Data Localisation and E-Commerce Regulation: Future of Digital Trade Laws in India

Abstract

The swift growth of digital trade in India has created a need for a strong legal framework to regulate data flows and e-commerce operations. Data localisation is an essential component of India’s digital trade regulations, designed to strengthen national security, regulatory oversight, and economic independence by mandating that specific categories of data be stored domestically. Localisation policies, while promoting data sovereignty and consumer protection, have also generated concerns about compliance costs, foreign investment, and possible trade restrictions. The regulatory framework in India is influenced by legislation including the Digital Personal Data Protection Act (DPDPA), 2023, the Information Technology Act, 2000, and the proposed National E-Commerce Policy, which collectively governs the storage, processing, and sharing of data. It is essential that these policies are in harmony with global trade standards to avoid conflicts with international agreements and to sustain India’s competitive advantage in digital markets. Achieving a balance between regulatory oversight and trade liberalisation is essential for fostering a sustainable and innovation-driven digital economy. This article provides a thorough analysis of the effects of India’s data localisation mandates on e-commerce and digital trade. This analysis examines the legal and economic challenges presented by these regulations and evaluates their consistency with global trade practices. Additionally, it evaluates the future direction of India’s digital trade regulations, emphasising the opportunities and challenges in establishing a secure and competitive digital economy. India’s localisation policies, influenced by security and economic factors, necessitate a more adaptable and cohesive strategy to align with international trade obligations, facilitate business operations, and promote ongoing technological advancement.

Keywords: data localisation, digital trade laws, India, global trade, Digital Personal Data Protection Act (DPDPA), cross-border data flows

Introduction

India’s digital economy is expanding rapidly, prompting the government to introduce new legal frameworks to regulate data localization and e-commerce activities. As digital trade increasingly plays a pivotal role in economic growth, the challenge of balancing regulatory oversight with economic competitiveness continues to be significant. The future of digital trade laws in India is significantly influenced by two key factors: data localisation and e-commerce regulation.

Data localisation encompasses a range of policy measures designed to restrict data flows by confining the physical storage and processing of data within the boundaries of a specific jurisdiction.[1] In the early stages of the digital era, nations concentrated on ‘digital globalisation,’ facilitating the cross-border transfer of data. This was in clear opposition to the theory of data localisation. As the landscape of the world wide web expanded, nations began to move away from the contemporary theory of unrestricted data flow for innovation. Instead, they focused on safeguarding their strategic interests and the well-being of their citizens through the implementation of data localisation practices. As of early 2023, nearly one hundred data localisation measures were implemented across forty countries, with over fifty percent of these initiatives having been introduced since 2015. Furthermore, various Mutual Legal Assistance Treaties (MLATs) and regional trade agreements (RTAs) among nations regulate the transfer of electronic data between the parties involved. MLATs typically facilitate the exchange of data between companies in a signatory country and the law enforcement agency of another signatory country upon a formal request, such as when seeking evidence against a fugitive economic offender. In contrast, RTAs may include particular stipulations regarding data storage and processing among the signatory nations.[2]

Electronic commerce, commonly referred to as “e-commerce,” offers customers the ability to explore a wide range of products and services online, enabling them to make purchases from the comfort of their homes or offices, thereby enhancing accessibility and convenience. Online sales have enabled e-commerce businesses to scale effectively and reach new customers that were previously inaccessible, both in domestic and international markets. In the early stages of e-commerce, it was anticipated to serve as an equaliser, enabling smaller enterprises to discover new customers and markets. Nonetheless, the actual situation has been substantially different.
Significant and uneven digital divides are present in the global digital and e-commerce landscape, both within and among countries. The issue of data localisation has emerged as a significant point of contention in the international digital landscape. Countries with advanced technology, along with the multinational giants in digital and e-commerce based there, strongly resist data localisation. The primary reason for the opposition is identified as a trade barrier, however, the underlying concern is the potential increase in operating costs.[3]

Background

The notion of data localisation in India has developed in light of apprehensions surrounding data sovereignty, national security, and economic autonomy. In the last ten years, India has implemented a range of regulatory measures designed to ensure that data produced within its territory is governed by domestic oversight. This evolution has been influenced by international trends, policy discussions, and specific mandates established by the government.
Historically, India has maintained a relatively open data policy, permitting companies to store and process data across borders. Nonetheless, given the rapid growth of digital transactions and the escalating cyber threats, it has become evident to policymakers that there is a necessity for enhanced data protection measures. The movement towards data localisation accelerated following the publication of the Justice B.N. Srikrishna Committee Report (2018), which highlighted the importance of local data storage to protect national interests. This report established the groundwork for the Personal Data Protection Bill, 2019 (now the Digital Personal Data Protection Act, 2023), which introduced essential provisions regarding cross-border data transfers and regulatory oversight.[4]

