Cross-border transfers and data localisation under the Data Protection Bill, 2021
Localisation comes in several flavours, and certain forms are more easily complied with than others
Comprehensive general data protection legislation for India has been eagerly awaited since the Supreme Court declared privacy as a fundamental right in Justice K.S. Puttaswamy vs Union of India. In December the Joint Parliamentary Committee (“JPC") presented its report on the Personal Data Protection Bill, 2019 (“2019 Bill"), after almost two years of deliberations. It proposed nearly 90 drafting and 90 substantive changes to the 2019 Bill and also proposed the draft of the Data Protection Bill, 2021 (“2021 Bill"). These changes include language which could affect the cross-border data flows both under approved “standard" contractual clauses, and under data adequacy decisions. Recent reports indicates that the 2021 Bill is being considered for further revision, and this should be a key area of focus.