Data Sovereignty As An Enterprise Risk: Localisation Strategy, Regulator-To- Regulator Co-Operation Under India’s Digital Personal Data Protection Act, 2023
- IJLLR Journal
- 20 minutes ago
- 2 min read
Maitry Kumari, BSc LLB (Hons.), National Forensic Sciences University, Gandhinagar
Tanbi Bhadani, BBA LLB (Hons), Chanakya National Law University, Patna
ABSTRACT
Data sovereignty has emerged as an increasingly important enterprise risk in contemporary regulatory discourse, warranting strategic governance at the board and C-suite levels. India’s Data Protection Act, functionally operationalised through rules notified in November 2025, emerged as a calibrated, risk-proportionate framework for personal data governance, embodying the SARAL (Simple, Accessible, Rational, Actionable and Lawful) design principles. Unlike rigid data localisation regimes, the statute vests the State with discretionary authority to restrict cross-border personal data flows on a permissioned, case-by-case basis, thereby maintaining the balance between national data sovereignty imperatives and international data transfer obligations under the law of trade and investment.
This article interrogates the amalgamation of data sovereignty and enterprise risk management (ERM), placing the DPDP act in the context of the global data protection regulatory ecosystem and a growing body of adequacy decision jurisprudence. Using doctrinal and comparative regulatory scholarship, the paper identifies the transactional and operational risks associated with data sovereignty regulations, particularly those related to the M&A process, third- party vendor management, digital transformation of the global supply chain, and multi-cloud and hybrid cloud procurement. In this respect, the study indicates that the cost of compliance due to data residency and localisation requirements amounts to 15-30% of operational technology costs in MNEs. In this case, it is important to consider a strategy for responding to these challenges. Therefore, the paper discusses the viability of layered data residency architectures and privacy-enhancing. technologies (PETs) such as pseudonymization, end-to-end encryption, tokenisation, and differential privacy as tools of regulatory compliance while maintaining operational interoperability.
Keywords: Data Sovereignty, Digital Personal Data Protection Act 2023, cross- border data flow, enterprise risk, Data localisation, adequacy decision.