Legal and Regulatory Framework Governing Data Localisation in India

India’s approach to data storage and cross-border data transfers has been influenced by a range of sector-specific regulations and legislative proposals. The Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) serves as the principal legislation regulating personal data protection in India. The framework establishes a systematic approach for the processing and storage of personal data, allowing the government to exercise discretion in limiting cross-border data transfers in light of national security and public interest factors. The DPDP Act has superseded the previous Personal Data Protection Bill, 2019, which included provisions for mandatory data localisation concerning sensitive and critical personal data.
Before the implementation of the DPDP Act, India’s strategy regarding data localisation was tailored to specific sectors. The Reserve Bank of India (RBI) Circular regarding the Storage of Payment System Data, issued in 2018, requires that all payment system operators maintain financial data solely within India. This directive aims to facilitate regulatory access and improve cybersecurity measures.[5] This directive represented a significant regulation that required major global payment companies such as Visa, Mastercard, and PayPal to set up local data centres.

The Insurance Regulatory and Development Authority of India (IRDAI) has implemented data localisation mandates via its Guidelines on Information and Cyber Security for Insurers (2017), which necessitate that insurers store and process sensitive customer data within the borders of India.[6] In a similar vein, the Securities and Exchange Board of India (SEBI) requires market infrastructure institutions, including stock exchanges and depositories, to maintain essential financial data within the country. This measure aims to prevent data misuse and ensure adherence to Indian regulations.[7]

Furthermore, the Consumer Protection (E-Commerce) Rules, 2020 govern the management of consumer data by e-commerce entities, thereby strengthening adherence to localisation requirements.[8] The Draft National E-Commerce Policy, 2019, while still pending finalisation, suggests more stringent data-sharing regulations and enhances the localisation agenda.[9]

India’s position on data localisation continues to be a contentious issue in international trade discussions, especially in relation to agreements with the World Trade Organisation (WTO) and bilateral digital trade negotiations. Global technology firms contend that stringent regulations could impede digital trade and innovation, while Indian regulators highlight the importance of safeguarding national interests and promoting domestic digital infrastructure.[10]

Effect of Data Localisation on Digital Trade and E-Commerce

The expansion, operations, and competitiveness of e-commerce companies and digital trade in India are heavily influenced by data localisation rules. These rules have good and bad effects on the digital economy depending on whether data be kept and handled inside national boundaries.
Improved consumer protection and data security are among the main benefits of data localisation. Regulatory authorities can better enforce privacy rules, lower reliance on foreign jurisdictions for data governance, and lower risks connected with cross-border data breaches by guaranteeing that sensitive user data stays within the nation. Furthermore, data localisation promotes the growth of domestic digital infrastructure, which motivates multinational technology companies to make investments in local data centres and cloud services, hence improving the Indian economy.

Data localisation, however, also costs compliance for e-commerce companies—especially those with global operations in India.[11] Because local data centres must be established, global e-commerce sites like Amazon and Flipkart may have greater running expenses, which might result in higher consumer expenses. Moreover, limiting cross-border data transfer impedes digital trade, therefore making it challenging for Indian companies to make use of international fintech solutions, AI-driven analytics, and global cloud computing services.

Strict data localisation rules raise further questions about possible trade limitations. Countries supporting open data flow—including the US and the EU—have expressed worries about India’s actions possibly breaching international trade accords, hence sparking conflict in the World Trade Organisation (WTO). Data localisation presents difficulties for e-commerce companies by raising costs, restricting innovation, and maybe encouraging world trade wars, even if it improves security and drives home development. India’s economic development depends on a balanced legislative framework that protects consumer rights without thus restricting digital trade.

The Future of Digital Trade Laws in India: Difficulties and Prospectives

The very heart of the challenges in designing laws regulating commerce in the digital world lies primarily in the conflict between data-localisation-policing regimes and international obligations. The proposed Digital Personal Data Protection Act currently empowers all consumers with similarly knitted data localisation requirements. These proposals created alarms in the camp of the multinational corporations and amongst their negotiating partners. Such restrictions will reportedly hinder cross-border data flows and increase the operational costs of business, impeding foreign investment into the Indian digital economy.

The consequence of compliance with data-localisation laws would be Internet governance fragmented along national borders: an impediment for Indian industries participating in broader international value chains. Further, by their very nature, e-commerce regulations are evolving. The draft e-commerce policy seeks, among other things, the protection of consumers, regulation of foreign direct investments, and safeguarding data sovereignty. But there seem to be raging debates surrounding the level of intervention the government requires to maintain economic fairness and competition in digital markets. While much of the perception sees stricter regulation helping curb the monopolistic tendencies of big tech companies, there is an equal fear that excessive control over the market will stunt innovation and prevent new entrants.

Despite these challenges, the bright side regarding the future of laws regulating trade in India lies in the equally multiplying possibilities therein. With the growing digitalisation of services, India may finally become a global leader in data governance through regulation that is both balanced and flexible, which protects consumer rights while enabling cross-border trade.

