Industry seeks clarity on cross-border data flows under new data protection bill

Industry bodies and startups have been pushing the government for clarifications on cross border data flow rules detailed under the new Digital Personal Data Protection (DPDP) bill. The bill, a draft of which was released on November 18, allows firms to store data from Indian users in “trusted” jurisdictions. However, the government has said that it will notify a list of countries where data can be stored.

The industry has been seeking more clarity on how trusted countries will be defined by the Ministry of Electronics and Information Technology (MeitY) and when they will be notified, multiple sources told Mint. They have also asked for a framework to ensure data flows freely across borders. Some have proposed that instead of coming up with a trusted list, the country should provide a list of countries where Indian data can’t be stored.

Last week, industry leaders led by NASSCOM also met the Information Technology, Electronics, and Communications Minister Ashwini Vaishnaw to share their viewpoint on the revised bill. In a statement afterwards, the industry body said that the IT Minister clarified to it that “the government will ensure that the approach focuses on strengthening data protection without disrupting data flows”.

According to a person aware of developments, the IT Minister said the government will work out a detailed framework for notifying in which countries data can be stored.

The first draft of the DPDB Bill is currently open for consultation, with submissions from the industry to close on December 17. Two industry executives aware of developments said that the bill is expected to be tabled at the Budget session of the Parliament in April, and should be passed at best by the monsoon session next year.

“In the interim, until the Bill is passed in Parliament, it would be great if the government could bring some clarifications. These would include a standardized procedure to be followed to identify and notify countries to which the data could flow such that the free flow of data can be enabled with countries that share a positive relationship in trade, investments, etc already,” said Kazim Rizvi, founding director of The Dialogue, a Delhi-based public policy think tank.

The DPDB Bill replaces the PDP Bill of 2019, which was withdrawn in August after a joint parliamentary committee (JPC) raised several concerns about it and asked for sweeping amendments. The new bill’s stance on cross-border data flow marks a significant departure from the previous bill which requires personal data of Indian users to be stored within the country. 

Rizvi pointed out that the uncertainty about the terms of notifying countries could make businesses restrictive in terms of establishing relationships with foreign countries due to anticipation. “It is essential that the government provides some processes on the standards and procedures to be followed to notify countries where data can flow so that business can evaluate the countries using the parameters,” he added.

Despite these concerns, the industry at large has appreciated the new bill and the relaxation of cross border data flow rules. “Cross-border data flow within trusted jurisdictions will allow for a free and fair digital economy to be formed. It will allow SMBs to compete with larger players on a more even footing than before and empower them,” said Vinod Kumar, president of India SME Forum.