Assessing the International Impact of the PIPL and the PDP Bill


Foreign entities will be required to comply with the PIPL strictly due to the law’s extra-jurisdictional powers. According to Chapter 3 of the PIPL, if a ‘personal information processor’, which is the equivalent of a data processor in India[4], wishes to transfer data beyond the People’s Republic of China, it has to comply with one of the following conditions

  1. pass a security assessment set by the Cyberspace Administration of China[5],
  2. certification for personal information protection by the State cybersecurity and informatisation department,
  3. conclude a contract with a foreign entity in accordance with standards laid out by the government and
  4. meet ‘other conditions’ provided by the government.

The PDP Bill, 2019

The PDP Bill, on the other hand, adopts a more liberal approach to cross-border data transfers. It makes a distinction between transfers of ‘sensitive personal data’ (‘SPD’), ‘critical data’, and ‘personal data’.[8] Personal data can be transferred outside India without any regulatory approval, while the transfer of SPD requires approval from the authorities.[9] Additionally, the contracts governing data transfers need to include provisions to effectively protect the rights of the ‘data principal’ and affix liability on the exporter for any harms caused.[10] Data principals are defined as “the natural person to whom the personal data relates”.[11] In case data transfers take place to another country/entity/international organisation, the SPD shall be protected and not prejudice the enforcement of laws by authorities in India. Critical data can only be transferred outside the country in case of a health emergency or to an international organisation, because the government believes that it will not affect the security of the state

The Importance of Free Flow of Data

The PIPL will trigger debates on the approaches countries take to regulate their digital economy. Data is an important competitive factor in today’s world, depending on who creates it, owns it, those it is shared with, and the rule-making bodies.[16] The digital transformation has introduced data as a new form of capital. It has the potential to create large rents, trigger international rivalry and raise negative externalities that require regulation.[17]



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Esya Blog

Esya Blog

The Esya Centre is a technology policy think tank based in New Delhi, India