Technology Governance Wiki - User contributions [en]

Data:India

2026-10-10T22:02:05Z

Latorre Tallard Pablo:

'''Words: 1911'''
= Data Portability Rights =
Data portability rights entitle individuals to legally transfer their data from one data holder/processor to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder/processor’s (2).
Data portability rights would not only bolster individuals’ control over their personal data but also market interoperability, innovation, and competition among data holders/processors (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders/processors market.
Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (and is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

= India's Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDP Act) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder/processor to another (“data fiduciaries” and “data processors” in the law’s terminology).
The DPDP Act bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (section 26 of the 2018 bill draft, and section 19 of the 2019 bill draft) (9). However, the DPDP Act final version did not recognize the right for reasons not yet officially revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple data fiduciaries/processors), and because it could present technical obstacles for the transferring of a single unit of data related to various data principals (i.e. a photograph relative to different data principals who differ on how it should be transferred across multiple data fiduciaries/processors) (10); according to others, India might be constructing a sector based regulatory structure in which data principals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).
In this sense, even though the DPDP Act does not recognize a data portability right, some special legal regimes establish ''de facto'' portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles data principals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (this is also established in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).
The absence of a data portability right affects data principals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data fiduciary/processor to another and to decide who processes their personal data. In this sense, data portability rights vest data principals with the power to switch data fiduciaries/processors based on their own preferences (i.e. the data fiduciary/processor technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data fiduciary/processor discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).
Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between data principals and data fiduciaries/processors, and, to improve transparency for the benefit of the former (16).

= India's Digital Competition Bill =
Beyond the DPDP Act, the Digital Competition Bill (DC Bill) establishes obligations related to the data portability right. The DC Bill - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on “Anti-Competitive Practices by Big Tech Companies” (17). The DC Bill, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).
Considering the above, the DC Bill establishes the obligation of systematically significant digital enterprises to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for data principals and enterprises in the transfer of their data to competing technology companies (20).
It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data fiduciaries/processors while in a competition regime is of particular application to systematically significant digital enterprises. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

= Comparison with the European Union Data Portability Regime =
The two most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.
Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.
The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal (25). As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (26). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.
India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (27). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.
But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (28).
In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (29). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often (30). The Data Act has only been applicable since September 2025 (31), so it is even harder to say how effective it has been.
While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (32). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (33). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.
How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (34). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (35).
India has no Data Act equivalent. Although India never officially explained why it dropped the general right to data portability from the final DPDPA nor why it's taking a sectoral approach, Khandelwal considers that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, India may be attempting the same sectoral approach to make the compliance costs smaller for companies (36). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (37).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

= References =

(1) [https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) accessed 2 October 2026.]

(2) [https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) accessed 2 October 2026.]

(3) [https://www.sciencedirect.com/science/article/pii/S0267364917303333 De Hert Paul & Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193.]

(4) [https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X Youping Li & Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization]; and [https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) accessed 2 October 2026.]

(5) [https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ Bresic Daniela & Lalova-Spinks Teodora, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) accessed 2 October 2026]; [https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) accessed 2 October 2026]; [https://www.dlapiperdataprotection.com/?t=transfer&c=BR DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) accessed 2 October 2026]; [https://dtinit.org/blog/2025/07/29/data-portability-regulatory Derakhshani Delara, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) accessed 2 October 2026]; [https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) accessed 2 October 2026]; and [https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) accessed 2 October 2026].

(6) [https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf Digital Personal Data Protection Act 2023 (India), No. 22 of 2023]; and Vrabec, Bansal and Gupta (n 4).

(7) Vrabec, Bansal and Gupta (n 4).

(8) DPDP Act 2023 (n 6).

(9) [https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ Khandelwal Pankhudi, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) accessed 2 October 2026]; and Vrabec, Bansal and Gupta (n 4).

(10) Vrabec, Bansal and Gupta (n 4).

