Data, Trade and Diplomacy: Will the EU–India FTA Shape India’s Strategy on Cross-Border Data Flows?
Addressing the Annual Meeting of the World Economic forum in Davos, Switzerland on 20th January 2026, President of the European Commission Ursula von Der Leyen said that “we are on the cusp of a historic trade agreement (with India). Some call it the mother of all deals. One that would create a market of 2 billion people, accounting for almost a quarter of global GDP.”
She was most likely referring to the Commerce Minister of India Piyush Goyal, who, while comparing it to the seven other deals India has signed with developed countries, called the upcoming EU-India deal as the ‘mother of all deals.’ Ursula von Der Leyen will be the chief guest of Republic Day Parade on 26th January 2026 in India, along with the European Council President António Costa, and it is expected that the EU-India Free Trade Agreement (FTA) will be signed during their visit.India and EU have been negotiating on a FTA since 2007.
Multiple rounds of negotiations have happened since then, but could not materialise due to significant differences over regulatory frameworks, market access, tariffs etc. The latest round of negotiations started in July 2022.One of the chapters in the current draft of FTA is on ‘Digital Trade’, with the key issues being privacy, data-flows, source code and cybersecurity among others. In this chapter, the EU has proposed cross-border data flows to facilitate trade in the digital economy, prohibiting the restrictions on storage and processing through data localisation measures.
In the public summary of the second round released by the EU in October 2022, it was mentioned that India presented a significant number of comments to the EU text proposal across the whole chapter on digital trade; along with the additional (new) proposals on issues that were not covered by the EU initial text proposal. In the public summary of the Twelfth Round of Negotiations in July 2025, it was mentioned that “this chapter was agreed in principle”.
While, there is no clarity so far on what has been agreed on data flows, it would be interesting to see what position India has taken in this regard, as it would not only shape India’s future strategic negotiations on digital trade, but also provide a clarity on India’s evolving approach on data localisation, which has seen several contradictory positions so far, both in domestic regulations and in international negotiations.The debate on data flow comes with several crucial dilemmas.
Data in its raw from does not have much value for digital economy, it requires storage, transfer and processing to turn it into a resource which could be monetised and used for different services. The infrastructures required for these processes are distributed across the world, creating the need for the data to flow across territorial borders.
It, however, poses challenges related to national security, legal jurisdictions and digital sovereignty. In the recent years, many countries of the world have started adopting different levels of data localisation measures citing the above mentioned grounds. Here it is important to understand that the default setting for data is to flow, and it requires domestic legislation to restrict the data flows across borders.
Once such regulations are enacted, cross border data flow needs interoperability not only in the technical standards, but also in the regulatory and policy standards. Interoperability requirements therefore shape dependencies in the global digital economy, compelling emerging actors to adapt their standards to those set by dominant actors in order to participate across different levels of the digital economy.
With the accelerating development and deployment of Artificial Intelligence, where data serves simultaneously as the raw material for building AI systems and the fuel that powers their operation, these dependencies become even more intense and critical.On the domestic front, there has been significant shift in India’s position on cross-border data flows, as evident in the different versions of Digital Personal Data Protection (DPDP) Act.
The first draft introduced in 2019, mandated to store and process critical personal data in India, and allowed transfer of sensitive personal data outside India with the condition to store a copy within the borders. These provisions were amended in the 2021 Bill, wherein, if the data principal has provided explicit consent, then transfers of sensitive personal data may be done to outside India.
In the 2022 draft, it was proposed that the Government will notify such countries or territories outside India to which a Data Fiduciary may transfer personal data. Taking a contrary approach in the 2023 draft, which was passed in 2025, it was proposed to rather notify country or territory outside India, where data can not be transferred. Reserver bank of India, however, mandates that the entire payment data shall be stored in systems located in India.
At the bi-lateral and multilateral levels as well, the similar shift can be noticed in India’s approach. Back in 2020, India opted out of the G20 led Osaka Declaration and its model of the data free flow with trust (DFFT) which allowed free cross border sharing of data. But in the India-UAE Comprehensive Economic Partnership agreement (CEPA), signed in 2022, it was agreed between the parties to promote data flows across borders without violating their respective data protection frameworks.
The EU, on the other hand, decides on cross-border data flows primarily through the General Data Protection Regulation (GDPR), approved in 2016 and enforced in 2028, which requires that personal data transferred outside the EU borders maintains an "essentially equivalent" level of protection. The European Commission determines this through ‘adequacy decisions’, which assess if a third country's legal framework offers sufficient safeguards, The European Commission has so far not recognised India in its adequacy decisions.
As mentioned earlier, data-flow requires interoperability on technical and regulatory standards and it would be interesting to see how it is being ensured in the India-EU FTA. India is also negotiating it’s trade deal with the United States and the US delegations have flagged data localisation provisions in DPDP Act and rules as non-tariff trade barrier for American tech companies.
The EU, unlike US, is a norms heavy partner, and it places strong emphasis on rules and standards. With the EU-India FTA most likely being signed before the India-US Deal, it would be interesting to see how the digital trade chapter in EU-India FTA shapes India’s future bi-lateral and multi-lateral strategic negotiations on cross-border data flows.
(The author is an Assistant Professor at the Human Sciences Research Centre, IIIT Hyderabad, India. She holds a PhD from the Centre for European Studies, Jawaharlal Nehru University, New Delhi)
