Cross-Border Data Transfers and Data Localization Mandate under the Data Protection Regime

Abstract

The present paper critiques India's approach to cross-border data transfers under the Draft Digital Personal Data Protection Rules 2025. It highlights concerns with Rule 14 and Rule 12(4), which grant the government broad discretion to impose data localization mandates, potentially restricting the transfer of specific data types regardless of the destination country's safety. This "regressive" approach could stifle innovation and create compliance hurdles for businesses, especially social media intermediaries. The paper also points out the ambiguity in defining restrictions and the lack of provisions for "onward transfers" of data, contrasting it with the more comprehensive GDPR. It advocates for a balanced framework with clear criteria for restrictions and safeguards, aligning with international best practices to ensure both national security and economic viability.