(11) Khandelwal (n 9).

(12) Khandelwal (n 9).

(13) [https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009]; and [https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) accessed 2 October 2026.]

(14) OECD, “The Impact of Data Portability” (n 2).

(15) Khandelwal (n 9).

(16) OECD, “The Impact of Data Portability” (n 2).

(17) [https://www.irccl.in/post/data-portability-and-the-digital-competition-bill Shukla Ashutosh, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) accessed 2 October 2026]; and [https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ Hooda Tanisha, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” accessed 2 October 2026].

(18) Khandelwal (n 9); Hooda (n 17).

(19) [https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) accessed 4 October 2026].

(20) Shukla (n 17).

(21) Khandelwal (n 9).

(22) [https://ejlt.org/index.php/ejlt/article/view/988 Lazarotto Barbara, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology accessed 2 October 2026].

(23) [https://gdpr-info.eu Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1].

(24) GDPR (n 23).

(25) Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (2023) OJ L 2023/2854.

(26) Lazarotto (n 22).

(27) DPDP Act 2023 (n 6).

(28) [https://academic.oup.com/idpl/article-abstract/9/3/173/5529345?redirectedFrom=fulltext Wong Janis & Henderson Tristan, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, accessed 4 October 2026.]

(29) [https://petsymposium.org/popets/2021/popets-2021-0051.php Syrmoudis Emmanuel & Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351.]

(30) Lazarotto (n 22). (31) Data Act (n 25), art 50.

(32) Khandelwal (n 9). (33) Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) https://financialservices.gov.in/account-aggregator-framework accessed 4 October 2026.

(34) Lakshmikumaran & Sridharan, “DPDP Act and Rules: A Ticking Compliance Timeline” (Lakshmikumaran & Sridharan, 12 May 2026) google.com/url?q=https://www.lkslaw.com/insights/articles/dpdp-act-and-rules-a-ticking-compliance-timeline&sa=D&source=docs&ust=1791533165444212&usg=AOvVaw0UnGsQPiEAPPEtcWmOYxaR accessed 4 October 2026.

(35) Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector (Digital Markets Act) (2022) OJ L265/1, art 6(9); DCB 2024 (n 19); Ministry of Corporate Affairs (India), Lok Sabha, Written Answer of the Minister of State for Corporate Affairs (Shri Harsh Malhotra) on the Draft Digital Competition Bill (19 August 2025).

(36) Vrabec, Bansal and Gupta (n 4); Khandelwal (n 9); ACCC (n 5).

(37) DPDP Act 2023 (n 6), s 2(g).

Infrastructures:China

2026-10-10T21:58:32Z

Latorre Tallard Pablo: /* References */

'''Words: 2306'''
<div>
== '''Introduction''' ==
</div>
<div>“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence. </div>
<div style="text-align: justify;">In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</div>
<div style="text-align: justify;">In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</div>
<div>Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</div>
<div> </div>
<div>

== '''Cybersecurity Law''' ==
</div>
<div>The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</div>
<div style="text-align: justify;">In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</div>
<div style="text-align: justify;">In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</div>
<div style="text-align: justify;">Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</div>
<div style="text-align: justify;">Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</div>
<div style="text-align: justify;">In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</div>
<div>Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</div>
<div> </div>
<div>

== '''Data Security Law''' ==
</div>
<div>The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development. </div>
<div style="text-align: justify;">It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</div>
<div style="text-align: justify;">The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</div>
<div style="text-align: justify;">Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</div>
<div style="text-align: justify;">In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</div>
<div>Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</div>
<div> </div>
<div>

== '''Personal Information Protection Law''' ==
</div>
<div>The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40). </div>
<div>Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</div>
<div> </div>
<div>

