally harmonized governance frameworks could serve as a viable model for the Global South, enabling countries to streamline data practices while ensuring that local needs are addressed. Furthermore, a techno-legal approach—integrating both technical and legal measures—was identified as essential to achieving harmonized data protection across borders.
This essay explores the deliberations from the 2023 GTS, examining the key insights and recommendations that emerged regarding data protection in the Global South. By analyzing these discussions, the essay aims to provide a nuanced understanding of the challenges, opportunities, and proposed pathways for developing countries as they navigate the evolving landscape of data regulation.
1.1 GLOBAL SIGNIFICANCE OF DATA PROTECTION AND
PRIVACY Data has become a critical economic asset in today’s digital age, fuelling industries such as ecommerce, artificial intelligence, and advertising. However, as data flows globally, concerns over privacy, security, and sovereignty have grown. The massive volume of personal data shared online raises risks related to unauthorized access, cyberattacks, and exploitation, which has led to an increased global focus on data protection. Privacy regulations, like the EU’s GDPR, have set global standards, prompting other nations, including those in the Global South, to adopt similar laws. The need to balance cross-border data flows with national security and privacy concerns has led to calls for regionally harmonized frameworks. These efforts aim to ensure that data is protected while enabling international business and innovation.
As such, data protection is not only a matter of individual rights but also of national sovereignty and global economic cooperation.
1.2 INDIA’S DIGITAL PERSONAL DATA PROTECTION ACT, 2023
India’s Digital Personal Data Protection Act, 2023 (DPDP)1 is a landmark piece of legislation aimed at safeguarding personal data and aligning with global data privacy standards. The Act's primary objective is to protect individuals’ privacy rights by regulating how personal data is collected, stored, processed, and shared by companies and organizations. It seeks to ensure transparency, accountability, and consent in data handling, while also empowering citizens with the right to access, correct, and delete their data. The DPDP Act is significant for India, as it establishes a comprehensive framework for data protection in a rapidly digitalizing economy. It also aims to promote trust in India’s digital services while ensuring that businesses can operate efficiently in the global market.
The Act’s provisions reflect global trends, particularly in the wake of the European Union’s GDPR, which has set a precedent for stringent data privacy regulations. The legislative process leading to the DPDP was long and contentious, spanning over five years of deliberations, multiple drafts, public consultations, and debates over data sovereignty, regulatory autonomy, and the balance between privacy and national security. The Act mirrors broader regional trends in the Global South, where countries are increasingly looking to implement data protection laws that address local challenges while harmonizing with international frameworks to facilitate cross-border data flows and digital trade.
1.3 LITERATURE REVIEW
“HOW BARRIERS TO CROSS-BORDER DATA FLOWS ARE SPREADING GLOBALLY, WHAT THEY COST, AND HOW TO ADDRESS THEM”2 This is an article by By Nigel Cory and Luke Dascoli analyses the Data localization measures have rapidly increased worldwide, with 62 countries now imposing 144 restrictions, compared to 35 countries in 2017. These policies significantly harm national economies by reducing trade, slowing productivity, and increasing prices for industries reliant on data. According to ITIF, stricter data restrictions can lead to a 7% reduction in trade output, a 2. 9% slowdown in productivity, and a 1. 5% rise in downstream prices over five years. Countries like China, Indonesia, Russia, and South Africa are the most restrictive, and while addressing legitimate data concerns is necessary, policymakers should explore alternatives to localization.
International collaboration is essential to maximize the benefits of a digital economy while maintaining open, rules-based trade. “CROSS-BORDER DATA POLICY: OPPORTUNITIES AND CHALLENGES”3 This is an article by Robert D. Atkinson & Nigel Cory analyses the Data governance and global digital data flows present significant challenges for international cooperation. To address these challenges, new global rules for data management are needed within the context of the post-World War II "rules-based" order. Countries committed to a global digital economy must collaborate to create these new frameworks. Currently, existing approaches have led to stagnation in internet governance, and China’s restrictive stance on data, AI, and digital trade risks isolating it from global discussions.
Many nations view China’s approach as self-serving and out of alignment with emerging global norms, making it crucial for China to revise its policies to play a more constructive role in shaping global digital rules.
