5 min readNew DelhiMar 2, 2026 09:37 AM IST
First published on: Mar 2, 2026 at 02:09 AM IST
As the issue of cross-border data flows — the movement of information across national boundaries, which is essential for modern global commerce — remained unresolved during talks concluded earlier this year, India and the EU have decided to tackle it within five years of the free trade agreement (FTA) coming into effect, according to the deal text released late Friday.
“The parties shall reassess within five years of the date of entry into force of this Agreement the need for inclusion of additional provisions, including on the free flow of data, into this agreement,” the digital trade chapter of the legal text said. The approach towards Cross-border data flows differs sharply between developed and developing economies.
International trade experts said little progress made on cross-border trade regulations under the deal indicate that core disagreements remain, as Indian and EU’s data protection legislation is evolving. There is a wait and watch approach since several issues are due to be discussed in the WTO, they said. This means Indian IT exporters will have to keep finding hectic workarounds for individual projects.
“The inclusion of this review clause is an indication that key rules like those on cross-border data flows had to be set aside to prioritise the FTA’s conclusion. Though since India’s data protection laws and rules are relatively new, this period offers an opportunity to build a strong practice on their effective implementation. But difficulties might still return during a future review if India’s legal framework is assessed as inadequate to the EU’s requirements or the issue of customs duties on electronic transmission is brought up,” Shantanu Singh, an international trade lawyer, said.a
Given the fragmented global approach, cross-border data governance remains among the most debated issues in digital trade talks. Understanding how different economies balance data sovereignty with economic openness is essential to assessing the future of digital trade and global data flows, a report on digital trade by the Centre for WTO Studies, IIFT said.
“The digital trade chapter of India-EU FTA reflects the geo-strategic nature of the FTA. Since regulations on data flows are still emerging on both sides, the agreement does not have regulatory commitments on data flows. For India and EU digital trade to progress with ease, there is a need for some flow of data with trust, which has not been achieved through the text. The review provision indicated that there was a drive on both sides, and that is why they have kept a window open,” Arpita Mukherjee, Professor, ICRIER said.
While India’s demand for data adequacy remains unmet, the EU has been striking data adequacy agreements with several countries that considerably eases flow of data and increase digital trade. Data adequacy refers to a legal status granted by the European Commission confirming that a non-EU country provides a level of data protection essentially equivalent to the EU’s regulations. In 2013, data adequacy was a key point of contention between India and the EU.
The UK had entered into a data adequacy agreement with the EU following Brexit. This helped businesses and organisations in the UK to receive personal data from the EU without having to put additional arrangements in place with European counterparts. This supports trade, innovation and investment.
Earlier this month EU and Brazil adopted mutual adequacy decisions, confirming that their levels of data protection are comparable. By ensuring that personal data can flow freely and securely between the EU and Brazil without any additional requirements, there will be a boost to digital trade between the two jurisdictions, the European Commission (EC) said.
“The decisions will save costs and ensure legal certainty and stability for European companies already invested in Brazil and for Brazilian firms expanding into the EU’s market. They create the largest area of free and safe data flows in the world, benefitting a combined 670 million consumers across the EU and Brazil,” EC said.
These mutual adequacy decisions come against the backdrop of the historic Partnership Agreement (EMPA) and Interim Trade Agreement (ITA) signed on 17 January between the EU and Mercosur. The decisions will be a building block for strengthening trade between the EU and Brazil and send yet another strong geopolitical signal, demonstrating the EU and Brazil’s shared commitment to multilateralism and the rules-based international order.
The European Commission has so far recognised several countries that offer an adequate level of data protection. These include Andorra, Argentina, Brazil, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea and Switzerland.
The review provision indicated that there was a drive on both sides, and that is why they have kept a window open,” Arpita Mukherjee, Professor, ICRIER said.
Share
