29 Contractual Clauses (SCCs) for each business deal. Both instruments require the levels of protection, oversight and access for individuals that would be offered in the EU. Both also require a data controller or processor, who can be held liable for breach, to be established in an EU Member State. And both routes are costly and time‐consuming. The requirement of a presence in the EU increases costs and limits the benefits of seamless cross‐border digital trade, especially for smaller firms. As the survey of Indian firms revealed, the result could be a significant loss of business opportunities.

How can the EU’s legitimate need to protect privacy be fulfilled without obliging other countries to accept nation‐wide EU standards or to incur the substantial compliance costs associated with SCCs and BCRs? Simply seeking commitments from governments to the free flow of data in trade agreements, is not a solution because data‐source countries will not accept one‐sided limits on their right to protect privacy. Traditional regulatory cooperation through harmonization and mutual recognition is not only unlikely but insufficient. As even identical regulations across countries do not by themselves address the problem that regulators cannot control the behavior of data‐handling entities located outside their jurisdictions, and that regulators in these other jurisdictions are not mandated to look out for the interests of foreign citizens.

Instead of these traditional approaches, it may be more fruitful to build on a recent model of international cooperation. When the EU first enacted its privacy rules, privacy protection in the US was deemed inadequate and transatlantic data flows were threatened. In response, the EU and the US negotiated a Safe Harbor Agreement which was updated after the Snowden revelations as the Privacy Shield Agreement. At the heart of this deal is a promise by US firms to protect the privacy of European citizens to European standards in return for unrestricted data flows. The firms’ commitment is monitored and enforced by US institutions, notably the Federal Trade Commission and the Department of Commerce.

Since the EU has recognized US conformity assessment mechanisms under the Privacy Shield, it has created a valuable opening. WTO law on services trade requires the EU to offer other countries an opportunity to negotiate comparable arrangements. Developing countries must take advantage of the opportunity, while strengthening their case for recognition by building the institutional capacity to credibly assess conformity.

A recognition agreement with the EU would have big advantages over existing options. First, unlike in the case of BCRS and SSCs, firms would not be required to establish a costly presence in the EU because the assessment of conformity with EU standards would take place at home by domestic regulators. Second, unlike in the case of national adequacy, firms would not be obliged to adopt more stringent and more costly standards for data involving transactions at home or with countries less demanding than the EU. Thus, countries would be free to tailor domestic standards to domestic needs and export standards to foreign needs.

In general, we would expect countries to proceed step‐by‐step in small groups, self‐selecting into specific arrangements and gradually deepening them. As a first step, data source countries may continue to specify conditions unilaterally and determine conformity unilaterally, but lend additional transparency and predictability to their requirements by listing them, e.g. as Additional Commitments under Article XVIII of the GATS. A further step could be for data source countries to recognize conformity assessment in specific data destination countries when there is trust in enforcement even though norms diverge. In parallel, groups of countries, could also make collective additional commitments when they converge on regulatory requirements – say, in a WTO Reference Paper on