== '''China’s State Centered Concept of Digital Sovereignty''' ==
</div>
<div>The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to “abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order” (see article 13), and why the the Data Security Law establishes as an objective to “preserve State sovereignty, security, and development interests” (see article 1). </div>
<div style="text-align: justify;">Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</div>
<div style="text-align: justify;">In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</div>
<div style="text-align: justify;">In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</div>
<div style="text-align: justify;">These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</div>
<div>In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</div>
<div> </div>
<div>

== '''China Model Versus the European Union Model''' ==
</div>
<div>The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context. </div>
<div style="text-align: justify;">EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</div>
<div style="text-align: justify;">Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</div>
<div style="text-align: justify;">As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</div>
<div style="text-align: justify;">This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</div>
<div>Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</div>
<div> 

== '''References''' ==

<div>(1) Cybersecurity Law of the People's Republic of China (2025 Amendment). </div>
<div>'''(2)''' Data Security Law of the People's Republic of China (2021).</div>
<div>'''(3)''' Personal Information Protection Law of the People's Republic of China (2021).</div>
<div>'''(4)''' Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</div>
<div>'''(5)''' Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, [https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']. </div>
<div>'''(6)''' Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, [https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty].</div>
<div style="text-align: justify;">'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>

Infrastructures:China

2026-10-10T21:57:22Z

Latorre Tallard Pablo:

'''Words: 2306'''
<div>
== '''Introduction''' ==
</div>
<div>“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence. </div>
<div style="text-align: justify;">In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</div>
<div style="text-align: justify;">In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</div>
<div>Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</div>
<div> </div>
<div>

== '''Cybersecurity Law''' ==
</div>
<div>The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</div>
<div style="text-align: justify;">In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</div>
<div style="text-align: justify;">In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</div>
<div style="text-align: justify;">Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</div>
<div style="text-align: justify;">Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</div>
<div style="text-align: justify;">In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</div>
<div>Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</div>
<div> </div>
<div>

== '''Data Security Law''' ==
</div>
<div>The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development. </div>
<div style="text-align: justify;">It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</div>
<div style="text-align: justify;">The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</div>
<div style="text-align: justify;">Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</div>
<div style="text-align: justify;">In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</div>
<div>Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</div>
<div> </div>
<div>

== '''Personal Information Protection Law''' ==
</div>
<div>The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40). </div>
<div>Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</div>
<div> </div>
<div>

== '''China’s State Centered Concept of Digital Sovereignty''' ==
</div>
<div>The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to “abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order” (see article 13), and why the the Data Security Law establishes as an objective to “preserve State sovereignty, security, and development interests” (see article 1). </div>
<div style="text-align: justify;">Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</div>
<div style="text-align: justify;">In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</div>
<div style="text-align: justify;">In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</div>
<div style="text-align: justify;">These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</div>
<div>In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</div>
<div> </div>
<div>

== '''China Model Versus the European Union Model''' ==
</div>
<div>The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context. </div>
<div style="text-align: justify;">EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</div>
<div style="text-align: justify;">Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</div>
<div style="text-align: justify;">As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</div>
<div style="text-align: justify;">This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</div>
<div>Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</div>
<div> 

== '''References''' ==
</div>
<div>(1) Cybersecurity Law of the People's Republic of China (2025 Amendment). </div>
<div>'''(2)''' Data Security Law of the People's Republic of China (2021).</div>
<div>'''(3)''' Personal Information Protection Law of the People's Republic of China (2021).</div>
<div>'''(4)''' Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</div>
<div>'''(5)''' Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, 
[https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']</div>
<div>'''(6)''' Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, 
[https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty]</div>
<div style="text-align: justify;">'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>

2026-10-06T20:23:04Z

Latorre Tallard Pablo: Created page with "= Data Portability Right = Data portability rights entitle individuals to legally transfer their data from one data holder to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves..."

