#India's Science Adviser Just Made the Case Against Data Localisation. MeitY Is Pushing the Other Way

A discussion paper from the Office of the Principal Scientific Adviser to the Government of India argues that mandatory data localisation India would raise compliance costs for startups, cut Indian researchers off from global datasets, and risk retaliatory trade action against a services export sector worth over $400 billion. It landed eight months after MeitY asked industry to comment on a proposal that would switch on cross-border transfer restrictions for Significant Data Fiduciaries a full eighteen months ahead of schedule.

Two arms of the same government, pointing in opposite directions, on the single DPDP question with the largest commercial consequence. That is the story, and it matters more than the paper's individual recommendations.

#What the paper says

The paper, Enabling Cross-Border Data Interoperability for AI Systems, was prepared by Animesh Jain and Kunal Thakur at the Office of the Principal Scientific Adviser, with inputs from Parvinder Maini and experts from iSPIRT and the Data Security Council of India. It was reported by ThePrint on 18 September. The document carries an explicit disclaimer that its views "should not be construed as formal policy positions of the PSA Office" — which is exactly the hedge you would expect on a paper that contradicts the direction of travel elsewhere in government.

Its central warnings are blunt. Mandating local storage and processing "raises compliance burdens, particularly for startups and MSMEs," and can "fragment global AI research ecosystems by limiting access to diverse datasets." On the trade front: "Stringent localisation measures may trigger retaliatory trade actions, affecting digital trade and services exports."

The paper anchors that in scale. India's digital economy was about 11.74 percent of GDP — roughly ₹31.64 lakh crore, or over US$400 billion — in 2022-23, and is projected to reach nearly a fifth of GDP by 2030. It cites economic modelling suggesting balanced cross-border regimes could add 1.77 percent to global GDP and 3.6 percent to exports, while highly restrictive ones could subtract 4.5 percent and 8.5 percent respectively. Those are global figures from modelling exercises, not India-specific forecasts, and should be read as directional rather than predictive. The directional point is the one that counts: a country exporting software and IT services at India's volume is unusually exposed to reciprocity when it restricts data flows.

#The proposal underneath the warnings

Strip out the localisation critique and the paper is making a constructive argument: treat cross-border data movement as a graded problem rather than a binary one.

It sets out a risk-tiered ladder linking data sensitivity to transfer pathway. Aggregated and statistical data moves through open exchange. Identifiable data moves under controlled-access agreements. Strategic and national-security data stays domestic, with only approved outputs leaving the country through secure processing environments — the model where the analysis travels to the data rather than the data travelling to the analyst.

This is not a novel framework in international practice, but it is a pointed one in the Indian context, because it implies that most AI training and research data does not need localisation at all. The sovereignty concerns that justify restriction — foreign surveillance exposure, weaker regulatory oversight in destination jurisdictions, concentration of data in a handful of global technology firms — are real, the paper acknowledges, but they attach to specific categories, not to personal data as a class.

Institutionally, it recommends constituting "a central interdisciplinary AI-data interoperability coordination body" within the National Data Governance Committee, as a nodal mechanism that "would not replace existing regulators but coordinate with them."

#Where this collides with MeitY

Here is the friction. On 23 January 2026, MeitY held stakeholder consultations and proposed compressing the DPDP compliance window from eighteen months to twelve, which would move the full compliance date from 13 May 2027 to 13 November 2026. Bundled into that proposal was immediate commencement of Rules 13(4) and 15 of the DPDP Rules, 2025 for Significant Data Fiduciaries — the provisions under which SDFs must comply with restrictions the Central Government notifies on transferring specified personal data outside India, on the recommendation of a designated committee. A separate acceleration applied to Rule 8(3) retention standards, with a ninety-day implementation clock. Comments were due 4 February 2026.

As things stand today, none of that has been notified. Section 16 of the DPDP Act still operates on a negative-list model: transfers are permitted to anywhere, subject to sovereign power to restrict specified destinations, and the restricted-country list remains empty. Rule 15 does not commence until 13 May 2027. We covered the consequences of that gap for contract drafting yesterday: vendor agreements across the market have been redrafted around a transfer mechanism that does not yet legally exist.

So the sequence reads: MeitY floats accelerating a localisation-capable mechanism in January; nothing is notified through the spring and summer; in September the Principal Scientific Adviser's office publishes a paper arguing the economics run the other way. Whether that is coordination or contestation, nobody outside government can say. But a discussion paper from the PSA's office is not an op-ed. It is a signal that the interoperability case has institutional backing inside the system, and that the Rule 13(4) committee — whenever it is constituted — will not face a settled consensus.

