EU data watchdog blocks EIB data transfer to India, citing privacy concerns

The EU data watchdog didn’t mince words. It said there simply wasn’t “enough evidence and proof” that countries like India could guarantee an “essentially equivalent level of data protection” as required under the EU’s stringent GDPR framework.

Instead, the supervisor advised the EIB to use a fallback option: a limited-use exception known as a “derogation,” which allows data to be shared for specific public interest purposes, even when the receiving country lacks EU-level safeguards.

However, according to experts, this is meant for occasional transfers—not routine exchanges.

The Ministry of Electronics and Information Technology (MeitY), which steered the DPDP legislation, has not yet commented on the EDPS’s remarks. Moneycontrol has also reached out to the EDPS with further queries on what exactly prompted the EDPS to make this decision.

"It is not clear and could be due to various factors," Aaron Kamath, Leader in Technology and Commercial Law Practice at Nishith Desai Associates told Moneycontrol. "One reason could be that the DPDPA is still not in force. As of today, there is still no standalone and comprehensive law governing the use and protection of personal data."

"Another reason could lack of clarity on how the new personal data protection law will play out. Under the DPDPA, there are wide exemptions available for Government agencies which has an impact on access and surveillance. Further, having not come into force, there is a lack of clarity and experience in how enforcement and remedies would practically pan out," Kamath said.

Additionally, according to Kamath, standard contractual clauses (SCCs) and cross-border data transfer agreements have typically been the preferred route for transferring data from the EU to India, and are likely to remain so unless there's a change in India’s legal status or recognition under EU rules.

He noted that the public-interest derogation suggested by the EDPS is meant to be used only in exceptional cases and shouldn't be seen as a replacement for adequacy decisions or SCCs.