Black list or white: Navigating India’s data protection goals with AI

← Back to index

In the digital era, the debate over data localisation laws has become increasingly nuanced and complex, particularly in countries like India, where technological advancement intersects with regulatory oversight. This intersection has broad implications and practical challenges for artificial intelligence (AI) development and technological innovation in India.

From the genesis of the Srikrishna committee report to subsequent legislative interventions, India has grappled with finding the right balance between data protection and fostering an environment conducive for innovation. The recent easing of data localisation mandates under the Digital Personal Data Protection Act, 2023 (DPDPA), has sparked much debate around its impact on AI development in the country.

Amid these deliberations, the government’s support for local data storage warehouses represents a strategic vision for strengthening India’s digital infrastructure. The symbiotic relationship between data localisation and AI innovation, and the potential consequences for India’s technological landscape that arise from data protection legislation and localisation norms, require a fine balance to be struck. This balance between regulatory objectives and technological aspirations remains paramount to ensure India’s continued emergence as a global leader in AI-driven innovation.

Data localisation, AI advancement

Within the legal discourse surrounding data localisation policies, a pivotal consideration concerns its instrumental role in promoting the development of AI technologies. Central to this contention is the fact that robust AI systems require diverse datasets for effective training and optimisation.

Essentially, AI technology works by relying on a large set of data and combining such data with progressive learning algorithms. These algorithms follow a series of instructions or ground rules to analyse the data they are fed, in order to construct patterns and lay out statistics or predictions.

For this reason, the quality and quantity of data supplied to train AI systems would have a substantial impact in determining the merit of such technology. Consequentially, by mandating the localisation of data, policymakers are effectively creating an environment conducive to the accumulation of rich repositories of information, thereby furnishing AI researchers and developers with ample resources for innovation and advancement.

It is argued that the interplay between data localisation and AI development emphasises a symbiotic relationship where the localisation restriction would serve as a catalyst for AI development. Through localisation of data, a country can safeguard the rights of its residents with respect to their personal data, but would also secure the foundation on which indigenous AI capabilities can flourish.

Indigenous data infrastructure

India’s government has been clear in its objective of creating solid indigenous data storage infrastructure. In pursuit of fostering investment and advancing India’s potential as a prominent global data centre hub, the Ministry of Electronics and Information Technology unveiled a preliminary draft Data Centre Policy in November 2020, outlining comprehensive strategies to bolster the sector’s growth and to cultivate a conducive operational environment for data centres.

A pivotal aspect of this policy framework entailed conferring infrastructure status on the data centre sector, an important designation intended to enhance its appeal to investors and facilitate access to critical financial resources.

This significant development gained further traction subsequent to the finance minister’s pronouncement during the 2022 budget address, where data centres were formally accorded “infrastructure” status and subsequently integrated into the Harmonised Master List of Infrastructure sub-sectors in October 2022.

By securing this status and inclusion on the harmonised list, data centres are poised to benefit from streamlined regulatory procedures, favourable policy incentives, and improved access to institutional financing.

This strategic move is expected to stimulate investment inflows, foster technological innovation, and reinforce India’s position as a leading contender in the expanding digital landscape. Moreover, several state governments have also incentivised the data centre industry by relaxing stamp duties in addition to various other subsidies.

India and data localisation

The necessity of enacting data localisation laws in the country remains a subject of ongoing deliberation. Industry stakeholders have argued the redundancy of data localisation norms, claiming that such restrictions create hinderances to market access, in addition to the significant economic costs involved in constructing the required infrastructure.

Conversely, arguments favouring data localisation expound beneficial outcomes such as time efficiency and convenience in accessing data, curbing foreign surveillance, etc.

The emergence of India’s data localisation discourse can be traced back to the foundation of the Srikrishna committee report in 2018, which emphasised the need for data localisation of certain sensitive categories of data, along with certain ancillary obligations.

In the same year, the Reserve Bank of India also mandated data localisation, stipulating that all payment data generated within the country must be stored exclusively on local servers. Subsequent legislation and regulatory intervention strengthened India’s commitment to data localisation.

The Personal Data Protection Bill of 2019 emerged as a watershed moment along this trajectory, obligating protection of personal data by localisation of certain categories of sensitive personal data.

Then the 2022 draft of the Digital Personal Data Protection Bill provided a stringent mechanism for data localisation where the central government would notify a “white list” of jurisdictions where personal data could be transferred. This provision essentially tightened the cross-border transfer of personal data. However, the 2022 draft bill was scrapped and replaced with the 2023 legislation.

Section 16 of the DPDPA eased the stance on cross-border data transfer restrictions and adopted a “black list” approach, where the central government may notify specific countries where storage of personal data is prohibited, effectively easing the restriction on cross-border transfer of data procured in India.

While some stakeholders have celebrated this lenient stance, several questions about its effect on the promotion of India’s technological landscape have arisen. The DPDPA does not provide for any safeguards for cross-border data transfer, and it is presumed that once the rules and regulations under the DPDPA are issued, or once the list of black-listed countries is issued, certain safeguards and protections would be built in.

Other than the DPDPA, there are various regulations that prescribe localisation requirements for industries such as insurance, telecoms and direct sales. The freedom for cross-border data transfer accorded under the DPDPA will then necessarily have to be aligned with sector-specific localisation norms and requirements.

Without a balanced data localisation requirement, the aggregation and retention of personal data within India’s borders may be compromised, leading to a scarcity of high-quality datasets that are crucial for AI research and development.

Conclusion

India stands at a pivotal juncture in its data governance journey. While relaxing data localisation restrictions may align with economic goals and global integration, it could have an adverse impact on India’s ability to nurture its indigenous AI capabilities, which are crucial for innovation and economic growth.

The world’s leading data privacy legislation, the General Data Protection Regulation, has addressed the conundrum of data localisation with a “white list” approach, where data of EU residents may be freely transferred to only a few specified jurisdictions.

This approach has not only been a remarkable endeavour in safeguarding citizens’ personal data, but has also been fundamental in fostering AI progress by ensuring access to high-quality data.

A balanced approach recognising the symbiotic relationship between data localisation and AI advancement is imperative. By striking this balance, India can maintain its competitive edge in the global technological landscape and emerge as a leader in AI-driven innovation.

← Back to index