A report in Times of India indicates that the government aims to introduce a nuanced data localisation requirement in its proposed Data Protection Bill. “Sensitive” personal data of Indian users will have to be stored in local servers and processed here. The bill also clears the way to establish a data protection regulator which will ensure that rules are followed. The bill is nuanced in the sense that it does not impose blanket bans on transfer of all data.
Therefore, the bill aims to arrive at an appropriate trade-off between the India’s economic strength as a global centre for processing data and the need to bring personal data under domestic regulation. Among other key aspects in the bill is the requirement that technology companies seek consent from users who are the source of data. This is an important requirement as the main complaint against social media companies is that they have used user data for commercial purposes without consent.
From a strategic standpoint, the bill will also align India’s interests with that of its partners. This is expected to be actualised when the regulator restricts transfer of Indian data to only those jurisdictions where the law is in sync with the direction India has taken. Personal data has emerged as the single most important spinoff of the evolution of information technology. The proposed bill is a belated effort to safeguard Indian users and national interest.
