India's new draft data protection bill proposes allowing cross-border data transfer with certain countries, unlike an earlier version which imposed restrictions
India has proposed a new comprehensive data privacy law that will mandate how companies handle data of its citizens …
Context & Ripple Effects
India’s privacy-policy arc began with a 2019 proposal centered on consent for collecting and processing citizens’ data, then reset when the government withdrew its long-awaited prior bill amid criticism from privacy advocates and tech companies. The new draft replaces that stalled framework rather than simply reviving it.
The key policy shift is away from the earlier draft’s transfer restrictions toward conditional international transfers. Related coverage indicates the government subsequently characterized an updated draft as more balanced, underscoring that it is trying to reconcile privacy rules with operational concerns raised during the earlier process.
First-order effects
- Companies handling Indian citizens’ data would face a comprehensive privacy-law framework, while gaining a route to transfer data abroad when destination countries meet India’s conditions.
- India moves from the prior bill’s restrictive transfer posture to a country-based permission model, making the government the central setter of cross-border data rules.
Second-order effects
- Multinational technology companies and other data-intensive businesses would need to align data-storage and transfer practices with India’s approved-country framework rather than plan solely around blanket localization-style restrictions.
- Privacy advocates and tech companies regain influence over the bill’s design: the earlier withdrawal and the subsequent “more balanced” updated draft show that criticism is shaping the framework’s terms.
Third-order effects
- If India sustains a conditional-transfer approach through legislation, privacy compliance will increasingly turn on bilateral or country-level data-governance decisions, not just companies’ own consent processes.
- The sequence of a consent-focused proposal, withdrawal, and revised draft points to a broader shift toward iterative privacy rulemaking that balances domestic control over citizen data with cross-border digital operations.
The trend: India is moving toward privacy regulation that combines individual-data safeguards with government-controlled pathways for international data flows.