Revised data protection bill to ease infrastructure cost: experts

The draft of the new bill, which the stakeholders expect to be released on Friday, is expected to identify so-called ‘friendly geographies’ to host user data, as opposed to earlier versions that required sensitive data to be necessarily stored in India.

“The biggest roadblock to mandating compulsory localization of data is the sheer cost of moving mass-scale data operations to India, from established markets such as the US or EU. It is not just their data that a venture would have needed to shift—migrating and localizing data in the country would require the data infrastructure mainframe, and a host of applications built on the mainframe, to be built in India,” said Sanchit Vir Gogia, founder and chief analyst of market researcher, Greyhound Research. This, he said, would have “more than doubled” the cost of handling and operating data for domestic firms. Consequently, mandatory data localization could have ended up having a massive impact on both startups and large firms, which typically use US-based data hosting and cloud services platforms such as Amazon Web Services (AWS), Microsoft Azure and Google Cloud. Mint reported earlier on Wednesday that the new Digital Data Protection Bill will help ease compliance for companies in India, by relaxing ‘some’ data localization, processing and storage norms.

To be sure, startups and companies had voiced concerns on compulsory data localization proposed in the previous Data Protection Bill — scrapped by the government on 3 August. At the time, Rajeev Chandrasekhar, minister of state for information technology, said the compliance burden upon homegrown startups was one of the reasons for withdrawing the previous bill.

Experts now say that with the proposed law, India’s approach to data protection could be in line with Europe’s General Data Protection Regulation (GDPR), among the most notable data protection laws in the world.