Cross-Border Data Transfers And Data Localization Under India’s DPDPA 2023 - A Comparative Analysis With EU-GDPR
Author: LawSphereX
Category: General Law
Published:
Updated:
CROSS-BORDER DATA TRANSFERS AND DATA
LOCALIZATION UNDER INDIA’S DPDPA 2023: A
COMPARATIVE
ANALYSIS
WITH EU-GDPR Ganga. V. Chitti, LLM IPL, CHRIST (Deemed to be University), Bengaluru
ABSTRACT
This paper comparatively explores the data cross-border transfer regulations of India's Digital Personal Data Protection Act, 2023 and the European Union's General Data Protection Regulation. In this respect, the paper articulates legal frameworks that inter-alia compares some of the essential commonalities, such as data protection and consent, and some significant differences between these two, like the structured approach via adequacy decisions and Standard Contractual Clauses (SCCs) in contrast to the "blacklist" approach by the government of India under the DPDPA. This analysis is supported by case studies that will illustrate some practical challenges organisations face in trying to comply with these regulations. Findings emerge as a call for harmonised data protection and compliance strategy standards.
The paper concludes that while organisations familiar with GDPR have a foundational advantage, substantial adjustments will be required to deal with the specific requirements that DPDPA calls for, especially on consent frameworks and reporting breaches. Keywords: Cross-border data transfers, Digital Personal Data Protection Act of 2023 (DPDPA), General Data Protection Regulation of the European Union (GDPR), Data localisation, Compliance challenges, Cross-border data protection.
1 INTRODUCTION
Data has emerged as the new currency of the digital economy, a world that, in allowing economic growth, technological innovation, and international trade, has unfettered these three principal economic development factors. With data usage on the rise across industries, there is a growing demand for strict legal frameworks governing data flows within specific contexts of cross-border data transfer and data localisation. Indeed, diversified approaches take the central stage that the global discourse on data protection warrants DPDPA 2023 of India and the GDPR of the European Union to assume cardinal regulations in reshaping the panorama of global data governance. The DPDPA 2023 would be a milestone in India's journey towards adopting international data protection standards and even towards GDPR.
One of the critical points emerging from this Act is its focus on the localisation of data - storing personal data within the borders of India. A real contrast to this is GDPR, which is stringent in protection but still allows cross-border data transfers under certain conditions. Such divergent regulatory regimes correspond to distinctive socio-economic and geopolitical contexts, adding to the challenge of balancing data sovereignty with global demand in digital trade. There has been a substantive focus on global norms on data protection. Yet, there is an angle where how divergent approaches by DPDPA 2023 and GDPR to cross-border data transfer and localisation impact international data governance remains incomplete.
Although GDPR was, de facto, a global standard, the implications of India's present data protection regime, more so its focus on data localisation, have primarily gone untested. This paper fills this vacuum by conducting comparative analyses of the DPDPA 2023 and the GDPR from the perspectives of their cross-border transfer and data localisation schemes. This study is essential in guiding policy and business decisions regarding the practice of law in the increasingly complex data protection landscape of countries worldwide. By analysing the strengths and weaknesses of the DPDPA 2023 and GDPR, this paper contributes to the knowledge base of cross-border data governance challenges and opportunities.
It is for this reason that the paper embarked on the exercise of critically analysing these regulatory frameworks to provide insights toward further informing the policy development in such a manner as to ensure balanced data protection practice in supporting national security and global digital trade.
2 OVERVIEW OF DPDPA 2023
The data protection laws of India would go back to its landmark Supreme Court case of K. S. Puttaswamy v. Union of India,1 when the court held that the right to privacy is a fundamental right under the Indian Constitution, the judgment also marked a watershed moment, calling for urgent, holistic data protection legislation in India. The Indian government came up with the Personal Data Protection Bill of 2019, which incidentally tried to address privacy concerns in light of the Puttaswamy case. The bill was extensively discussed, and several versions were brought into the fray over feedback from stakeholders. It was also made compatible with international standards for data protection. Ultimately, it became DPDPA 2023, integrating all the amendments and providing new provisions to address data protection challenges in the contemporary context.
