The software and information industry seems unhappy with the cross-border data flow provision mentioned in the Draft Personal Data Protection Bill, 2022. The draft calls for a ‘whitelist’ approach where the personal data of Indians can only be transferred to a set of countries notified by the government. Transfer of personal data to other countries seems to be banned, subject to certain exemptions. Software and Information Industry Association (SIIA), an international trade association based in the US, said, “We are concerned that the approach contemplated by the Bill will have negative consequences for the Indian economy.” It added, the Bill “can be expected to create unpredictability for domestic businesses and foreign investors that will lead to constraints on the ability of Indian-based businesses to grow, reduce foreign investment, and limit the choices and services available to Indian consumers.” SIIA has over 600 members, including the likes of Stock Exchange of Thailand, Reserve Bank of Australia, Qarar Exchange, Meta and JP Morgan. Why it matters: The provisions in the current bill create uncertainty for organisations who regularly transfer data outside of India. Changes in where personal data can be transferred puts additional compliance burdens on companies and could even lead to additional costs for them. Additionally, the government has not specified any ‘guiding principles’ for determining how companies will be whitelisted for data transfers. These are expected to be prescribed later. As you’ll see, SIIA’s suggestions highlight the industry’s concerns and expectations with regard to cross-border data transfers. The major points…
