Relaxed provisions on cross-border data transfer 'commendable advancement': Experts on data protection Bill

New Delhi: Relaxed provisions in the data protection bill on cross-border information transfers to countries for processing data is a "commendable advancement" from the strict localisation norms that were mooted in the previous versions, industry experts said on Thursday.

Shreya Suri, Partner at INDUSLAW highlighted that one "interesting feature" is that this version points towards a jurisdiction blacklisting format with respect to the permissibility of cross-border data processing activities. This is unlike other major jurisdictions like the EU, where the approach is to identify and whitelist jurisdictions with adequate legal standards.

Kazim Rizvi, Founding Director of tech policy thinktank The Dialogue also noted that the Bill allows cross-border data transfers to any countries or territories outside India for processing data unless the government restricts data flows to certain nations.

"This provision is again a commendable advancement from the strict localisation norms that were present in the initial drafts of the Bill and will be critical for the advancement of the digital economy. However, it will be further helpful to clarify the mechanisms like Binding Corporate Rules, Contractual Clauses etc that the data fiduciaries may follow to transfer the data", said Rizvi.

Notably, the Bill says that the central government "may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.

Other experts felt the Data Protection Bill promotes data transparency and protects user and enterprise data.

Trishneet Arora, Founder and CEO of cybersecurity company TAC Security said the Bill is a significant milestone for protecting data privacy in the digital age.

"The Digital Personal Data Protection Bill, 2023 presented in Lok Sabha, is a significant milestone in taking safeguarding personal information and reinforcing the importance of privacy in the digital age...for individuals and businesses alike," Arora said.

"Key provisions of the Data Protection Bill include stringent measures for consent management, data anonymization, breach notification, and cross-border data transfers," he noted. Highlighting the provisions for regulating personal data, he said the Bill "serves as a robust shield against unauthorized access, data breaches, and misuse" and instils greater trust in digital conversations.

"Compliance with the bill's provisions will be essential for businesses, as it ensures the protection of customer data, enhances transparency, and mitigates the risks associated with data breaches," he added.

Partner at Grant Thornton Bharat Akshay Garkel said the Bill promotes transparency in data practices. "The Data Board's empowerment to function as a digital office, handling complaints, allocating cases, and making decisions by adopting techno-legal means, adds to the efficiency and transparency of the entire process," he added.

The government tabled the Digital Personal Data Protection Bill in Lok Sabha on Thursday.

Entities misusing or failing to protect digital data users may face penalty of up to Rs 250 crore, according to the Digital Personal Data Protection Bill 2023 which lays down obligations of entities handling and processing data as well as rights of individuals.