= Data Portability Right =
Data portability rights entitle individuals to legally transfer their data from one data holder to another in a structured, organized, and machine-readable format on a continuous basis. Commonly, data portability rights apply only to data that is digital and personal, and that is processed with consent or in the context of a contract performance (1). Additionally, data portability rights differentiate themselves from other data sharing approaches in that in them the personal data transfer is triggered by the individual’s initiative and not the data holder’s (2).Data portability rights would not only bolster individuals’ control over their data but also market interoperability, innovation, and competition among data holders (3). Additionally, data portability rights would promote the reuse of the same data in multiple ways (i.e. the credentials that an individual uses in one platform can be conveniently reused in another) and facilitate understanding of data flows (4). In this way, data portability rights are connected to individuals’ rights, consumer rights, and competition in the data holders market.Data portability rights were first recognized in the European Union General Data Protection Regulation (GDPR) which inspired (or is inspiring modifications in) the data protection regulations of Australia, Botswana, Brazil, Canada, Korea, Malaysia, New Zealand, Peru, Switzerland, the United Kingdom, and Vietnam, among others (5).

 
= Digital Personal Data Protection Act =
The Digital Personal Data Protection Act (DPDPA) - enacted in 2023 - is India’s first data protection regulation (6). Although it broadly follows the principles of the GDPR (7), it does not recognize the data portability right. Indeed, individuals (“data principals” in the law’s terminology) possess, among others, rights to access, complete, correct, update, or erase their personal data (sections 11 and 12) (8) but not to transfer it from one data holder to another (“data fiduciaries” and “data processors” in the law’s terminology).The DPDPA bills recognized the data portability right: for example, the 2018 and 2019 bills provided for the right except in cases of trade secret revelation, technical impossibility, or law compliance (Section 26 of the 2018 bill draft, and Section 19 of the 2019 bill draft) (9). However, the DPDPA final version did not recognize the right for reasons not yet revealed: according to some commentators, the regulation did not provide for the right because it could pose cybersecurity risks (i.e. a cybercriminal engaged in identity fraud could potentially transfer the victim’s personal data throughout multiple platforms), and because it could present technical obstacles for the transferring of a single unit of data related to various individuals (i.e. a photograph relative to different individuals who differ on how it should be transferred across multiple platforms) (10); according to others, India might be constructing a sector based regulatory structure in which individuals’ rights are established from sector to sector and not through general provisions with the aim of decreasing compliance costs for small and medium size enterprises (i.e. it has been reported that the Indian government is planning to extend personal data rights in the healthcare sector) (11).In this sense, even though the DPDPA does not recognize a data portability right, some special legal regimes establish de facto portability systems for specific kinds of personal data. For instance, the Account Aggregator framework for the Open Banking regime entitles individuals to shift their personal data between different financial institutions (12), and the Telecommunications Mobile Number Portability Regulation establishes the obligation of mobile telephone companies to facilitate mobile telephone number portability to all subscribers, both pre-paid and post-paid, in their networks (the obligation is reaffirmed in the Recommendations on Privacy, Security, and Ownership of Data in the Telecom Sector of the Indian Telecom Regulatory Authority) (13).The absence of a data portability right affects individuals’ autonomy and control in relation to their personal data since it makes it legally burdensome to shift from one data holder to another and to decide who processes their data. In this sense, data portability rights vest individuals with the power to switch data holders based on their own preferences (i.e. the data holder technical capabilities, policies, or privacy standards) and safeguard them against personal data loss or unavailability in case the data holder discontinues operations (this was the case of Alphabet’s social network service Google+ that was terminated in 2019 due to low usage and data privacy problems) (14).Additionally, the absence of a data portability right impacts market competition by attaching personal data to market incumbents. Indeed, the availability of a data portability right reduces the risks of market incumbent lock-in effects associated with vertical integration, network effects, and switching costs, thereby increasing overall market competition (15). In this sense, data portability rights contribute to mitigate power imbalances between individuals and data holders, and, to improve transparency for the benefit of the former (16).