1.4 STATEMENT OF PROBLEM
The Global South faces significant challenges in developing cross-border data privacy laws due to limited regulatory capacity, diverse legal systems, and concerns over national sovereignty. While data flows globally, these countries struggle to protect personal data and privacy while balancing economic growth and global trade needs. Existing international frameworks often overlook the region’s specific challenges. This paper examines how countries in the Global South can create effective, harmonized data privacy laws that safeguard citizens’ rights, promote economic growth, and foster international cooperation.
1.5 HYPOTHESIS
“The Global South can develop effective cross-border data privacy laws by strengthening regional frameworks and regulatory capacity. This will balance privacy protection, economic growth, and international cooperation”.
1.6 RESEARCH QUESTIONS
i. How can countries in the Global South develop effective cross-border data privacy laws that balance privacy protection and economic growth? ii. What are the challenges faced by developing countries in implementing data protection regulations while ensuring compliance with global standards? iii. How can regional cooperation and harmonization of data privacy laws help address data sovereignty concerns in the Global South?
1.7
RESEARCH
METHODOLOGY
The research work is conducted through Doctrinal research by relying upon secondary sources.
1.8 RESARCH
OBJECTIVES
i. To examine the challenges faced by countries in the Global South in developing and implementing cross-border data privacy laws. ii. To explore the potential for region-specific frameworks to harmonize data privacy regulations and balance privacy protection with economic development. iii. To analyse the role of international agreements and collaborations in shaping data governance and privacy laws in developing countries. iv. To assess how data sovereignty concerns can be addressed through regional cooperation and international partnerships in the Global South. v. To investigate strategies for aligning national data privacy regulations with global standards while respecting national sovereignty and facilitating cross-border data flows.
CHAPTER 2 :-REGIONAL
ANALYSIS
OF DATA PRIVACY LAWS
Comparative analysis
of data privacy laws in three major regions of the Global South—Asia, Africa, and Latin America—focusing on their approaches to regulating cross-border data flows. Each region has unique challenges, influences, and regulatory structures that shape how data privacy is handled both within their borders and across international boundaries. Asia: Asia's approach to data privacy is heavily influenced by economic powerhouses like China, India, and Japan, which are central to global trade and digital commerce. These countries often impose data localization requirements, demanding that certain types of data be stored within their borders to protect national security, privacy, and economic interests. The influence of these economic superpowers also affects how other Asian countries approach data protection and privacy.
Furthermore, there is an increasing push to harmonize data privacy laws with regional trade agreements, especially in the context of digital trade and e-commerce. These efforts aim to ensure that data privacy regulations do not hinder economic growth or cross-border trade while protecting consumers’ rights. However, the diversity of legal systems, from China’s strict data governance to India’s recent Digital Personal Data Protection Act, creates complex challenges for regional coordination. Africa: The growing presence of digital markets has made data protection regulations increasingly important, resulting in a significant rise in the number of African nations implementing data protection laws. By August 2020, 31 out of 55 African countries had passed such laws, with the majority having done so by 2019, although some are still not yet operational.
In South Africa, the Protection of Personal Information Act (POPIA)4 has seen both progress and setbacks since it was passed in 2013. The law officially came into effect on July 1, 2020, and covers various aspects of data protection, including regulations specific to South Africa. In July 2023, the country’s Information Regulator issued its first fine under POPIA, penalizing the Department of Justice and Constitutional Development (DoJ&CD)5 with a R5 million fine for breaching sections 19 and 22 of the Act due to data security failures. The regulator has taken steps to enforce data protection laws, such as launching public awareness campaigns, approving Codes of Conduct, and setting up an Enforcement Committee to address complaints.
However, challenges persist in effectively implementing POPIA, particularly with the DoJ&CD's failure to renew security licenses, leading to the exposure of around 1,200 files containing personal data. Additionally, the DoJ&CD missed a 31-day deadline to take corrective action after receiving an enforcement notice, highlighting issues with compliance and the enforcement process. Latin America: In Latin America, regional cooperation frameworks like the Organization of American States (OAS) play an important role in fostering collaboration on data privacy and cybersecurity issues. These frameworks aim to create regional standards for data protection while addressing concerns over cross-border data flows, privacy, and digital trade.
