Lok Sabha Question No. 319 (UNSTARRED), answered on 2024-07-24
Subject: Regarding Cross-Border Data Transfer
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Shri Manish Tewari

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION NO. 319

TO BE ANSWERED ON: 24.07.2024

## REGARDING CROSS-BORDER DATA TRANSFER

## 319.     SHRI MANISH TEWARI:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

(a) whether the Government has devised any means for allowing or restricting cross-border transfer of data under the Digital Personal Data Protection Act (DPDPA);

- (b) if so, the details thereof;

(c) whether the DPDPA differs from the Sensitive Personal Data Information (SPDI) Rules regarding cross-border data transfer;

- (d) if so, the details thereof;

(e) whether DPDPA removes the existing regulations on cross-border data transfer imposed under the SPDI Rules;

- (f) if so, the details thereof;

(g) whether the Government has conducted any studies to ensure that sensitive personal data is not transferred under the DPDPA and the same is protected from cross-border transfer once the DPDPA is implemented;

(h)  whether  the  Government  is  going  to  formulate  any  new  guidelines  or  regulations  to regulate cross-border data transfer; and

- (i) if so, the details thereof;

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA)

(a) to (i):  The Digital Personal Data Protection Act, 2023 recognises the right of individuals to protect their personal data and incorporates all well-accepted principles for protection of personal data. These include:

- (i) The principle of consented, lawful and transparent use of personal data;
- (ii) The  principle  of  purpose  limitation  (use  of  personal  data  only  for  the  purpose specified at the time of obtaining consent of the Data Principal);
- (iii) The  principle  of  data  minimisation  (collection  of  only  as  much  personal  data  as  is necessary to serve the specified purpose);
- (iv) The principle of data accuracy (ensuring data is correct and updated);
- (v) The principle of storage limitation (storing data only till it is needed for the specified purpose);
- (vi) The principle of reasonable security safeguards; and
- (vii) The principle of accountability (through adjudication of data breaches and breaches of the provisions of the Bill and imposition of penalties for the breaches)

The  Digital  Personal  Data  Protection  Act,  2023recognises  higher  degree  of  protection including restriction on transfer of personal data. To illustrate, under Section 10(2) read with Section  18  of  Payment  and  Settlement  Systems  Act  2007,  the  Reserve  Bank  of  India  has issued  a  directive  on  storage  of  payment  system  data  in  India.  As  per  this  directive,  data including end-to-end transaction details and information pertaining to payment or settlement transaction  should  be  stored  in  India.  Such  restriction  on  transfer  of  personal  data  is recognised under the Digital Personal Data Protection Act, 2023 and will continue to operate.

********