Pakistan-Linked Tools Pose a Risk to India’s Digital Sovereignty

Amid growing digital threats and the enforcement of India’s Digital Personal Data Protection (DPDP) Act, about companies that might be operating within Indian soil, with links to Pakistan in some form or fashion.  The reliance on such companies, that still are using Pakistan based development centers to offer Data privacy and Securiti products in India creates significant risk of data being accessed from Pakistan. Such foreign-origin data privacy and security solutions, particularly from nations with strained geopolitical relations like Pakistan's Security.AI, raises critical questions for Indian enterprises and government agencies regarding compliance with the Digital Personal Data Protection (DPDP) Act and alignment with the "Make in India" initiative.

Key DPDP Act Provisions:

Enacted on August 11, 2023, the DPDP Act governs digital personal data processing in India and by foreign entities serving Indian data principals. It mandates data fiduciary obligations, including ensuring data security, accuracy, and consent-based processing, with penalties for breaches. The Act permits cross-border data transfers but allows government restrictions, has extraterritorial applicability, and provides limited exemptions for state agencies concerning sovereignty or security.

Implications of Using Pakistan-Associated Security.AI:

National Security and Data Sovereignty: Entrusting sensitive personal data to a Pakistan-associated solution like Security.AI poses significant geopolitical risks, including potential unauthorized access or surveillance. This directly conflicts with the DPDP Act's emphasis on sovereignty and the "Make in India" drive to reduce dependence on foreign technology, especially from adversarial nations. Future data transfer restrictions could also be violated if data processing or storage occurs outside India.

DPDP Compliance Challenges: Data fiduciaries remain fully liable for compliance, even when using foreign data processors. Any breach by Security.AI could expose the fiduciary to substantial penalties. Ensuring clear, informed consent and transparency about cross-border data processing becomes complex and could erode trust. Moreover, verifying "reasonable security measures" mandated by the Act from a Pakistan-based provider, given limited oversight, is challenging.

Alignment with "Make in India": The "Make in India" initiative promotes indigenous technology for self-reliance. Opting for a Pakistan-origin solution like Security.AI, when Indian alternatives exist (e.g., Ardent Privacy), contradicts this national policy. Government agencies, in particular, face pressure to prioritize Indian solutions to mitigate perceived security risks and align with national objectives.

Practical and Reputational Risks: Using a tool from a sensitive jurisdiction may attract heightened scrutiny from the Data Protection Board (DPB) during audits. Enterprises and government agencies also risk significant reputational damage if stakeholders perceive their reliance on such a tool as compromising data privacy or national interests.

Recommendations:

To ensure DPDP compliance, uphold data sovereignty, and align with "Make in India," enterprises and government agencies should:

Prioritize Indigenous Solutions: Favor Indian-developed data security tools tailored to India's regulatory and cultural context.

Conduct Rigorous Due Diligence: If considering foreign tools, perform thorough audits of security protocols, data storage locations, and compliance with Indian laws. Ensure legally binding Data Sharing Agreements (DSAs) are in place.

Assess Cross-Border Data Flows: Verify data processing/storage locations and ensure explicit consent from data principals for any transfers, complying with potential government restrictions.

Engage Experts and DPIAs: Consult legal and cybersecurity experts and conduct Data Protection Impact Assessments (DPIAs) to identify and mitigate risks.

Government Policy Advocacy: The Indian government should issue clear guidelines on using foreign-origin tools, especially from countries with geopolitical tensions.

Specific for Government Agencies: Avoid foreign tools unless absolutely no viable Indian alternative exists, and seek explicit approval from relevant authorities like MeitY to ensure alignment with national security policies.

Relying on a Pakistan-associated data security solution like Security.AI for DPDP compliance presents significant national security, regulatory, and reputational challenges. Prioritizing Indian-developed solutions is crucial to safeguard sensitive personal data, ensure data sovereignty, and maintain public trust within India's evolving digital landscape.