Data Localisation and the Sovereignty Debate: What India’s Digital Data Protection Law Actually Requires

India’s Digital Personal Data Protection Act, after years of public consultation, multiple draft versions, and substantial debate between privacy advocates, technology industry representatives, and government stakeholders, finally established a comprehensive legal framework governing how personal data can be collected, processed, and stored. The final law represents a series of negotiated compromises, and understanding those compromises is essential to assessing what genuine protection the law provides versus what remains a matter of executive discretion.

What the Law Gets Right

The Act establishes meaningful, internationally recognisable principles: data must be collected for specific, lawful purposes with informed consent, individuals have a right to access and correct their own data, and organisations processing data bear accountability obligations including, for significant data processors, mandatory data protection officers and regular audits. These are substantive protections that, properly enforced, would represent a genuine improvement over India’s previous, considerably weaker data protection regime, which relied on more limited provisions within the broader Information Technology Act.

The Government Exemption Question

The most significant point of contention throughout the legislative process, and the one that persists in the final law, concerns the scope of exemptions available to government bodies. The Act permits government agencies to be exempted from several of the law’s core obligations — including, in some circumstances, the requirement to disclose what data is being processed and for what specific purpose — when processing is deemed necessary for national security, public order, or several other broadly worded categories. Privacy advocates have raised a consistent concern: a data protection law whose core consent and transparency obligations can be set aside by government notification for an expansively defined set of purposes provides a meaningfully different and weaker level of protection against state surveillance than it provides against private commercial data misuse.

A data protection law is measured not only by the rights it grants on paper, but by how narrowly or broadly the exceptions to those rights are drawn — and by who gets to decide, case by case, whether a given exception applies.

Cross-Border Data Transfer and Localisation

Earlier draft versions of the legislation contained stricter data localisation requirements, mandating that certain categories of sensitive personal data be stored exclusively on servers physically located within India. The final Act adopted a more flexible approach, allowing cross-border data transfer to countries the government designates as having adequate data protection standards, a mechanism that gives the executive considerable ongoing discretion over which countries qualify, but that also avoided the more disruptive compliance costs that strict localisation requirements would have imposed on technology companies operating in India, including many Indian companies serving global customers who rely on globally distributed cloud infrastructure.

The Enforcement Question That Remains Open

Ultimately, the law’s real-world protective effect will depend substantially on the independence and rigour of the Data Protection Board established to enforce it, a body whose members are appointed by the central government, raising legitimate questions about its practical independence when adjudicating cases involving government data processing itself. The legal framework is now in place. Whether it functions as a genuine check on both commercial and state data practices, or as a structure that formalises broad government latitude while regulating private industry more strictly, will become clear only through the pattern of enforcement decisions that emerge in the years ahead.