Data localisation:2 In many ways, it could be said that some key subprovisions encapsulate the intent behind this legislation, with a view of balancing data protection with the needs of a global digital economy. The DPDPA 2023 thereby offers an aptly suited data protection structure in India, with a particular focus on cross-border data transfers and data localisation. Section 16 of the Act thereby requires that personal data be stored in India, which signifies an emphasis by the government on data localisation to maintain higher control and security over the data. This provision reduces the danger and threat of international data breaches and enhances the effectiveness of data protection laws. The DPDPA 2023 defined data fiduciaries' and principals' roles and responsibilities.
The Act, 3 Data fiduciaries must have observant requirements in data protection, such as explicit consent from data principals, transparent data protection activities, and adequate security measures for their data. 4 Another requirement of the data fiduciaries is the obligation to perform their respective duties under the Act, including conformity with the data protection principles and fulfilling the requests for data access or correction. Data principals- or persons whose data is being processed- were granted various rights under the Act, including the right to consent,
1 K.S. Puttaswamy (Privacy-9J.) v. Union of India, (2017) 10 SCC 1
2 Digital Personal Data Protection Act, No. 30 of 2023, § 16
3 Ibid § 5
4 'India’s Digital Personal Data Protection Act 2023 vs. the GDPR: A Comparison' (December 2023).
access, correction, and deletion of personal data. These provisions reflect the commitment of the Act towards both accountability and individual privacy, which embodies international data protection norms but simultaneously caters to India's specific regulatory needs.
3 CROSS-BORDER DATA TRANSFERS
3.1 What are Cross-Border Data Transfers?
The term cross-border data transfer refers to the international movement of personal data, which gives room for physical and virtual transboundary transmission of information across two countries whose jurisdiction it falls under. This forms the core of global business and communication, where companies can undertake ventures across regions without even noticing the crossing of boundaries. However, it also runs in parallel with the complexity of legal and regulatory intricacies due to differences in data protection and privacy legislation across regions. Businesses have to grow their understanding of cross-border data transfers to navigate diverse regulatory frameworks while ensuring personal data protection and the delivery of their global operations.
3.2 Relevance to Global Economy
Cross-border data transfer will develop international trade and boost the world's economies. Free-flowing data is the best part of the digital economy as it keeps business ventures alive in the fast-increasing global changes. Access and sharing of information through transfers enhance customer service through understanding the behaviour of the customers, data analytics, and strategic decisions.5 As industries are evolving to more pronounced levels of digitalisation, effective and safe cross-border data flows henceforth become essential for organisations in order for them to be empowered so as to remain agile and competitive in their respective markets.
3.3 Cross-Border Data Transfers Obstacles
Cross-border data transfers are essential. However, there are several obstacles that organisations need to navigate through in order to accomplish this process successfully. Probably the most significant obstacle would be the compliance requirements of a plethora of 5 MG Kodandaram, Inadequacies in the Digital Personal Data Protection Act, 2023, Tax India Online (2023). data protection laws prevalent around the world. Other risks in international data transfer involve the complexity of seeking the required consent and the conduct of Data Protection Impact Assessments (DPIAs),6 Especially if an organisation's country has stricter requirements on data localisation, a data breach or cyber-attack is also a risk in international data transfer. Hence, appropriate security measures and norms for data protection are inevitable when transferring sensitive data across borders.
Organisations must respond to the changing landscape of regulations and take suitable security measures with respect to operation efficiency while trying to maintain customer trust under the increasing complexity of rules.
4 CROSS-BORDER DATA TRANSFERS UNDER INDIA'S DPDPA 2023
4.1 Legal Framework
for Data Transfers: India's Digital Personal Data Protection Act (DPDPA) of 2023 provides a robust legal framework for cross-border data transfers. By balancing the protection of personal data against the facilitation of international trade and the exchange of data, this legislation ensures that personal data is processed in accordance with the standards of data protection and respecting the rights of individuals concerning their privacy.7 This framework reflects a paradigmatic shift in the approach India would undertake towards data handling; it would align well with global trends on data protection that stress the imperative to protect personal information within the digital economy.
