New Delhi: A government discussion paper has cautioned that forcing startups to store and process data within the country could raise costs, cut Indian researchers off from global datasets and invite retaliatory trade action. It also proposed a dedicated body to govern how data for artificial intelligence moves across borders.
The paper, ‘Enabling Cross-Border Data Interoperability for AI Systems’, made public Thursday and produced by the Office of the Principal Scientific Adviser (PSA) to the Government of India, warns that mandating local storage and processing “raises compliance burdens, particularly for startups and MSMEs,” and can “fragment global AI research ecosystems by limiting access to diverse datasets”.
It also says, “Stringent localisation measures may trigger retaliatory trade actions, affecting digital trade and services exports.” It carries the caveat that its views “should not be construed as formal policy positions of the PSA Office.”
The paper has been prepared by Animesh Jain, Senior Policy Fellow, and Kunal Thakur, Policy Analyst, at the PSA office, with inputs from reviewers including Parvinder Maini, scientific secretary in the office, and experts from the software think tank iSPIRT and the Data Security Council of India.
Citing Organisation for Economic Co-operation and Development (OECD) and World Trade Organisation modelling, the paper says balanced approaches “can increase global GDP by around 1.77 percent and global exports by about 3.6 percent”, while “highly restrictive or fragmented data regimes may reduce global GDP by nearly 4.5 percent and exports by around 8.5 percent”.
A footnote adds that these are simulations “based on hypothetical global scenarios, rather than observed economic outcomes”, and that earlier modelling estimated a GDP impact of around 0.1 percent for selected localisation measures in India.
The warning about retaliatory trade action lands at a point when trade friction is already shaping India’s external economic relations. In 2025, the United States raised tariffs on Indian goods to 25 percent and then to 50 percent, in part over India’s continued purchase of Russian oil.
The two sides announced a framework trade deal in February 2026 that lowered the reciprocal tariff to 18 percent and removed the additional 25 percent levy, with negotiations on a broader bilateral trade agreement continuing. Digital trade barriers, including data localisation, have featured among the non-tariff issues raised in such negotiations.
The paper also identifies risks at the other end. Unrestricted flows, it says, raise concerns including “exposure to foreign surveillance, reduced regulatory oversight when data is processed in jurisdictions with weaker safeguards, and the risk of data concentration in the hands of a few global technology firms”.
The context is the expansion of India’s digital economy, which the paper notes accounted for “about 11.74 percent of GDP, equivalent to approximately Rs 31.64 lakh crore (over US$400 billion), in 2022-23 and is projected to reach nearly one-fifth of GDP by 2030.”
Why AI changes the question
The paper argues that AI shifts the terms of the debate because the object crossing a border may not be a dataset. “In AI systems, the object crossing the border may be raw data, model parameters, analytical outputs or a trained model,” it states. A model trained on restricted data “may retain, reproduce or enable inferences about information contained in its training records, even where the underlying data remain within the country”.
On this basis, the paper proposes a four-tier “risk-aligned matrix” that links data sensitivity to transfer pathways. Aggregated or statistical data would move through “open/low-friction international exchange”; identifiable data would require a “controlled-access agreement/trusted corridor”; and data classified as strategic or national security would remain domestic, with only “approved outputs” permitted to leave through “secure model-to-data/federated processing”.
The India context
The paper reviews India’s existing instruments. It notes that Section 16 of the Digital Personal Data Protection Act, 2023, gives the central government a “negative-list model under which cross-border transfers are generally permitted but remain subject to sovereign control,” and that “the substantive cross-border transfer provisions are scheduled to become operational in May 2027”.
It describes the Reserve Bank of India’s 2018 Storage of Payment System Data direction as “localisation-first, with domestic storage remaining the default and only narrow operational exceptions permitted”.
The DPDP Act’s cross-border rules have not yet been triggered. As of mid-2026, the Centre had not notified any restricted countries under Section 16, and the core obligations are due to commence on 13 May 2027. MeitY has separately floated shortening the compliance window for Significant Data Fiduciaries.
Positioning between US and China
The paper surveys the approaches of other jurisdictions. It records that the United States, under Executive Order 14117, “has adopted an access-based model for ‘bulk sensitive personal data’ and ‘government-related data” and that China “applies stricter controls to sensitive data and critical information infrastructure”. India does not appear on the US list of “countries of concern” which names China, Cuba, Iran, North Korea, Russia and Venezuela.
The paper’s framework is built on three pillars it calls compatibility, accountability and coordination, presented as “an overlaid interoperability layer on extant governance mechanisms, rather than considering as a new AI data-governance regime”.
A demonstration and a recommendation
The paper applies its framework to health data, where it says India already has technical standards including HL7 FHIR and DICOM, and initiatives such as the Medical Imaging and Information Datasets for India (MIDAS). It references the collaboration announced at the AI Impact Summit 2026 between the Indian Council of Medical Research and the French Health Data Hub to test the Data Empowerment and Protection Architecture for “secure and traceable access to Indian and French health data for public-interest research”.
Among its recommendations, the paper proposes that within the National Data Governance Committee, “a central interdisciplinary AI-data interoperability coordination body may be constituted as a nodal institution mechanism”. It states this body “would not replace existing regulators but coordinate with them”.
The paper describes itself as “not intended to be final or exhaustive”, offering “entry points through which the Indian AI ecosystem may begin discussion”.
(Edited by Viny Mishra)
Also read: India is mistaking data localisation for digital sovereignty. It must control the traffic system