Building bridges in the data jungle: A path to global trust

With India's evolving data laws, certification mechanisms like CBPR offer businesses a competitive edge while fostering trusted cross-border data flows

- DR JAIJIT BHATTACHARYA & RITVIK RAI

Cross-border data flows are essential for sustaining the digital economy. However, governments often seek to restrict these flows due to concerns over privacy, user harm, surveillance, and the need for adequate protections for user data in certain jurisdictions.

Balancing these conflicting interests has led to the development of trusted mechanisms for cross-border data transfers. Two of the most prominent mechanisms are the enforcement of the extraterritorial application of the European Union’s General Data Protection Regulation (GDPR) and the Global Cross-Border Privacy Rules (CBPR) Forum, based on the Asia-Pacific Economic Cooperation (APEC) CBPR framework.

THE SIGNIFICANCE OF THE GLOBAL CBPR

When personal data crosses national borders, the key concern is ensuring that the receiving jurisdiction has robust privacy legislation to protect user data. The EU’s GDPR, for example, is an extraterritorial regulation that applies to all entities processing the data of EU citizens, regardless of their geographical location or operational base. Its extraterritorial application is enforced through the Data Privacy Framework, Standard Contractual Clauses, and Binding Corporate Rules.

In contrast, the Global CBPR is not a law with extraterritorial applicability but rather a standardisation mechanism that operates on a principles-first approach. The Global CBPR Framework (Framework) consists of two systems: the Global CBPR system, which certifies data fiduciaries, and the Global Privacy Recognition for Processors (PRP) system, which certifies data processors.