Localization not to restrict cross-border data flow: IT secretary | Today News

New Delhi: Even as Big Tech continues to oppose India’s data localization rules, the Union government is pushing companies to have adequate data storage infrastructure in the country to ensure a “resilient internet”—one that can withstand global disruptions and maintain reliable connectivity.

The government’s push for adequate data storage facilities within the country is crucial for critical sectors to operate, S. Krishnan, secretary at the Union ministry of electronics and information technology (Meity), said at a gathering in Delhi on Friday.

“We are not saying there won’t be free flow of data. We have nothing against free flow of data,” Krishnan said, adding that the data storage capacity is needed to handle the growing amount of data, especially with the rise of artificial intelligence and AI computing.

In India’s draft Digital Personal Data Protection rules, consultation for which was wrapped up on 5 March, a clause dictates that significant data fiduciaries will need to comply with localization mandates for “specific” personal data. These mandates will be determined based on recommendations from a data protection committee, and will be approved by the Central government.

During the consultation on the draft DPDP rules, Big Tech companies such as Meta Platforms and Google’s India arms expressed concerns over a government-appointed committee overseeing cross-border data transfers.

“The committee-based approach is not in line with the DPDP Act. The same does not mention such a body. Introduction of a certain committee introduces unnecessary bureaucracy and regulatory overreach,” an executive at a Big Tech firm said, requesting anonymity.

“Demand for blanket localization of data involves complications in operation, as well as the cost involved with such a move. We have urged the government to take a more nuanced approach so that it makes for a uniform business environment,” added another Big Tech executive who is directly involved in India’s privacy law discussions.

Also read | Mint Explainer: The digital personal data protection Act, its rules, and roadblocks

Big Tech’s expectations: Some degree of tweaks

Section 16 of the DPDP Act allows the Centre to restrict data transfers to specific countries or territories via notifications. Further, the Act allows for the precedence of sector-specific rules—this means any existing law providing a higher degree of protection and restriction on data transfer will get precedence over the DPDP Act.

The Big Tech companies, however, argue that the draft rules go beyond this provision by imposing additional conditions.

Rohit Kumar, founding partner at policy think-tank The Quantum Hub, said a blanket localization mandate may not be feasible.

“What is prudent is to mandate localization of strategic sensitive data, keeping in mind that the current global standard of Mutual Legal Assistance Treaty may not be the most efficient route for India to access sensitive data of its own users from foreign locations. But, mandating a blanket data localization effort adds cost and operation burden, rather than just restricting free flow of data,” Kumar said.

He further added that sectoral localization has already been done successfully, and lends precedent for India to follow.

“The Reserve Bank already mandates localization of sensitive data in the interest of security of financial transactions. A similar format, if followed and maintained, makes for the best policy framework keeping both user privacy and ease of business in mind,” Kumar said.

A government official told Mint, requesting anonymity, that keeping sensitivities in mind, the data protection committee that is set to be formed soon will oversee data transfer restrictions on request of sectoral ministries, and will consult industry stakeholders before making its final recommendations.

Kumar, as well as the two Big Tech executives cited earlier, expect “some degree of tweaks” to the final set of rules that are expected to be notified within the next two to three months for the DPDP Act. For a smooth transition, the Centre is expected to allow a two-year timeframe for businesses to comply with the new law.