India, having the second largest population in the world, with a young, consumer oriented society, is emerging as a virtual treasure trove of information. India is likely to become one of the largest sources of commercially useful data in the world. In light of the increasing importance of data protection and privacy, the National e-Commerce Policy (“Policy”) aims to regulate cross-border data flow, while enabling sharing of anonymised community data (data collected by IoT devices installed in public spaces like traffic signals or automated entry gates).
Conditions are required to be adhered to by business entities which have access to sensitive data of Indian users stored abroad. Sharing of such data with third party entities, even with customer consent, is barred under the Policy.
A legal and technological framework will be created to provide the basis for imposing restrictions on cross-border data flow from the following specified sources:
a) Data collected by IoT devices installed in public space
b) Data generated by users in India by various sources, including ecommerce platforms, social media, search engines etc.
The legal and technological framework would also provide basis for sharing the data collected by IoT devices under (a) above with domestic entities for use in research and development for public policy purposes.
A business entity that collects or processes any sensitive data in India and stores it abroad, shall be required to adhere to the following conditions:
a) All such data stored abroad shall not be made available to other business entities outside India, for any purpose, even with the customer consent
b) All such data stored abroad shall not be made available to a third party, for any purpose, even if the customer consents to it
c) All such data stored abroad shall not be made available to a foreign government, without the prior permission of Indian authorities
d) A request from Indian authorities to have access to all such data stored abroad, shall be complied with immediately
e) Any violation of the conditions mentioned above shall face the prescribed consequences