Consequent to the Indo-US Tariff war where Trump has imposed discriminatory tariff on India, it is expected that India may respond with counter measures.
One counter measure which is likely to come is through the adoption of DPDPA 2023 quickly and bring the large US Digital Firms under leash for using the personal data of Indian citizens with impunity.
One of the first measures in this regard should be to tighten the Data Localization requirement under Section 16 of DPDPA 2023. Within the next 6 months, India should mandate total data localization for all big Tech companies such as Google, Meta, Amazon, Apple and Microsoft. These five companies have already been flagged by EU as “Gatekeepers” under the Digital Marketing Act and along with the upcoming EU Data Use Act which is becoming effective from 12th September 2025, and mandating that such companies shall not
“a) solicit or commercially incentivise a user in any manner, including by providing monetary or any other compensation, to make data available to one of its services that the user has obtained pursuant to a request under Article 4(1);
(b) solicit or commercially incentivise a user to request the data holder to make data available to one of its services pursuant to paragraph 1 of this Article;
(c) receive data from a user that the user has obtained pursuant to a request under Article 4(1).“
According to Article 4(1) of the Act,
1. Where data cannot be directly accessed by the user from the connected product or related service, data holders shall make readily available data, as well as the relevant metadata necessary to interpret and use those data, accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time. This shall be done on the basis of a simple request through electronic means where technically feasible.
This means that such organizations will now have to provide “Data Access Rights” free of charge.
Such provision can be brought in the DPDPA Rules as part of the Data Principal Rights Access and also by enabling local Data storage by these organizations as well as VISA , CIBIL and other Financial data processors.
In due course this would encourage more data centers to come up in India and boost the Data Storage related services.
Naavi