 
= Digital Competition Bill =
Beyond the DPDPA, the Digital Competition Bill (DCB) establishes obligations related to the data portability right. The DCB - released in 2024 - was prepared and published by the Committee on Digital Competition Law following a report of the Parliamentary Standing Committee on Finance on the “Anti-Competitive Practices by Big Tech Companies” (17). The DCB, thus, seeks to regulate dominant technology companies (“systematically significant digital enterprises” in the proposal’s terminology) with the purpose of increasing competition in digital markets in a similar way as the European Union Digital Markets Act (DMA) (18).Considering the above, the DCB establishes the obligation of dominant technology companies to “allow business users and end users of its Core Digital Service to easily port their data, in a format and manner as may be specified” (section 12(3)) (19). The obligation’s purpose is to reduce switching costs for enterprises and individuals in the transfer of their data to competing technology companies (20).It is important to note that data portability application in a data protection regime is different than in a competition regime since they follow different policy objectives and logics. For instance, data portability in a data protection regime usually is of general application to all data holders while in a competition regime is of particular application to dominant technological companies. Additionally, data portability in a data protection regime is only applicable to personal data while in a competition regime it is to all categories of data (21).

 
= Comparison with the European Union Data Portability Regime =
The three most important laws to consider when comparing the European Union’s data portability right to that of India are the GDPR and the Data Act.Data portability rights began in the European Union as data protection rights (22). Article 20 of the GDPR allows individuals to request the personal data they gave to a data holder and have it transmitted to another data holder, where it is “technically feasible” (23). A data holder (“data controller” in the regulation’s terminology) could be any person, public authority, agency or other body that “alone or jointly with others, determines the purposes and means of the processing of personal data” (24). The purpose of the regulation is to give individuals control over their personal data and to foster competition between data holders.The Data Act, on the other hand, is about data innovation. Unlike the GDPR, which just focuses on personal data, the Data Act covers data in general, personal and non-personal. As Lazarotto states, “the Data Act avoids the dichotomy between personal and non-personal data” (25). This law is about the data economy and making sure that users are able to access and share their data for innovation purposes, however they see fit to use that information.India’s DPDPA has a similar goal to that of the GDPR in terms of protecting individuals’ personal data, but it is not as broad on data portability rights (26). Data portability rights do exist in India’s financial sector within its Account Aggregator for Open Banking framework, which allows financial data to be transferred between financial institutions at the request of the individual.But are those objectives being met? In the European Union, the GDPR’s objective is partially being met. As Wong and Henderson showed in their study in “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” out of 230 portability requests, only 172 (about 75%) were successfully completed (27).In addition, Emmanuel Syrmoudis, the lead author of “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” explained their findings of 182 online services to “the absence of an infrastructure realizing direct data portability” (28). Perhaps it is because of this lack of technical infrastructure that Lazarotto states that despite broad applications, the right hasn’t been used very often. The Data Act has only been applicable since September 2025, so it is even harder to say how effective it has been.While India does not provide individuals with a general data portability right, in terms of finance, its data portability system works quite well. As Khandelwal concludes India has seen, “a high success rate with interoperability and data portability in the financial sector” (29). As of March 2026, “more than 2.88 billion financial accounts are enabled to share data on Account Aggregator, 284.6 million accounts have been linked by users to the Account Aggregator framework” (30). Yet, Khandelwal says this kind of success rate could be hard to replicate on a more complicated platform.How do these frameworks compare? Both frameworks have a general data protection regime but only the European Union specifically calls out portability. In addition, it’s worth noting that India’s DPDPA only becomes fully enforceable in May 2027. There is a proposal in India to move this up to November 2026, but it has yet to be adopted (31). In addition, the European Union’s DMA pushes portability on the largest platforms (Article 6(9) and India’s DCB would do the same, however, the bill has been paused awaiting a market study) (32).

