Decoding Data Localization in India, UAE, KSA, Russia, China

3. OVERVIEW Data Localisation refers to the legal and regulatory requirements that demands data be stored and processed in the country in which it was generated. Today 75 percent of all countries have implemented some level of data localization rules. Number of Countries Countries with Data Localisation Law Countries without Data Localisation Law While Data Localization enhances data privacy by ensuring compliance with domestic regulations and limiting foreign access, it also imposes significant challenges for businesses. As part of following Data Localisation regulations businesses would be required to ensure compliance with complex regulatory frameworks, invest in local data storage infrastructure and manage Cross-border data transfer restrictions. Finding a middle ground shall be the right approach that needs to be taken by Organizations for addressing the challenges posed by Data Localization laws. This whitepaper examines data localization laws, Challenges and Implementation Strategies for India, UAE, KSA, Russia and China. It highlights key benefits like data security and privacy, while addressing challenges. Case studies from various countries illustrate the impact of these laws. While there are exceptions to data localization laws in certain contexts, these exceptions are excluded from the scope of this whitepaper. All rights reserved by Tsaaro Consulting Page No. | 1

4. CHAPTER 1 KEY CONCEPTS 1.1 WHAT IS DATA LOCALIZATION? Data Localization can be defined as the legal or regulatory requirement that data must be stored and processed within the domestic country in which it was created. As a basis for imposing such restriction in the movement of data, countries have relied upon various legitimate as well as other reasons including protection of national security, ensuring the data privacy rights of their citizens and economic growth among others. There are different variants of Data Localization depending on the level of restriction imposed on the flow of data: Conditional Transfers Complete Prohibition Implicit Restriction Some regulations allow data (e.g., health data) to be stored and processed locally but permit international transfers under specific conditions. In extreme cases, data cannot be transferred across borders, effectively mandating local storage and processing. A rule requiring domestic storage and processing, inherently prohibits cross- border transfers.1 All rights reserved by Tsaaro Consulting Page No. | 2

5. 1.2 HOW DOES DATA LOCALIZATION WORK? Data localization mandates that data generated within a country be collected, processed, and stored within its national borders, ensuring compliance with local regulations. It applies to various sectors, including banking, healthcare, and telecommunications, where data privacy and security are critical. Data Storage & Infrastructure – Organizations subject to data localization laws must establish local data centers or partner with domestic cloud providers to store and process data within the country. This prevents unrestricted cross-border data flow. Regulatory Compliance & Access Control – Governments enforce strict regulations on who can access the data and under what conditions. Companies must implement encryption, cybersecurity measures, and periodic audits to comply with national standards. Cross-Border Transfers & Restrictions – In jurisdictions with strict localization laws, data cannot be transferred abroad without regulatory approval. Some frameworks allow transfers under conditions such as explicit user consent or data protection agreements with foreign entities. Enforcement & Penalties – Regulatory bodies oversee compliance through audits, licensing requirements, and penalties for violations. Companies failing to adhere may face fines, operational restrictions, or even bans on conducting business within the jurisdictiIomnp. licit Restriction While data localization enhances data sovereignty, security, and privacy, it also presents operational challenges such as increased infrastructure costs and potential barriers to global digital trade. Organizations must carefully navigate these laws to maintain compliance while ensuring business continuity. All rights reserved by Tsaaro Consulting Page No. | 3

6. 1.2 HOW DOES DATA LOCALIZATION WORK? Data localization mandates that data generated within a country be collected, processed, and stored within its national borders, ensuring compliance with local regulations. It applies to various sectors, including banking, healthcare, and telecommunications, where data privacy and security are critical. Data Storage & Infrastructure – Organizations subject to data localization laws must establish local data centers or partner with domestic cloud providers to store and process data within the country. This prevents unrestricted cross-border data flow. Regulatory Compliance & Access Control – Governments enforce strict regulations on who can access the data and under what conditions. Companies must implement encryption, cybersecurity measures, and periodic audits to comply with national standards. Cross-Border Transfers & Restrictions – In jurisdictions with strict localization laws, data cannot be transferred abroad without regulatory approval. Some frameworks allow transfers under conditions such as explicit user consent or data protection agreements with foreign entities. Enforcement & Penalties – Regulatory bodies oversee compliance through audits, licensing requirements, and penalties for violations. Companies failing to adhere may face fines, operational restrictions, or even bans on conducting business within the jurisdictiIomnp. licit Restriction While data localization enhances data sovereignty, security, and privacy, it also presents operational challenges such as increased infrastructure costs and potential barriers to global digital trade. Organizations must carefully navigate these laws to maintain compliance while ensuring business continuity. All rights reserved by Tsaaro Consulting Page No. | 3

7. CHAPTER 2 REGULATORY REQUIREMENTS 2.1 COMPARISON MATRIX Country Applicable Sectors    Relevant law   Penalty Cybersecurity Law of the People’s Republic of China (2017) Data Security Law (DSL, 2021) Personal Information Protection Law (PIPL, 2021) E-Commerce law, 2019 Business-(RMB 50,000- RMB 500,000) Individuals-( RMB 10,000- RMB 100,00)   Critical infrastructure Finance, energy, telecom Government data, e- commerce Healthcare, transportation, social media platforms China  RBI Directive on Payment Data Storage    Digital Personal Data Protection Act, 2023 E- Governance Policy (MetiY Guidelines) FDI Policy for E-Commerce (Press Note 2, 2018) IT (intermediary guidelines) CII Protection Rules, 2013 IRDAI Guidelines on Information and Cyber Security, 2017 Information Technology Act, 2000 Financial services ,Insurance, telecom Media and Broadcasting,Healthcare,Edtech,E nergy Cloud service providers,E- commerce Rupees 10 Lakhs- 20 Lakhs  India  Financial services, Telecom, E-commerce, Advertising Energy Federal Law No. 242 - Personal Data Protection Law (2006) Federal Law No. 152-FZ (2006) RUB 1,000,000 - RUB 6,000,000  Russia  All rights reserved by Tsaaro Consulting Page No. | 4

8. Download the Decoding Data Localization in India, UAE, KSA, Russia, China full Whitepaper here