India's new draft data protection bill proposes allowing cross-border data transfer with certain countries, unlike an earlier version which imposed restrictions
India has proposed a new comprehensive data privacy law that will mandate how companies handle data of its citizens …
Context & Ripple Effects
India’s privacy-law effort had previously centered on consent requirements for collection and processing in its 2019 consent-based proposal. The government then withdrew the long-running bill after criticism from privacy advocates and tech giants, leaving a policy reset rather than a settled compliance regime.
The new draft changes that reset’s direction: selected international transfers are treated as a permitted channel rather than a broadly restricted one. Related coverage’s subsequent more “balanced” revision reinforces that the government was recalibrating the framework in response to competing privacy and business concerns.
First-order effects
- Companies handling Indian citizens’ data would face a comprehensive privacy framework while gaining a potential transfer route for data sent to countries India permits.
- India becomes responsible for defining and administering the country-based conditions that determine which cross-border transfers are allowed.
Second-order effects
- Technology companies that criticized the withdrawn framework have a direct incentive to seek broad, predictable eligibility criteria, since access to overseas processing depends on India’s approved-country policy.
- Privacy advocates’ focus shifts from an outright transfer restriction to the safeguards and country-selection rules governing permitted transfers.
Third-order effects
- If this approach persists through successive drafts, India’s data regime would move toward conditional international interoperability—privacy obligations at home paired with state-controlled openness abroad—rather than blanket localization.
- The repeated drafting cycle makes the durability of any compliance model dependent on whether India can reconcile the concerns that led to the earlier bill’s withdrawal.
The trend: India is shifting its data-governance debate from broad cross-border restrictions toward a conditional transfer regime shaped by approved destinations and domestic privacy rules.