G20 promotes the Data Free Flow with Trust (DFFT) Initiative, which shall allow India to develop international cooperation mechanisms while fulfilling its national interests. The digital trade laws of India are now nearing restoration while they need to wind up through many obstacles from regulatory functions; with the right balance struck between data protection and economic growth-induced global cooperation, the digital path ahead is going to provide a spectrum for a sustainable and competitive future.

Discussion

India’s digital trade law is now at a very crucial juncture given how the country is trying to balance data localisation with the regulation of e-commerce. The case for data localisation is made from the perspectives of data security, privacy, and regulatory oversight of cross-border data flows. Under the DPDPA, 2023, several stringent compliance measures would require business entities handling data of Indian citizens to comply with the mandates of data localisation. The DPDPA attempts to put Egypt’s data sovereignty on the front burner while spurring heated debates over fears that these laws might restrict digital trade and foreign investments. The Indian government has so far been on the proactive side in framing regulations that would aid the e-commerce sector while checking consumer protection and fair competition. In this regard, the Draft National E-Commerce Policy considers important the protection of domestic industries from anti-competitive practices from foreign tech giants. However, the spectre of creating a restrictive atmosphere could engender fears that investors would think twice before pouring money into India.

India has another major challenge to align its localisation policies with global trade agreements. Its stance on data sovereignty has created friction with international trade partners in negotiations at the WTO and bilateral trade discussions. Countries advocating free cross-border data flow have argued that restrictive regulations could hinder digital trade, causing adverse effects on cloud computing, fintech, digital commerce, etc. At the same time, India\u2019s insistence on localisation rests on considerations about national security and economic self-reliance, aimed at encouraging a vigorous local digital ecosystem. India\u2019s digital trade framework will also have to factor in the cost of localisation. SMEs depending on international cloud services may struggle in this scenario due to increased compliance costs, depriving them of a competitive edge. On the other hand, multinational e-commerce operation companies in India could also face regulatory hurdles that may compel them to amend their market strategies. Achieving a balance between localisation and integration into global trade is vital to both sustain the Indian digital economy and guarantee data protection and regulatory control.

Conclusion

India’s digital trade regulations are adapting to align with the nation’s focus on data sovereignty, economic development, and safeguarding consumer interests. Data localisation policies enhance cybersecurity and regulatory oversight; however, they present challenges concerning foreign investment, innovation, and compliance with international trade regulations. The government should guarantee that its regulatory framework avoids imposing unnecessary obstacles for businesses, all while upholding a secure digital environment.
An equitable and adaptable strategy is essential to address the concerns of both domestic stakeholders and international partners. Participating in international dialogues on cross-border data governance, engaging in WTO-led negotiations, and incorporating best practices from nations with comparable digital trade frameworks can assist India in developing a regulatory structure that fosters innovation while safeguarding national interests.
Moving ahead, India should enhance its e-commerce and data policies to establish a cohesive legal framework that facilitates digital trade while ensuring security is not compromised. The success of India’s digital trade laws will hinge on the seamless integration of localisation requirements with overarching economic and technological objectives, thereby enabling businesses, consumers, and regulatory bodies to flourish in the digital era.

Reference(S)

[1] Anirudh Burman and Upasana Sharma, ‘How Would Data Localization Benefit India?’ (Carnegie Endowment for International Peace, 8 April 2021) https://carnegieendowment.org/research/2021/04/how-would-data-localization-benefit-india?lang=en

[2] ‘Data Localization in India: Regulations, Impact, and the Future’ (Meta Legal, 24 August 2023) https://www.metalegal.in/post/data-localization-in-india-regulations-impact-and-the-future

[3] Abhijit Mukhopadhyay, ‘Data Localization: A New Instrument of Protectionism’ (2020) 6 International Organisations Research Journal 110.

[4] Ministry of Electronics and Information Technology (MeitY), Digital Personal Data Protection Act, 2023 (Government of India, 2023).

[5] Reserve Bank of India (RBI), Storage of Payment System Data (Government of India, 2018).

[6] Insurance Regulatory and Development Authority of India (IRDAI), Guidelines on Information and Cyber Security for Insurers (2017).

[7] Securities and Exchange Board of India (SEBI), Cyber Security & Cyber Resilience Framework (2019).

[8] Government of India, Consumer Protection (E-Commerce) Rules, 2020.

[9] Ministry of Electronics and Information Technology (MeitY), Draft National E-Commerce Policy (Government of India, 2019).

[10] Kelsey Jane, John Bush, Manuel Montes, and Joy Ndubai, ‘How ‘Digital Trade’ Rules Would Impede Taxation of the Digitalised Economy in the Global South’ (Third World Network, 2020).

[11] Rishab Bailey and Smriti Parsheera, ‘Data Localisation in India: Questioning the Means and Ends’ (2018).