First Principles IAS · Current affairs
Everything filed · Internal Security › Cyber security and money laundering › Data, social media and digital sovereignty
Printed on · firstprinciplesias.com/current-affairs
Internal Security › Cyber security and money laundering
हिन्दी — Read in HindiData, social media and digital sovereignty
Who controls data and digital networks, and the security questions that control raises.
Asked before
- Prelims 2026: Which of the following statements with regard to Large Language Models (LLMs) used in machine learning is/are correct? 1. LLMs assign pro…
- Prelims 2026: Which of the following statements with regard to Black Boxes used in modern aircrafts is/are correct? 1. They carry a beacon emitting red…
- Prelims 2026: Which of the following statements with regard to drone swarms is/are correct? 1. They use Terahertz band of frequency to communicate with…
- Prelims 2026: Which of the following statements with regard to the National Quantum Mission (NQM) is/are correct? 1. It aims at developing intermediate…
- Prelims 2026: Which of the following statements about DHRUV64 is/are correct? 1. It is the third chip fabricated under the DIR-V Programme with an over…
- Prelims 2026: Which of the following statements regarding the features of blockchain technology are correct? 1. Records stored in the database may be m…
- Mains 2026 GS3: Explain how fake news and disinformation pose threat to Internal Security and Public Order in Indian context? In this regard, discuss sal…
- Mains 2026 GS3: Discuss counterfeit currency and money laundering as major sources of terror funding in India. State the actions being taken at Internati…
Data localisation and security: what must stay in India
Copy link to Data localisation and security: what must stay in IndiaStandardPrelims and Mains31 Jul 2026
What it is
- Data localisation is a legal requirement that certain data be stored, or a copy of it kept, on servers physically in India, so that Indian regulators and courts can reach it and a foreign government cannot.
- India has no single localisation law. Four regimes do the work: the Reserve Bank of India's circular of 6 April 2018, which requires payment system operators to store payment data only in India; the Indian Computer Emergency Response Team's directions of April 2022, which require ICT system logs to be kept in India for 180 days and incidents reported within six hours; the Companies Act rules, which require a daily backup of electronic books of account on servers in India; and the Digital Personal Data Protection Act, 2023 with its Rules of 2025.
- The 2023 Act took the opposite road from the Srikrishna Committee of 2018, which had asked for a copy of all personal data to be kept in India and critical data to be stored only here. The Act allows transfer to any country except those the Centre notifies, a negative list, and no country has been placed on it.
| Regime | What must stay in India |
|---|---|
| Reserve Bank of India circular, 6 April 2018 | Payment system data, stored only in India, by payment system operators and their service providers |
| CERT-In directions, April 2022 | ICT system logs kept in India for 180 days; incidents reported within six hours |
| Companies Act rules | A daily backup in India of electronic books of account kept abroad |
| Digital Personal Data Protection Act, 2023 and Rules, 2025 | Transfer abroad allowed except to countries the Centre notifies (a negative list, still empty); Rule 15 conditions on transfer by order; Rule 13 data a significant data fiduciary may not take out; in force 13 May 2027 |
| The road not taken: Srikrishna Committee, 2018 | A copy of all personal data in India; critical personal data stored only in India; dropped by the 2023 Act |
What happened
- The Digital Personal Data Protection Rules were notified on 13 November 2025 in three phases: the Data Protection Board at once, consent managers from November 2026, and the substantive duties, including the two localisation rules, from 13 May 2027.
- Rule 15 lets a data fiduciary transfer personal data abroad only subject to conditions the Centre sets by general or special order, which may turn on whether a foreign State or its agencies could reach the data. Rule 13 lets the Centre, on a committee's recommendation, designate categories of personal data and traffic data that a significant data fiduciary may not take out of India at all.
- The Kudankulam leak of July 2026, in which a contractor's plant data sat with a third party provider, is the security case for the second rule: the data that matters most was not covered by any of the four regimes.
Why it matters
- The security argument is reach: a server in India answers to an Indian court, a warrant and a CERT-In direction; one abroad answers to a foreign one first, and the Meta and Telegram disputes of recent years have all turned on this.
- The economic argument runs the other way: localisation raises costs, fragments the cloud and invites the same demand from other countries against Indian firms, which is why the Act chose a negative list over a mandate.
- The design in the Rules is a middle path: free flow by default, a black list of countries, and a white list of data that must stay, which lets the Centre localise the data that carries risk, the critical infrastructure kind, without localising everything.
Exam lens
- Prelims: the RBI's payment data circular of 6 April 2018; CERT-In's 2022 directions, logs for 180 days in India and reporting within six hours; the DPDP Rules notified 13 November 2025, substantive duties from May 2027; Rule 13, data a significant data fiduciary may not transfer abroad; the negative list under the Act.
- Mains: whether a negative list of countries and a white list of data secure India's data better than the Srikrishna mandate would have.
Asked before: Mains 2024 GS3 · Mains 2018 GS3
Show the questions
- Mains 2024 GS3: Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
- Mains 2018 GS3: Data security has assumed significant importance in the digitized world due to rising cyber crimes. The Justice B. N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyber space?
Connects to
- Cyber security of critical infrastructure: the Kudankulam leak (Internal Security, July): the data that should have stayed.
- The right to information and the data protection law (Polity, August): the other challenge to the 2023 Act.
- Safe harbour and the Meta takedown (Polity, August): the platform whose data sits abroad.
Sources
- Hogan Lovells, “India's Digital Personal Data Protection Act 2023 brought into force”
- Bar and Bench, 18 August 2026, “Data localisation is not a binary question”
- Mondaq, 26 March 2026
- Inc42, 22 October 2018
- PIB, 30 July 2026
Settled facts (dates of Acts, constitutional provisions, standing definitions) are from standard references.
Also filed elsewhere
- Internet shutdowns · on Media, online content and its regulation
Exam lens: Section 20 of the Telecommunications Act, 2023; the 2024 Suspension Rules; Anuradha Bhasin (2020).
- Safe harbour and the Meta takedown · on Media, online content and its regulation
Safe harbour is the protection that Section 79 of the Information Technology Act, 2000 gives an intermediary, a platform that hosts what its users post, from liability for that content, so long as it does not initiate or modify the content and takes it down when lawfully required.
- Vehicle to vehicle communication: compulsory from October 2028 · on Satellite and emerging communications
A vehicle fitted for vehicle to vehicle (V2V) communication broadcasts what it is doing to the vehicles around it and listens for the same from them.