4.2 Conditions and Limitations of Cross-Border Transfers
While the DPDPA allows cross-border transfers under this act, it is left to the discretion of the government of India to impose restrictions for transferring data to specific countries. Organisations have to be vigilant enough to make sure they transfer data only to those jurisdictions that are perceived to be safe, as decreed by the government. The government can inform organisations about such restrictions so that their personal data can be transferred to countries with adequate levels of protection. The Act, therefore, provides for additional regulations that will specify the particular criteria and procedures whereby such restrictions
6 Art.35 of the General Data Protection Regulation (E.U Regulation)
7 Rahul Matthan and Shreya Ramman, Top 10 Operational Impacts of India’s DPDPA – Cross-Border Data
Transfers, (October 2023). will come into effect so that organisations know precisely what to expect in terms of compliance standards.
4.3 Role of the Government in Cross-Border Data Transfer Regulations
The role of the Indian government is essential since it centralises oversight and regulation of cross-border data transfers under the DPDPA. Indeed, the Indian government would take responsibility for evaluating the adequacy of standards regarding the protection of data in foreign countries, which means establishing whether personal data may be transferred into such countries. On the other hand, the government may also declare other organisations as Significant Data Fiduciaries (SDFs),8 And they shall have more obligations to protect personal data appropriately. Such regulatory protection further gives a structured framework for compliance that ensures organisations that may be transferring data outside a country are responsible and meet the marked high standards required for data protection as contained in the DPDPA.
4.4 Organizations Compliance Obligations
The organisations involved in cross-border data transfers under the DPDPA have some strict compliance obligations. 9 These will include developing a broad data transfer policy that articulates and spells out how personal data will be treated as it is moved between countries. Data fiduciaries must also invest in privacy-enhancing technologies, conduct compliance audits regularly, and respect the data subjects' rights throughout the transfer process. Those organisations that fall under the Significant Data Fiduciaries will have to present a Data Protection Officer (DPO)10 The DPIAs should also start the procedures when they develop high-risk processing activities so that potential risks posed by the cross-border data transfer can be recognised and addressed.
These requirements emphasise the need for robust data governance, and for that reason, organisations have to remain aware of the changes in regulations so that they can adhere to the requirements.
8 Section 2(z) and Section 10 of the Digital Personal Data Protection Act, 2023
9 Mehreen Imtiaz and Deepika Prakash, Comparative Analysis of the Digital Personal Data Protection Act of India 2023 and GDPR, (2024).
10 Section 2(l) and Section 10(2) of the Digital Personal Data Protection Act, 2023
5 CROSS-BORDER DATA TRANSFERS UNDER GDPR
5.1 Legal Basis for Data Transfers:
thereto based on the evolving nature of the regulations or the regulatory environment. Under the General Data Protection Regulation, organisations are requested to ensure an appropriate legal basis before transferring personal data outside the jurisdiction of the European Union. The GDPR stipulates several bases for legitimacy, of which the most fundamental basis would be explicit consent,11 This, in this case, involves obtaining explicit and informed consent from the data subject for transferring their data, keeping fully aware of the risks that will be involved. The other basis would be contractual necessity, whereby the transfer of data is necessary for the provision of goods or services offered in a contract with the data subject.
The GDPR also allows for adequacy decisions made by the European Commission, as a third country has adopted protections deemed to be at least comparable to those found in the EU. 12 Such countries may thus make transfers without having to adopt additional safeguards.
5.2 Adequacy Decisions and Appropriate Safeguards
The GDPR allows for adequate transfers if there is an adequacy decision from the European Commission, ensuring that the third country has a level of data protection comparable to that in the EU. Countries such as Canada, Japan, and the UK have received decisions like this, thereby allowing smooth transfers of data and not requiring any added measures for the protection of that data. In other countries, the GDPR requires organisations to apply "appropriate safeguards" when transferring personal data from those countries. SCCs 13 Refer to standard contractual clauses set out by the European Commission. These are standardised contractual provisions approved in advance that safeguard the adherence to the standards of protection of the EU in all steps related to the transfer.
BCRs,14 On the other hand, it stands for binding corporate rules laid down by international groups of enterprises to facilitate crossborder transfers within their corporate group.
11 Art.7 of the General Data Protection Regulation (E.U Regulation)
12 Sonali Srivastava, Decrypting Critical Concepts under India's Digital Personal Data Protection Act, 2023 and Comparison with GDPR and PIPL, Indian J. L. & Tech.7,11 (2023).
