Protect Data, Businesses Too

Under the Digital Personal Data Protection Act 2023 and its recently-released draft rules, personal data can be freely transferred to a foreign country and processed there as long as the country is not blacklisted by the Union government.

- AMAR PATNAIK

The blacklisting approach is in contrast to the earlier approach of restricting data transfers only to a select list of countries.

The current provisions have a direct impact on the multinational companies that process, store and collect personal data in multiple countries. For instance, if an MNC operating in India is located in a blacklisted country, then its operations would effectively cease under the DPDP Act. But it's not clear what happens if it is located in a whitelisted country, but the data is transferred to one of its branches operating in a blacklisted country where it gets processed. The Act and the draft rules have not addressed this issue.

Given that some amount of personal data is essential for providing goods and services, foreign companies operating in countries to which data transfers are prohibited (once notified by the government) may face challenges in conducting business in India. If data is already being transferred to a country that the government later restricts, immediate action would be required to halt such transfers. This gives rise to the question—is it desirable to put an outright ban on multinational organizations operating in a blacklisted country without having a specific mechanism to regular cross-border transfer of data? The blacklist approach under the DPDP Act and the draft rules can backfire and harm businesses operating in India.