Data flows: India, EU kick can down the road, to review later

22 MB/s or Diplomacy on Ice: The Data Flow Story

The India-European Union (EU) Trade and Technology Council (TTC), convening on March 1, 2026, in Brussels, walked away from a pivotal opportunity to resolve cross-border data flow disputes. Instead, they punted: a commitment to "review the matter later" was signed, delaying any substantive reckoning. This, despite three years having passed since the Ballpark Agreement of 2023 — which was supposed to outline the regulatory parameters for data transfers between Indian and EU entities. The irony? Indian IT exports to the EU, projected to surpass $22 billion in FY27, are growing even as regulatory uncertainty deepens.

A Familiar Pattern of Deferral

This vague diplomatic outcome is not unexpected, but it marks a critical shift compared to prior rhetoric. In 2024, Union IT Minister Ashwini Vaishnaw had declared India "an inch away" from achieving adequacy status under EU’s General Data Protection Regulation (GDPR). Adequacy status would exempt India from restrictions on data transfers, enabling frictionless digital commerce. Instead, the EU now expresses concerns about India’s Digital Personal Data Protection Act, 2023, particularly Section 17, which allows the Central Government to block cross-border data transfers if deemed against public interest. This, EU negotiators argue, conflicts with GDPR’s strict geographical constraints on data jurisdiction.

The deadlock reflects a broader trend in India’s foreign negotiation posture: delay and ambiguity where clarity is impossible. Past instances include delays in finalising the Regional Comprehensive Economic Partnership (RCEP) or the tempering of WTO e-commerce discussions. The TTC’s outcome this week is an extension of that very rhythm — avoiding substance in favour of superficial progress.

The Levers of Disagreement

The EU’s skepticism stems largely from the handling of three interlinked frameworks: GDPR, adequacy negotiations, and India’s recent data laws. At the heart of the tension lie two critical concerns:

• Section 17 of India’s Digital Personal Data Protection Act (DPDPA): While legal experts argue that data localisation mandates in India are softer compared to early drafts of the bill, Section 17 empowers the Central Government with vast discretion. Transparency mechanisms remain unspecified.
• EU Restrictiveness: GDPR, touted as the gold standard globally, prohibits its members from transferring personal data freely to jurisdictions without parity in privacy safeguards. India, in contrast, permits data transfer to “trusted” geographies as defined by executive orders, making regulatory parity difficult to assess.

Further, the lack of a fully established Data Protection Board under the 2023 Act weakens India’s readiness. As of February 2026, the board’s appointment remained ad hoc, leaving no institutional capacity to mediate between Indian stakeholders and EU regulators.

What Do Firms Face?

The Indian IT ecosystem — comprising multinational giants like Infosys, Wipro, and TCS — finds itself in a quandary. Data processing contracts sourced from the EU accounted for an estimated 27% of their export revenues in FY25. Moreover, industry bodies like NASSCOM estimate losses to the tune of ₹23,000 crore annually if EU restrictions on outsourcing become stricter.

The Indian government, on its part, promotes the narrative of strategic sovereignty, claiming that “what applies to us applies to others” — a veiled reference to the European Digital Services Act (2022) and its mandated compliance for U.S. tech firms. But what this misses is that compliance readiness in India is uneven at best. A NITI Aayog survey from 2024 found only 16% of firms even aware of their data protection obligations under DPDPA.

The Lessons from Japan

If India is looking for a path forward, Japan provides a revealing counterpoint. In 2018, Japan became the first Asian country to gain EU adequacy status, owing to a deal that incorporated GDPR terms into its domestic legislation. Crucially, Japan agreed to establish independent oversight mechanisms — something India has thus far resisted. More importantly, adequacy recognition injected substantial dynamism into Japanese digital services, specifically in cloud computing exports, which rose by $5 billion within two years.

India, by contrast, has approached adequacy less as an economic opportunity and more through the lens of sovereignty and non-alignment. While such a stance plays domestically, it leaves Indian firms at a comparative disadvantage globally.

The Real Question: Strategy or Stasis?

What is striking about the TTC process — and its recent deferral — is not just the absence of agreement but its predictability. Both sides cite “technical divergences” but refuse to acknowledge the elephant in the room: mismatched institutional mechanisms. Where the EU operates via principled regulation codified under GDPR, India uses executive leeway. As a result, negotiations always arrive at the same impasse.

The uncomfortable truth is that neither side may genuinely desire adequacy. For the EU, India’s regulatory opacity risks undermining GDPR’s global credibility. For India, accepting adequacy could curb the discretion it fiercely guards in digital lawmaking. This deadlock favours political posturing but leaves industry without critical clarity.

Practice Questions for UPSC

Prelims Practice Questions

Frequently Asked Questions