Data protection law will be a big boost to outsourcing and data processing industry

In a digital age, where vast amounts of personal data are transferred at high speeds in virtual environments, the discussion around data protection in India has come at an opportune time. Given the strong tradition and history of the Indian outsourcing industry and sheer volumes of data processed in the country, the proposed act has the potential to put control of personal data back in the hands of the individual. At the same time, it obligates companies handling personal data to overhaul their data protection and privacy policies. 

With the data protection bill, the big debate is that of data localisation, i.e. the mandatory storage of certain personal data in India. The crux of this debate is the scope of data to be localised. 

Localisation of data is a sensitive issue, not least geopolitically as data boundaries are now becoming perceived as national or regional boundaries. If you look at countries which have strong data localisation requirements, a perception is that the data localisation laws have been enacted to enable easier surveillance of their own citizens and as an attempt to boost local IT economies. It would be fair to say that this is not the intention of this draft bill as the Indian constitution guarantees freedom of speech and expression. However, the external perception of the reason for data localisation should be considered. 

If, for instance, the government takes a light approach to data localisation, such as the localisation of only health data, then the effect on companies processing this data is small. However, a heavy approach, where all data of Indian citizens must be stored locally it will present challenges for many companies, especially multinationals who may have databases outside the India data boundary. It really depends on what the law eventually mandates, but one certainty is that for multinational companies who operate in countries which have data localisation requirements, the increased cost of operation is, without a doubt, taken into consideration when deciding to invest in operations in that country.

Embracing the new Indian law means companies may have to revise standard operating procedures, so that their customers are made aware of where their data is being processed and their rights in relation to their personal data. 

For example, if an applicant applies for a visa, their personal data is passed on to the Embassy of the country they wish to visit, this may be processed outside India. If, as proposed in the new law, visa applicants can consent to their personal data being transferred overseas, then there will be little impact other than to manage the collection of this consent in the manner prescribed in the proposed law. 

There’s no doubt this law will be a big boost to the data processing industry in India, because internationally, many countries are writing into their data protection laws elements that make it increasingly difficult to transfer data to countries that don’t have a robust data protection laws. By enacting and successfully implementing this data protection law, the government is providing a springboard to the Indian outsourcing and data processing industry by making it easier for other countries to transfer data into India. 

It is no coincidence that countries with robust, practical and enforceable data protection laws also have very successfully digital & data processing economies.

TIGHTENING NORMS

• Localisation of data is a sensitive issue, not least geopolitically as data boundaries are now becoming perceived as national or regional boundaries
   
• If govt takes a light approach then effect on firms processing this data is small

The writer is group data protection officer at VFS Global