13 Art.46 of the General Data Protection Regulation
14 Ibid
5.3 Specific Derogations for Specific Situations
The GDPR also provides particular derogations where cross-border data transfers may be allowed where adequate protection cannot be guaranteed. Explicit consent or consent is one of the derogations. In such a derogation, the data subject consents to the transfer after being informed of any applicable risks. Other derogation applies when the transfer is necessary for the performance of a contract. This includes the performance of the controller's obligations under such an agreement entered into with the data subject. Public interest is also a valid justification. This derivation happens when the transfer is necessary for reasons of a significant public interest. One of the justifications would include an example of international cooperation between regulatory authorities and other bodies dealing with matters of national security.
Derogations are also relevant in case of the transfer, if it is for court procedures or legal disputes, including defence, so that same ensures access to cross-border legal remedies.
5.4 Organisation's Obligations of Compliance
Organisations dealing with cross-border data transfer under the General Data Protection Regulation shall have obligations to comply precisely with the protection of personal data. Specific records of such transfer of data shall be kept. The legal basis of transferring the data on which bases countries are involved and the safeguards maintained during transfer must also be specified. Organisations need to carry out DPIAs in order to assess and mitigate the possible risks to the rights and freedoms of the data subjects when processing activities pose significant dangers to those rights and freedoms. 15 It should be determined to be adequate in terms of the level of protection through robust technical and organisational measures, such as but not limited to technical protection of data by way of encryption and access controls.
Moreover, organisations shall, from time to time, inspect and audit their transfers of data to ensure at any given time that they comply with the GDPR and make appropriate adjustments
6 LOCALISATION OF DATA
6.1 Data Localization under India's DPDPA 2023:
India’s Digital Personal Data Protection Act (DPDPA) of 2023 mandates specific requirements
15 Mohamamduzef Diwan, A Comparative Analysis of GDPR and DPDP Act, VI(IV), Indian J. L. & Legal
Res. 15,18, (2023). on localisation and specified conditions for the storing and processing of personal information. Although the DPDPA does not uniformly impose mandates across all sectors toward broad, uniform data localisation, it retains the authority of the central government to develop an approved list of countries from which transfers of personal data are prohibited. 16 Such reflects an evolving position on the international exchange of data, one that would balance data protection with global commerce. 17 The statute also acknowledges that sector-specific rules already in place necessitate the storage of data in a jurisdiction for the purposes of observation of domestic law. DPDPA sector-specific localisation requirements are an addendum to the general provision of the law.
For instance, RBI insisted on localisation of holding payment data, which also entails storing the transaction reports and details of customers in India. Similarly, in other sectors like telecommunications and health services, there are requirements for localising data storage. Therefore, such organisations must adapt to specific needs in such sectors if they are going to adhere to regulations and also provide security to any information that happens to be sensitive. These industry-specific requirements even require businesses to amalgamate local data handling habits with their operational systems. Data localisation requirements under the DPDPA pose opportunities and challenges for businesses and data fiduciaries.
On the one hand, operational costs may be more to satisfy these localisation requirements because companies are going to invest in local infrastructure and data centres to achieve this goal. On the other hand, the requirements will strengthen consumer trust among the Indian users who today have much more concern over data security and privacy. Such a demonstration of good faith to protect personal data and compliance with local regulations will strengthen the market position for businesses and spur more investment in local data infrastructure.
6.2 Data Localization under GDPR
The GDPR addresses the questions of localisation differently. It has no specific localisation requirement but underlines providing protection whenever there is cross-border data transfer. It supervises the transborder data flows, focusing on protection at the maximum levels of
16 Section 16 of Digital Personal Data Protection Act, 2023
17 Khilansha Mukhija, & Shreyas Jaiswal, Digital Personal Data Protection Act 2023 in light of the European Union's GDPR, 4(1), Jus Corpus Law Journal, 638-649, (2023). restriction. The GDPR does not require any organisation to store its data within the EU. However, it provides for clear regulations in cases of the transfer of personal data both out of and into the European Economic Area (EEA), ensuring there is adequate protection. The organisations may transfer their data to third countries, which lie outside of the EU, and this is allowed only when the country of destination assures that an adequate level of protection equivalent to that of the EU is ensured with the adequacy decisions of the European Commission or through appropriate safeguards like SCCs and BCRs. 18 It allows flexibility in worldwide operations yet ensures alignment with standards in GDPR.