India has no Data Act equivalent. Khandelwal considered that India may be following Australia’s model of going by sector rather than providing one general right like the GDPR. Like Australia’s Consumer Data Right model, which extends data rights sector by sector, India may be attempting the same sector approach to make the compliance costs smaller for companies (33). It is worth noting that the DPDPA does refer to an “interoperable platform” which makes it plausible that portability was intended at some stage in India (34).What’s the ultimate outcome of the law? The two systems pursue similar goals with different approaches. With the GDPR and Data Act, the European Union provides a broad right that is enforceable. However, people are rarely able to use this effectively because the European Union lacks the technical infrastructure to let users transfer their data easily between data holders. India has the technical infrastructure for individuals to request their financial data easily including interoperability, but mainly in the financial sector. It does not offer any broad right to individuals like the GDPR in terms of social media platforms, for example. It is interesting that both systems have what the other needs: the European Union has the broad right, but not the technical ability to allow individuals to effectively use it, while India has the necessary technical infrastructure, but not the broad right.

 
== References ==

#Dutch Data Protection Authority, “Right to Data Portability” (Autoriteit Persoonsgegevens) https://www.autoriteitpersoonsgegevens.nl/en/themes/basic-gdpr/privacy-rights-under-the-gdpr/right-to-data-portability accessed 2 October 2026.
#OECD, “The Impact of Data Portability on User Empowerment, Innovation, and Competition” (OECD Going Digital Toolkit Notes, OECD Publishing 2024) https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/06/the-impact-of-data-portability-on-user-empowerment-innovation-and-competition_ee329380/319f420f-en.pdf accessed 2 October 2026.
#Paul De Hert and Others, “The Right to Data Portability in the GDPR: Towards User-Centric Interoperability of Digital Services” (2018) 34 Computer Law & Security Review 193 (https://www.sciencedirect.com/science/article/pii/S0267364917303333).
#Youping Li and Jianhu Zhang, “Data Portability and the Collection of Personal Data” (2026) 106 International Journal of Industrial Organization (https://www.sciencedirect.com/science/article/abs/pii/S016771872600041X); and Helena Vrabec, Yashu Bansal and Animesh Gupta, “Squeezing Out an Imperative Right? The Right to Data Portability in the Indian Context” (Leiden Law Blog, 26 February 2024) https://www.leidenlawblog.nl/articles/squeezing-out-an-imperative-right-the-right-to-data-portability-in-the-indian-context accessed 2 October 2026.
#Daniela Bresic and Teodora Lalova-Spinks, “The Broadening of the Right to Data Portability for Internet-of-Things Products in the Data Act: Who Does the Act Actually Empower? (Part I)” (CiTiP Blog, 2022) https://www.law.kuleuven.be/citip/blog/the-broadening-of-the-right-to-data-portability-for-internet-of-things-products-in-the-data-act-part-i/ accessed 2 October 2026; Australian Competition and Consumer Commission, “The Consumer Data Right” (ACCC) https://www.accc.gov.au/by-industry/banking-and-finance/the-consumer-data-right accessed 2 October 2026; DLA Piper, “Data Protection Laws of the World: Brazil — Transfer of Personal Data” (DLA Piper, last modified 30 March 2026) https://www.dlapiperdataprotection.com/?t=transfer&c=BR accessed 2 October 2026; Delara Derakhshani, “Global Portability Regulatory Round-Up” (Data Transfer Initiative, 29 July 2025) https://dtinit.org/blog/2025/07/29/data-portability-regulatory accessed 2 October 2026; “South Korea Upgrades OnMyData Platform to Boost Data Portability” MLex (20 January 2026) https://www.mlex.com/mlex/articles/2431684/south-korea-upgrades-onmydata-platform-to-boost-data-portability accessed 2 October 2026; and Federal Data Protection and Information Commissioner, “Knowing and Asserting My Rights” (FDPIC) https://www.edoeb.admin.ch/en/knowing-and-asserting-my-rights accessed 2 October 2026.