The sectoral picture already reflects the split. The paper characterises the RBI's 2018 Storage of Payment System Data direction as "localisation-first, with domestic storage remaining the default and only narrow operational exceptions permitted." DPDP, by contrast, is the most permissive major transfer regime among large economies. India is simultaneously running a hard-localisation regime for payments and an open regime for everything else, and nobody has reconciled the two.

#The international framing is a negotiating position

The paper's comparative section is doing work beyond description. It notes that the United States adopted an access-based model under Executive Order 14117, targeting "bulk sensitive personal data" and "government-related data" transfers to designated countries of concern — and that India does not appear on that list. China is described as applying stricter controls to sensitive categories.

Read that alongside the trade-retaliation warning and the argument becomes: India currently sits on the permissive side of a line the US draws, which is an asset in digital trade negotiations, and hardening the domestic regime would put that at risk. The EU adequacy question sits in the same frame. India holds no adequacy decision from the European Commission, and DPDP's consent-centric structure and broad state exemptions are the known obstacles. A localisation turn would not help that file either.

#Another seat at an already crowded table

The recommendation for a new coordination body deserves scrutiny, because India's AI and data governance architecture is not short of committees.

MeitY's India AI Governance Guidelines, released in November 2025, established an AI Governance Group, a Technology & Policy Expert Committee, and an AI Safety Institute, on the stated premise that India needs no standalone AI law because DPDP, the IT Act and sectoral regulators already apply. In May 2026 the Committee of Secretaries approved a National Framework for Data Sharing prepared by MeitY, with an India Data Management Office under the Digital India Corporation. Sectoral regulators — RBI, SEBI, IRDAI, TRAI — each run their own data rules. And the body that is supposed to enforce DPDP itself, the Data Protection Board of India, still has no chairperson and no members, despite MeitY inviting applications in May 2026 and again in June.

Proposing a fifth coordinating mechanism while the primary enforcement body remains unstaffed is a fair criticism of the paper, even if its substantive analysis is sound. Coordination bodies do not resolve disagreements between regulators; they relocate them.

#Health data is the honest test case

The paper applies its framework to health data, and that choice is instructive. It references India's existing standards work — HL7 FHIR, DICOM, the MIDAS initiative — and the collaboration announced at the AI Impact Summit 2026 between the Indian Council of Medical Research and France's Health Data Hub to test the Data Empowerment and Protection Architecture for traceable access to Indian and French health data for public-interest research.

Health data is the case where every tension is live at once. It is among the most sensitive personal data DPDP covers. Medical AI research is close to worthless without diverse, multi-population datasets. And India already carries localisation expectations for health records through DISHA-era guidance. If a graded framework cannot be made to work for health data, it cannot be made to work anywhere. If it can, the argument for blanket localisation weakens considerably.

#What this means for Indian businesses now

Nothing in this paper changes any obligation. No rule was notified, no deadline moved, no country restricted. But three practical conclusions follow.

Do not build architecture on the assumption that the permissive regime is permanent. The negative list is empty today and Rule 15 is dormant until May 2027, but MeitY has already proposed switching SDF restrictions on early, and the PSA paper is evidence that the question is contested rather than closed. If you are an organisation likely to be designated a Significant Data Fiduciary — large consumer platforms, financial services, health, telecom — your data map should identify which processing you could repatriate, how fast, and at what cost. That is a tabletop exercise, not a migration.

Distinguish personal data transfers from AI training data. The paper's tiering logic suggests that aggregated and de-identified datasets will face a materially lighter path than identifiable personal data. Organisations that can demonstrate rigorous de-identification and document it will be better placed under any regime that emerges. Organisations that treat "we anonymised it" as an assertion rather than a tested control will not.

Watch the Rule 13(4) committee, not the headlines. The legal power to restrict transfers runs through a committee recommending restrictions to the Central Government. The composition and mandate of that committee will determine whether India lands closer to the PSA paper's graded model or MeitY's January proposal. Its constitution is the event worth tracking.

#The question nobody has answered

India's cross-border data policy is currently being written in three places at once: in DPDP Rules that have not commenced, in a MeitY consultation that produced no notification, and now in a discussion paper from an office that explicitly disclaims policy authority. Businesses are being asked to plan against that.

The paper is candid that it is "not intended to be final or exhaustive," offering "entry points through which the Indian AI ecosystem may begin discussion." That is the right posture for a discussion paper. It is an uncomfortable position for a country whose substantive data protection obligations commence in nineteen months and whose consent manager framework goes live in under two.

For the current commencement tables, SDF designation criteria and our running tracker of what is actually in force, see /resources. If you are assessing consent infrastructure ahead of the 13 November 2026 registration window, our consent manager breakdown covers what registration actually requires.