Ensuring Data Residency and Portability

Governments around the world have been trying to regularise it so that local laws may apply, but this is proving elusive in the absence of enforceable cross-border legal agreements

- Sujit Bhar

Recently at a function, Tata Sons Chairman N Chandrasekaran reiterated that the government should take proactive steps towards establishing the regulatory standards required for data privacy, data residency and data localisation. The call could not have been made at a better time. Now that the world is preparing for the long leap, as Covid-19 vaccines slowly come into the market, we need to be prepared with all facilities and contingencies. The pandemic has shown that business in the “cloud” is here to stay. Whether people work from home, or initiate B2B or B2C transactions, or take part in physical exchanges with the help of the cloud, or even if they troop back to their offices, cloud computing and data portability will experience similar levels of acceleration, if not more.

That is where data security comes into play. Governments around the world have been trying to regularise data localisation, so that local laws may apply, but this is proving elusive in the absence of cross-border enforceable legal agreements.

What is data residency? Simply put, it refers to the physical or geographic location of an organisation’s data or information. If Company A, based in New Delhi, stores all its data in a California-based server, then the laws of India might not apply to it. Why do we need these laws to apply? If a set of data, say, is adjudged by an Indian court to be perverse or as critical evidence, the court would want the data, and the server that hosts it, to be isolated and sealed. Data stored in the server would be an exhibit in the case.