EU data watchdog blocks EIB data transfer to India, citing privacy concerns

European Union

The European Data Protection Supervisor (EDPS) blocked a request by the European Investment Bank (EIB) in February 2024 to transfer personal data—specifically contact details—to India and few other non-EU countries, citing insufficient assurances of privacy protection.

The decision, disclosed in the EDPS’s annual report released last month, came just months after India passed its landmark Digital Personal Data Protection (DPDP) Act in August 2023.

The EDPS concluded that India does not yet ensure an “essentially equivalent level of data protection” to the EU’s General Data Protection Regulation (GDPR).

To be clear, although the DPDP Act was passed in 2023 and the draft rules were released in 2025 for consultation, the regulation has still not been implemented.

The EU data watchdog didn’t mince words. It said there simply wasn’t “enough evidence and proof” that countries like India could guarantee an “essentially equivalent level of data protection” as required under the EU’s stringent GDPR framework.

Instead, the supervisor advised the EIB to use a fallback option: a limited-use exception known as a “derogation,” which allows data to be shared for specific public interest purposes, even when the receiving country lacks EU-level safeguards.

However, according to experts, this is meant for occasional transfers—not routine exchanges.

The Ministry of Electronics and Information Technology (MeitY), which steered the DPDP legislation, has not yet commented on the EDPS’s remarks. Moneycontrol has also reached out to the EDPS with further queries on what exactly prompted the EDPS to make this decision.

"It is not clear and could be due to various factors," Aaron Kamath, Leader in Technology and Commercial Law Practice at Nishith Desai Associates told Moneycontrol. "One reason could be that the DPDPA is still not in force. As of today, there is still no standalone and comprehensive law governing the use and protection of personal data."

"Another reason could lack of clarity on how the new personal data protection law will play out. Under the DPDPA, there are wide exemptions available for Government agencies which has an impact on access and surveillance. Further, having not come into force, there is a lack of clarity and experience in how enforcement and remedies would practically pan out," Kamath said.

Additionally, according to Kamath, standard contractual clauses (SCCs) and cross-border data transfer agreements have typically been the preferred route for transferring data from the EU to India, and are likely to remain so unless there's a change in India’s legal status or recognition under EU rules.

He noted that the public-interest derogation suggested by the EDPS is meant to be used only in exceptional cases and shouldn't be seen as a replacement for adequacy decisions or SCCs.