India: Indian Joint Parliamentary Committee adopts Report on Personal Data Protection Bill

On 16 December 2021, the Indian Joint Parliamentary Committee (JPC) on the Personal Data Protection Bill (PDPB) tabled its report in both Houses of Parliament, two years after the bill was first referred to the JPC. The PDPB constitutes India's first comprehensive regulation of the use of individual data by the government and private companies. Among others, the draft of 2019 set out the rules for cross-border data transfers (art. 33 et seq.): Whereas sensitive personal data may be transferred outside India under the express consent of the data subject, critical personal data (as may be defined by the government) can only be processed in India. Exemptions thereof may be possible. The Joint Parliamentary Committee Report, however, additionally suggests that intragroup contracts for cross-border transfers shall also need governmental approval.