Data localization in India: paradigms and processes

Abstract

This paper examines the debates around data localization in India, using the term to mean any kind of mandatory requirements of local storage or processing of data within the country. We focus on the policy motivations and challenges of data localization, mapping these arguments into three broad categories of the civil liberties perspective, the government functions perspective, and the economic perspective. This is followed by an examination of the robustness of the policy processes through which such norms are being introduced in India. We focus on three policy initiatives-the Personal Data Protection Bill, the Reserve Bank of India's payments directive, and the localization conditions in telecommunication licenses. We find each of these processes to be lacking in terms of robustness, transparency, and deliberative policy making with the data protection discussions faring better than the other two initiatives.

Global governance and regulation of cybersecurity: Towards coherence or fragmentation?

“…1001 Regarding India, the country has already implemented different types of data localization requirements with different levels of strictness. 1002 On the other side of the spectrum, states such as the European Union and the United States have enjoyed a privileged position in cybersecurity governance and advocate for a multistakeholder model, based in the principles of democracy, the flow of information and free speech. Privileged in the sense that both countries are actively engaged in cybersecurity debates and are important actor's in adopting and promoting cyber norms.…”