Are cross-border data transfer and storage rules mandatory for foreign e‑commerce platforms operating in India?

As e-commerce continues to grow globally, many foreign platforms are increasingly catering to Indian consumers. With the rise of digital transactions, personal data of Indian users is often transferred, stored, or processed across borders. Cross-border data transfer and data storage have therefore become critical issues under Indian law. Foreign e-commerce platforms operating in India are required to comply with India's data protection laws, especially when dealing with sensitive personal data.

India is currently in the process of strengthening its data protection regime through the Personal Data Protection Bill (PDPB), which imposes strict data localization and cross-border data transfer rules. These laws are aimed at securing consumer data, ensuring privacy, and regulating the transfer of data outside India to prevent misuse. Therefore, foreign e-commerce platforms must understand and adhere to these regulations to operate legally in India.

1. Legal Framework Governing Data Transfer and Storage for Foreign Platforms

a. Personal Data Protection Bill (PDPB)

The Personal Data Protection Bill (PDPB), which is currently under review in India, is set to become the primary law governing data protection in India. Key provisions related to cross-border data transfer and storage include:

• Data Localization: The PDPB mandates that sensitive personal data and critical personal data must be stored in India. While non-sensitive personal data can be transferred outside India, it must adhere to certain conditions, such as ensuring that the data recipient country provides adequate protection for data privacy.
• Cross-Border Data Transfer: The PDPB provides that personal data can only be transferred outside India if the recipient country offers adequate data protection standards. Alternatively, platforms may be required to enter into standard contractual clauses or obtain explicit consent from users for cross-border data transfers.

b. The Information Technology Act, 2000 (IT Act)

The IT Act is another important law that governs cyber activities in India, including the storage and transfer of electronic data. Relevant provisions under the IT Act include:

• Intermediary Guidelines: Foreign e-commerce platforms operating in India are considered intermediaries under the IT Act. They must comply with the due diligence requirements and cooperate with law enforcement agencies in case of data breaches or cybercrimes.
• Sensitive Personal Data: Under the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, platforms are required to store sensitive personal data securely and ensure that it is not transferred to unapproved jurisdictions without proper security protocols.

c. Data Localization Requirements

In addition to the PDPB, India’s growing emphasis on data localization means that foreign e-commerce platforms may be required to store certain types of personal data of Indian users within India. This is intended to ensure better data security, facilitate easier government access to data for investigation purposes, and limit data exposure to foreign jurisdictions with less stringent privacy laws.

d. Other Relevant Regulations

• Foreign Exchange Management Act (FEMA): If an e-commerce platform processes payments or transfers funds, it may also need to comply with FEMA regulations related to cross-border financial transactions.
• The Reserve Bank of India (RBI) Guidelines: For platforms dealing with payment data, RBI mandates certain security measures to ensure the protection and storage of payment data in India.

2. Key Data Transfer and Storage Rules for Foreign E-Commerce Platforms

a. Data Localization

Under current laws, and likely in future PDPB regulations, sensitive personal data (e.g., financial information, health data, and biometric data) must be stored within India. This means that foreign platforms must either:

• Set up data centers in India to store such data.
• Partner with Indian service providers that comply with Indian data laws to store data on their behalf.

b. Cross-Border Data Transfer Rules

Foreign e-commerce platforms can transfer personal data of Indian consumers abroad only if the country receiving the data ensures a level of protection equivalent to India's standards.

• Standard contractual clauses must be included when transferring data to countries without adequate protection.
• Explicit consent from Indian consumers may also be required for cross-border data transfers.

c. Data Security Obligations

Foreign e-commerce platforms must ensure the security of personal data during storage and transfer by adopting adequate measures, such as:

• Encryption during transmission.
• Implementing robust cybersecurity protocols.
• Regular audits to ensure compliance with Indian data protection requirements.

d. Data Protection Officer (DPO)

Platforms that process large amounts of personal data of Indian consumers may be required to appoint a Data Protection Officer (DPO) under the PDPB. The DPO must ensure compliance with data protection laws and act as the primary contact for data subject rights.

3. Consequences of Non-Compliance

If foreign e-commerce platforms fail to comply with data localization and cross-border data transfer regulations, they could face several legal and financial consequences:

• Fines: Platforms could be penalized with hefty fines for violating the PDPB, which could range from ₹5 crore to ₹15 crore or 2% to 4% of global turnover, depending on the nature and severity of the violation.
• Reputational Damage: Non-compliance with data protection laws can severely damage a platform's reputation, leading to consumer distrust and loss of business.
• Legal Action: Indian regulatory authorities like the Data Protection Authority could take legal action against platforms for failing to adhere to data protection norms. In addition, consumers could seek compensation through courts for data breaches or misuse of their information.
• Suspension of Operations: In extreme cases, foreign platforms may face a ban or suspension of their services in India if they fail to follow data protection regulations.

Example Scenario

Example:

A global e-commerce platform operating in India stores Indian users' personal data on its servers in the United States, without complying with the data localization provisions under the Personal Data Protection Bill. The platform has not obtained explicit consent from users for transferring their data outside India.

As a result:

• The platform faces a ₹10 crore fine under the PDPB for non-compliance with data localization rules.
• Consumers file complaints against the platform for breaching their privacy and misusing their data.
• The platform is required to relocate the sensitive data to India within a specified timeframe and establish data security measures to comply with Indian laws.

Conclusion

Yes, foreign e-commerce platforms operating in India are required to comply with cross-border data transfer and data storage rules under Indian law, particularly the Personal Data Protection Bill (PDPB) and the Information Technology Act, 2000. These platforms must ensure that sensitive personal data is stored within India and adhere to strict protocols for cross-border transfers of personal data. Failure to comply with these rules can result in significant financial penalties, legal action, and reputational damage. As India's data protection regime continues to evolve, foreign e-commerce businesses must stay updated on the latest regulatory requirements to avoid legal repercussions.