Latin American countries are increasingly aligning their privacy laws with global standards, especially in the context of trade agreements with North America (such as the USMCA) and Europe (such as the EU’s GDPR). 6 These agreements influence how countries like Brazil, Argentina, and Mexico regulate data privacy and facilitate international data transfers. Regional integration efforts are crucial in overcoming challenges related to the lack of cohesive data protection laws and ensuring that Latin American nations can benefit from global digital trade while protecting their citizens’ privacy rights. Each of these regions faces distinct challenges but shares a common goal: the need to develop effective, harmonized data privacy laws that protect individuals' rights while fostering international cooperation and economic growth.
Understanding these regional differences and strategies is crucial for building comprehensive frameworks for global data governance in the Global South.
CHAPTER 3:-
CHALLENGES
IN THE GLOBAL SOUTH Countries in the Global South face distinct challenges in establishing regulatory frameworks for privacy and data protection. One major issue is the lack of awareness about privacy concerns, compounded by the perception that regulatory authorities are aligned with government interests, which leads to a trust deficit. Another challenge is that economic growth in the digital age requires the free flow of data across borders, creating tension between economic needs and national security concerns. Even when data protection laws are established, enforcement becomes difficult as data protection authorities (DPAs) often struggle with limited resources and face the complexities of extraterritorial regulations. As a result, countries in the Global South need to develop a unique approach to data protection regulation that differs from the models in the Global North.
A key aspect of data protection legislation in the Global South should be not only regulation but also building a culture of privacy awareness. This will ensure better compliance with international regulations. Brazil’s approach offers a useful example, as its national data protection law came into effect in August 2020, but its data protection authority allowed a twelve-month grace period before enforcement began to help businesses and individuals familiarize themselves with the law. Policy makers in the Global South should also consider a balanced approach, combining stricter regulations, such as heavy penalties, with more flexible frameworks. 7 This balance would encourage cooperation between regulators and businesses while fostering innovation.
However, variations in data protection laws across countries can result in high compliance costs for businesses operating in multiple jurisdictions, potentially discouraging them from expanding into these markets. Harmonizing regulations within the Global South could help alleviate this issue. Despite its potential benefits, this proposal faces significant challenges. Establishing a common understanding of key concepts and definitions is difficult, as countries often have different priorities and national concerns. It is also essential to encourage collaboration among DPAs when implementing regulations.
CHAPTER 4:- INTERNATIONAL COOPERATION AND INFLUENCE
OF GLOBAL STANDARDS At the Global Technology Summit (GTS), there was a significant emphasis on the importance of international data privacy standards, particularly the General Data Protection Regulation (GDPR) of the European Union, which has set a global precedent for data protection laws. The GDPR, which came into effect in 2018,8 is often seen as the most comprehensive framework for data protection, with its robust requirements for consent, transparency, and accountability regarding personal data9 processing. As such, it has influenced data protection laws in many countries and regions, encouraging them to implement similar standards to enhance privacy and security for individuals. However, for countries in the Global South, there is a delicate balancing act when it comes to adopting such international frameworks.
These nations face specific challenges, such as limited regulatory capacity, insufficient technological infrastructure, and economic concerns that may conflict with strict data protection measures. While aligning with global standards like the GDPR is essential for ensuring international trade and digital cooperation, these countries must also tailor their regulations to address domestic priorities, such as economic development, cultural values, and unique legal contexts. One of the main dilemmas faced by the Global South is the potential economic impact of stringent data protection laws. For instance, countries may fear that stringent compliance with international standards will impose high costs on businesses, particularly small and medium-sized enterprises (SMEs). This could discourage foreign investment and limit the growth of the digital economy.
Additionally, the local context in many developing countries might require different approaches to data privacy, as they face varying levels of digital literacy, access to technology, and public awareness about privacy risks. The summit proposed that the Global South should not only adopt international standards but also actively shape them. By engaging in international dialogues, forming alliances, and participating in the development of global frameworks, these countries can ensure that data governance systems respect their unique social, economic, and cultural circumstances. This would allow for the creation of a more inclusive and representative global data governance structure that is fairer and more equitable for all regions.
