Localization & Transfer of Personal Data under the Digital Personal Data Protection Act, 2023
Businesses today operate in an increasingly interconnected digital ecosystem, where the storage, processing and movement of personal data routinely transcend national borders. As a result, personal data may be processed in multiple jurisdictions either through cloud infrastructure, outsourced service providers or global customer operations. While such arrangements offer significant commercial and operational benefits to an entity, they also raise important questions regarding accountability and the protection of personal data once it leaves a country's borders. The Digital Personal Data Protection Act, 2023 (‘DPDP Act/Act’) and its corresponding rules (set to become fully operational by May 2027) establish the principal framework governing the processing of digital personal data in India. Amongst other things, the DPDP framework aims to regulate the transfer and processing of personal data outside India. Consequently, organizations that store, process, or transf...