Even though the GDPR does not have an express requirement for data localisation, strict data transfer rules under the GDPR indirectly implement data localisation. It is the flexibility that the GDPR afforded that also gives organisations an opportunity to function on an international level simultaneously while demanding that organisations install more stringent data protection practices to prevent risks posed by weaker privacy laws of recipient countries. 19 Therefore, organisations should focus on robust data protection measures and regularly evaluate the sufficiency of data protection measures in third countries.
7 COMPARISON OF CROSS-BORDER DATA TRANSFERS
7.1 DPDPA vs. GDPR:
The Digital Personal Data Protection Act of 2023 and the General Data Protection Regulation have the same ultimate goal, i. e. , to regulate cross-border data transfer and safeguard the data. Both frameworks support the requirement of the standard of privacy with the protection of rights regarding the processing of personal data in transfers from one country to another. In addition, two versions of DPDPA and GDPR require an organisation to obtain explicit consent from data subjects when such transfers are involved, in which the types of usage need to be communicated and agreed upon by individuals. Both laws also confer vast rights to the data subjects, which include the right to access and correct their personal data. Both laws bind the organisations such that adequate measures are taken so that personal data is protected while it is being transferred between parties.
Thus, data remains safe from unauthorised access or 18 JP Meltzer, Balancing Commitments to Cross-Border Data Flows with Domestic Regulation in The Elgar Companion to the World Trade Organization 227, 231 (Edward Elgar Publishing 2023).
19 Ibid
breaches.
7.2 Differences in Legal Framework
Though both serve the purpose of aiming to promote cross-border data transfers, there are fundamental differences between these two legal frameworks of DPDPA and GDPR. This framework is applied by the GDPR to determine the transfer of personal data outside the Union, such as inadequacy decisions, SCCs, BCRs, and specific derogations. Thus, personal data may be protected just like in the case of the EU territory. For the DPDPA, most countries will allow transfers without restrictions, while transfers to countries on the blocklist shall be banned considering the fact that the government retains it. This involves more lenient international data flows. In addition, the GDPR serves to bind all entities to strict compliance requirements that oblige very detailed documentation as well as regular reviews on data protection.
20 In contrast, the DPDPA puts more emphasis on the ease of international data transfer and imposes some measures to make it secure but does not have strict requirements for such transfer. Secondly, although the GDPR has uniform applicability across sectors, the DPDPA accommodates sectorspecific localisation requirements that consequently affect how organisations operating in specific sectors will handle data.
7.3 Impact on International Business Operations
DPDPA and GDPR have significant implications for international operations as the two pieces of law differ. Businesses that are active both in India and the EU would have to navigate two competing paradigms of regulation that may raise compliance costs and operational complexity. 21 The adjustment with disparate data transfer and protection requirements further exposes the complexity of business practice and demands new investment to improve data infrastructure and security. Hence, future localisation requirements are likely to challenge Indian businesses. Clear data protection standards under the GDPR will further limit companies' access to the EU markets until their processes align with such new standards.
Data management strategies must be conceived in line with both regulations to strike a balance between one's regulatory compliance with the requirements of maintaining consumers' 20 Kermina Minoo Patel, The 2023 Digital Personal Data Protection Act: Evaluating its Strength in Protecting Citizen Data, 4(1), Jus Corpus Law Journal [234],(2023).
21 Supra at 5
confidence and operations performance across geographies.
8 CASES
8.1 Cases on cross-border issues under DPDPA 2023:
India's Digital Personal Data Protection Act of 2023 brought many new challenges for businesses dealing with cross-border data transfers. A multinational company could operate in India and may be required to send customers' data to an analytics centre at a global location. However, the transfer could be initiated only if the government did not block the destination country. The requirement would become a significant operational constraint as businesses would always need to be updated about changes on the blocklist to be compliant with them. As per RBI's 2018 Circular on Storage of Payment System Data, payment-related data should be stored only in India. 22 For instance, an enterprise such as HSBC, which wishes to have global analytics to penetrate the banking and financial sectors, must comply with the rules and regulations under DPDPA along with RBI to have local centres.
This is another complex case of data governance management against various legal compliance and operational efficiency.
