India To Restrict Information Outflow: Countries On “Negative List” Barred From Indian User Data Transfers

India appears to be tightening control over the flow of personal data of Indian internet users, especially beyond the country's borders.

The proposed Digital Personal Data Protection Bill is likely to include a list of countries to which data of Indian users won't be allowed to flow. The upcoming draft of the bill may have a "Negative List" of countries.

Let's look at some key changes expected in the upcoming draft of the Digital Personal Data Protection Bill (DPDPB), 2022.

Indian Government May Notify Negative List To Limit Cross-Border Data Flows

The data of Indian users, just like in other countries, isn't limited to the country's boundaries. Websites, apps, and other digital platforms collect, store, and process data. Such data can, and often does, reside on foreign soil.

Previously, the Indian government had proposed a "White List", which included trusted geographies. Simply put, countries in the whitelist would be allowed cross-border data flow from India. The central administration, after consultation on the issue, has now revised the strategy.

Under the newly proposed "Default Mode" for cross-border data flow, the government will have a Negative List, indicated the minister of state for electronics and IT, Rajeev Chandrasekhar:

"The government will have the right to restrict certain geographies and will decide the criteria for restriction. This will mean that the government will have a "blacklist" of countries to which cross border data flow will be disallowed."

Will Indian User Data Flow Be Disrupted Due To The Negative List?

Creating a Negative List of countries is a practical approach to quickly identify and ban unsafe or unreliable countries from receiving, hosting, and processing the personal data of Indians. However, the proposed step shouldn't have a huge impact in the near future, suggested Ashish Aggarwal, head of Public Policy at the technology industry lobby NASSCOM.

"There is no immediate disruption. Existing data flows are happening based on several contractual (agreements) with both parties (aware) that their customer data is safe. There are also obligations built into this."

The Negative List will basically offer a quick reference to businesses about the countries that are to be avoided. This will help ease the flow of data to friendly and reliable countries. Moreover, countries that appear on the Negative List can try and get their names out of it by following procedures laid out by the Indian government.