Navigating Cross-Border Data Transfers for Global AI

A New Paradigm for Cross-Border Data Transfers

India's approach to cross-border data transfers in the final 2023 Act represents a significant shift from earlier drafts and from other major global regulations like the EU's GDPR. Previous Indian proposals, much like GDPR, focused on an "adequacy" model, where data could only be transferred to countries pre-approved as having sufficient data protection laws.

The DPDP Act, 2023, reverses this logic. It adopts a more flexible, business-friendly "negative list" approach. Let's watch a short explanation from the law firm Khaitan & Co.

As the video explains, the default rule under the DPDP Act is that cross-border transfers of personal data are permitted. The restriction is the exception, not the rule. The Central Government is empowered to create a "blacklist" of countries to which data transfers will be restricted. If a country is not on this list, transfers are, by default, allowed.

This "allow-by-default" framework is a significant departure from the GDPR's "adequacy" framework, which you may encounter in your comparative law studies. It is crucial to be aware of this distinction, as many older analyses of India's data protection bills describe a more restrictive, GDPR-like model that did not make it into the final Act.

Analyzing Section 16: The Legal Text

The core of this regime lies in Section 16 of the DPDP Act, 2023. It's a brief but powerful section.

Section 16: Transfer of personal data outside India

1. The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.
2. Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.

Let's break down the two key components:

• Section 16(1): The "Blacklist" Mechanism: This clause gives the Central Government the authority to issue notifications naming countries where personal data cannot be sent. The process for this notification involves review by both houses of Parliament, ensuring a level of oversight. As of today, no such list has been notified.
• Section 16(2): The Sectoral Law Override: This is a critical exception. It states that if any other Indian law imposes stricter rules on data transfers for a particular sector, that stricter law will prevail. This means the DPDP Act's permissive stance does not create a universal free-for-all; it defers to more stringent, sector-specific regulations.

The Override in Action: The Case of Financial Data

The most prominent example of the sectoral override in Section 16(2) is the regulation of financial data by the Reserve Bank of India (RBI). This has profound implications for AI systems in the fintech space.

To understand this interaction, let's examine a detailed academic paper.

As the paper details, the RBI's directive on "Storage of Payment System Data" mandates that all data related to payment systems—including transaction details, customer information, and payment credentials—must be stored in systems located only in India.

While the RBI later clarified that data could be processed abroad, it must be brought back to India within 24 hours, and the original copy must never leave. This is a form of data localization, a much stricter requirement than the DPDP Act's default rule.

For an AI company developing a credit scoring model or a real-time fraud detection system that uses payment data, this means:

• The primary data storage must be in India.
• They cannot simply use a global data lake hosted on a server in the US or Europe for this data.
• This constrains AI architecture, encouraging designs where models are trained on data held within India.

Practical Compliance for Global AI Systems

Given this legal framework, how should an organization deploying AI in India manage its cross-border data flows? Compliance is not a one-time clearance but a continuous governance program. Your experience in implementing transformation projects will be valuable in appreciating these operational steps.

Based on our analysis, here is a practical checklist:

1. Maintain a Data Transfer Register:

   • Map all cross-border data flows. Where is your cloud provider's data center? Where is your customer support team located?
   • Document the datasets, purposes, destinations, and legal basis for each transfer.

2. Monitor the "Blacklist":

   • Continuously monitor notifications from the Central Government. If a country you transfer data to gets added to the restricted list, you must be prepared to reroute those data flows rapidly.

3. Identify Sectoral Overrides:

   • Determine if your organization operates in a sector with specific data transfer rules (e.g., finance, insurance, healthcare).
   • If stricter localization or transfer rules exist, they supersede the DPDP Act's general allowance.

4. Implement Contractual Safeguards:

   • Even though the DPDP Act doesn't mandate GDPR-style Standard Contractual Clauses (SCCs), the Indian Data Fiduciary remains liable for any data breaches or misuse by a foreign processor.
   • It is crucial to have robust Data Processing Agreements (DPAs) with foreign vendors. These contracts should impose obligations for data security, breach notification, purpose limitation, and onward transfer restrictions, effectively extending DPDP-grade protection contractually.

The following image provides a simplified visual of a compliant data flow in the health sector, a field you are familiar with.

Conclusion

In this lesson, we have unpacked the nuanced rules governing the flow of personal data across India's borders. We've seen how the DPDP Act, 2023, pioneers a flexible "negative list" approach, a significant move designed to facilitate global business operations, including the development of large-scale AI.

Key Takeaways:

• "Allow-by-Default" Model: The DPDP Act permits cross-border data transfers to any country by default, unless that country is specifically placed on a restricted "blacklist" by the Central Government.
• Sectoral Laws Override: This permissive rule is subject to a crucial exception: stricter data transfer or localization laws from specific sectors (like the RBI's mandate for financial data) will prevail over the DPDP Act.
• Liability Remains: The Indian Data Fiduciary remains liable for the security and processing of personal data even after it has been transferred abroad. This makes strong contractual safeguards with foreign processors a practical necessity.
• Architectural Implications for AI: This legal landscape directly influences AI system design, pushing companies in regulated sectors towards data localization and architectures like federated learning, while offering more flexibility to others.

Preview of the Next Lesson:

We have now covered the core obligations of Data Fiduciaries, from consent and legitimate uses to data transfers. But what happens when these rules are broken? In our next lesson, we will examine the enforcement mechanism of the Act by exploring the role, powers, and penalty framework of the Data Protection Board of India.