8.2 Cases on Cross-Border Issues under GDPR
Perhaps the most pertinent challenge to transfers of data from the EU to the U.S. after the invalidation of the Privacy Shield framework is the case of Schrems II Case: Data Protection Commissioner v. Facebook Ireland Ltd., 23 Such transfers should lead to adequate protections when transferred to those countries below the standards of the European Union as it further espouses the importance of more in-depth compliance measures. Major technology companies such as Google and Apple, are adopting differential privacy techniques to comply with GDPR in managing cross-border data operations. Differential privacy relates to anonymising user data so that trends can be analysed without compromising privacy individuality.24 This will support in achieving compliance requirements for GDPR and
22 Ibid
23 C-362/14, Schrems v. Data Prot. Comm'r, 2015 E.C.R. 650
24 MG Kodandaram, India's Privacy Journey - Two Steps Forward, Three Steps Back, Tax India Online, (2023). increase customer trust as one can balance operational needs with privacy protection in businesses. These examples reveal the challenges and complexities that organisations face regarding the regulation of cross-border transfers of data both under DPDPA and GDPR. This puts a seal on such an effort toward more proactive compliance measures and the deployment of new technologies for the control and handling of cross-border data flows.
9 CONCLUSION
So, while studying India's Digital Personal Data Protection Act 2023 and the General Data Protection Regulation of the European Union in a comparative way, it has been found that something complex hails from this entire legal framework related to protecting personal data. Two of these have not only laid great emphasis on the protection of individual rights but have also spoken to organisations about the very stringent implementation of measures for data protection. However, because precise enforcement mechanisms exist in adequacy decisions and contractual protections, DPDPA relies more on a state-centric approach to restrictions of data transfers, especially to blocked countries. In addition, court judgments such as Schrems II demonstrate how fluid transborder data protection and privacy are.
With the dynamic nature of data privacy concerns coupled with its governance frameworks, there is a need for flexible, forward-looking policies in data protection. This introduces an additional layer of sophistication in how organisations react to complexity in the regulatory environment, which involves differentiated requirements across jurisdictions and sectorspecific regulations with data localisation. Future data protection policies should be designed in a manner that the regulatory bodies of the world can collaborate as co-owners to generate standardised guidelines that, at the same time, promote data protection and the free flow of information. Organisations must proactively address their data privacy policies if they want to remain compliant and prevent the misuse of this sensitive information.
To do that, they should first know DPDPA and GDPR and understand the compliance needs of both organisations. Invest in sound data governance frameworks with policies on data localisation and transfer while ensuring that they implement appropriate technical safeguards, such as encryption and access control. Educating and sensitising employees to the good practice of data protection will also help establish a culture of compliance and develop trust with their consumers. Ultimately, these recommendations would prove to assist organisations in mitigating risks and making better use of building reputation along with effective compliance with the fast-changing landscape of data protection regulations.
REFERENCES:
1. Khilansha Mukhija, & Shreyas Jaiswal, Digital Personal Data Protection Act 2023 in light of
the European Union's GDPR, 4(1) Jus Corpus Law Journal, 638-649, (2023).
2. MG Kodandaram, Inadequacies in the Digital Personal Data Protection Act, 2023, Tax India
Online, (2023).
3. MG Kodandaram, India's Privacy Journey - Two Steps Forward, Three Steps Back, Tax India
Online, (2023).
4. Mohamamduzef Diwan, A Comparative Analysis of GDPR and DPDP Act, VI(IV), Indian
Journal of Law and Legal Research, (2023).
5. JP Meltzer, Balancing Commitments to Cross-Border Data Flows with Domestic Regulation in
The Elgar Companion to the World Trade Organization (Edward Elgar Publishing 2023).
6 Kermina Minoo Patel, The 2023 Digital Personal Data Protection Act
Evaluating its Strength in Protecting Citizen Data, 4(1), Jus Corpus Law Journal [234], (2023).
7. Sonali Srivastava, Decrypting Critical Concepts under India's Digital Personal Data
Protection Act, 2023 and Comparison with GDPR and PIPL, Indian Journal of Law and Technology,(2023).
8 India’s Digital Personal Data Protection Act 2023 vs. the GDPR
A Comparison (December 2023).
9. Mehreen Imtiaz and Deepika Prakash, Comparative Analysis of the Digital Personal Data
Protection Act of India 2023 and GDPR, (2024).
10. Rahul Matthan and Shreya Ramman, Top 10 Operational Impacts of India’s DPDPA – Cross-
Border Data Transfers, (October 2023).