#Digital Personal Data Protection Act 2023 (India), No. 22 of 2023 (https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf); and Vrabec, Bansal and Gupta (n [4]).
#Vrabec, Bansal and Gupta (n [4]).
#DPDP Act 2023 (n [6]).
#Pankhudi Khandelwal, “The Story of Data Portability in India: A Lack of Clarity under Data Protection, Competition Law and Other Frameworks” (Law School Policy Review, 27 November 2024) https://lawschoolpolicyreview.com/2024/11/27/the-story-of-data-portability-in-india-a-lack-of-clarity-under-data-protection-competition-law-and-other-frameworks/ accessed 2 October 2026; and Vrabec, Bansal and Gupta (n [4]).
#Vrabec, Bansal and Gupta (n [4]).
#Khandelwal (n [9]).
#Khandelwal (n [9]).
#Telecommunication Mobile Number Portability Regulation 2009 (India), No. 8 of 2009 (https://www.trai.gov.in/sites/default/files/2024-10/201208081218350931511Regulation23sep09%5B1%5D.pdf); and Telecom Regulatory Authority of India, “TRAI Releases Recommendations on "Privacy, Security and Ownership of Data in the Telecom Sector" (Press Release, 16 July 2018) https://www.trai.gov.in/sites/default/files/2024-08/PRNo7816072018.pdf accessed 2 October 2026.
#OECD, “The Impact of Data Portability” (n [2]).
#Khandelwal (n [9]).
#OECD, “The Impact of Data Portability” (n [2]).
#Ashutosh Shukla, “Data Portability and the Digital Competition Bill” (IRCCL, 4 August 2024) https://www.irccl.in/post/data-portability-and-the-digital-competition-bill accessed 2 October 2026; and Tanisha Hooda, “India's Draft Digital Competition Bill, 2024: Reforming Digital Markets” https://www.impriindia.com/insights/policy-update/indias-draft-digital-competition-bill-2024-reforming-digital-markets/ accessed 2 October 2026
#Khandelwal (n [9]); Hooda (n 17]).
#Draft Digital Competition Bill 2024 (India) (Ministry of Corporate Affairs, Committee on Digital Competition Law, Report, Annexure IV, March 2024) https://www.medianama.com/wp-content/uploads/2024/03/DRAFT-DIGITAL-COMPETITION-BILL-2024.pdf accessed 4 October 2026.
#Shukla (n [17]).
#Khandelwal (n [9]).
#Barbara Lazarotto, “The Right to Data Portability: A Holistic Analysis of GDPR, DMA and the Data Act” (2024) 15(1) European Journal of Law and Technology https://ejlt.org/index.php/ejlt/article/view/988 accessed 2 October 2026.
#Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1 (https://gdpr-info.eu/).
#GDPR (n [23]).
#Lazarotto (n [22]).
#DPDP Act 2023 (n [6]).
#Janis Wong and Tristan Henderson, “The Right to Data Portability in Practice: Exploring the Implications of the Technologically Neutral GDPR” (2019) 9(3) International Data Privacy Law 173, https://doi.org/10.1093/idpl/ipz008 accessed 4 October 2026. 
#Emmanuel Syrmoudis and Others, “Data Portability between Online Services: An Empirical Analysis on the Effectiveness of GDPR Article 20” [2021] (3) Proceedings on Privacy Enhancing Technologies 351 (https://petsymposium.org/popets/2021/popets-2021-0051.php).
#Khandelwal (n [9]).
#Khandelwal (n [9]).
#Department of Financial Services, Ministry of Finance (India), “Account Aggregator Framework” (Department of Financial Services, last updated 27 May 2026) https://financialservices.gov.in/account-aggregator-framework accessed 4 October 2026.
#DCB 2024 (n [19]).
#Khandelwal (n [9]).
#DPDP Act 2023 (n [6])

Data: Data Portability

2026-10-06T20:18:30Z

2026-10-06T08:56:31Z

Latorre Tallard Pablo: /* Vertical Integration by Pablo Latorre */