Tech Firms Seek Clarity On Data Storage Norms In Foreign Locations

SUMMARY

These companies have told the government that the proposed definition of trusted geographies will mean significant investments in data storage units

Furthermore, if the government updates the norms and geographies from time to time, these investments are likely to go to waste

The government is of the opinion that the list will not say in which countries or territories it will allow the storage of data, but where it doesn’t

A host of multinational technology firms and large social media intermediaries met the IT ministry to seek clarity on the proposed data storage rules in foreign jurisdictions.

According to an ET report, these companies have told the government that the proposed definition of trusted geographies will mean significant investments into data storage units. Furthermore, if the government updates the norms and geographies from time to time, these investments are likely to go to waste.

The new draft of the Digital Personal Data Protection Bill has suggested certain data localisation and storage norms, restricting geographical storage of data by the collecting companies to ‘trusted’ geographies

Furthermore, the government will allow for cross-border storage and transfer of data to ‘certain notified countries and territories’. However, it will issue a notification after an ‘assessment of such factors, as it may consider necessary’ to notify such countries or territories outside India to which a [company] may transfer personal data.

The terms and conditions will also be specified in such notification, the Bill has hinted.

In the meeting with senior officials of the IT Ministry, the ET report quotes executives seeking assurances that data storage norms (as and when decided) will not be ‘entirely dependent’ on changing geopolitics, forcing companies to change the locations of their data storage units.

“The companies also sought assurances that the investments for data centres made so far will not be impacted adversely. They also wanted some clarity on how the trusted jurisdiction will be decided,” one of the sources said.

On the other hand, the government is of the opinion that the list will not say in which countries or territories it will allow the storage of data, but where it doesn’t.

The data localisation norms also pose a roadblock to the blockchain industry, as suggested by the Indian Blockchain Forum (IBF). Therein, the industry body has stated that the decentralised nature of blockchain-based applications makes it extremely difficult to identify a location of even a person in charge of the data.

The IT ministry released the draft DPDP Bill for public consultation on November 18, 2022, which is open for recommendations till December 17, 2022.