For instance, the African Union's Convention on Cyber Security and Personal Data Protection aims to create a unified approach to data protection across the continent while accounting for the specific needs of African nations. Similarly, countries like Brazil have adopted regulations like the General Data Protection Law (LGPD), which, while inspired by the GDPR, was tailored to fit the local context of Brazil’s digital ecosystem. Furthermore, international cooperation and knowledge-sharing are vital for capacity building in the Global South. This cooperation can involve sharing best practices, offering technical assistance, and creating networks for regulators to collaborate on cross-border data issues.
By participating in shaping these global standards, developing countries can ensure that their concerns are addressed while also benefiting from a standardized approach to data protection that facilitates global trade, digital innovation, and cross-border cooperation. In conclusion, for countries in the Global South to benefit from global data privacy standards, they must not only adapt to these frameworks but also take an active role in shaping them, ensuring that these standards reflect the unique needs and challenges of developing regions. Such active participation will help in creating more balanced and sustainable data governance policies that support both global digital growth and local development.
CHAPTER 5:-CONCLUSION: A PATH FORWARD
The Global Technology Summit highlighted the importance of a balanced, inclusive approach to data protection, especially for the Global South, where countries face distinct challenges related to technological capacity, regulatory infrastructure, and economic needs. As data has become a foundational element of economic development and international trade, developing countries are at a crucial juncture where they must navigate between protecting individual privacy rights and enabling data-driven economic growth. The summit’s advocacy for a regionally harmonized and techno-legal approach offers a promising path for these nations. This model allows countries to set common data protection standards tailored to regional contexts while still aligning with global frameworks like the GDPR.
It enables flexibility in regulation that can evolve with changing technological advancements and socio-economic conditions. Additionally, a techno-legal strategy—which involves both regulatory and technical safeguards—addresses concerns around enforcement capabilities by building systems that can ensure compliance with data protection laws even in resource-constrained settings. Benefits of Regional Cooperation and Harmonization The push for regional cooperation is particularly vital for the Global South, as neighboring countries often face similar challenges and market needs. By establishing shared standards for data governance, countries can promote seamless cross-border data flows within the region, which is crucial for trade, innovation, and economic collaboration.
This reduces the regulatory fragmentation that can burden businesses operating in multiple jurisdictions and offers a stronger, unified stance in global negotiations on data privacy standards. Role of the International Community The international community’s role remains essential in helping developing countries implement robust data governance frameworks. Technical assistance, capacity-building programs, and financial resources from international organizations and developed nations could empower the Global South to build data protection systems that are both secure and fair. This collaborative approach also supports knowledge-sharing on best practices and emerging challenges, fostering an environment where data protection frameworks are continually improved and adapted to new risks.
Future Pathways for Data Governance Looking ahead, the Global South’s journey toward effective data governance will likely involve a blend of local innovation and global cooperation. Data protection strategies will need to stay agile, adapting to the rapid pace of technological change, while maintaining focus on digital inclusion, transparency, and accountability. As these countries continue to develop their own models of data protection that resonate with their unique cultural, economic, and social landscapes, they contribute valuable perspectives that can help shape a more equitable global data economy.
BIBLIOGRAPHY
https://www.cigionline.org/articles/global-standards-digital-cooperation https://www.cliffedekkerhofmeyr.com/news/publications/2023/Sectors/CorporateInv/corpo rate-and-white-collar-investigations-alert-13-july-2023-protection-of-personal-informationact#:~:text=After%20being%20issued%20with%20an,administrative%20fine%20of%20R5% 20million https://digitaltradelaw.ch/wp-content/uploads/2023/04/Burri_Cross-Border-Data-Flowsand-Privacy-in-Global-Trade-Law_Has-Trade-Trumped-Data-Protection.pdf https://itif.org/publications/2021/07/19/how-barriers-cross-border-data-flows-arespreading-globally-what-they-cost/
4. https://medium.com/illumination/data-protection-laws-in-the-global-south-7d5b636c011b
5. https://carnegieendowment.org/posts/2024/02/data-protection-regulation-in-the-globalsouth?lang=en
6. https://medium.com/illumination/data-protection-laws-in-the-global-south-7d5b636c011b