Clarity needed on what comprises critical data: Nasscom

IT industry body Nasscom Tuesday said the government will have to offer clarity on what is categorised as "critical data" under the proposed data protection framework as such information is mandated to be stored locally.

The trade association also called for a "balanced" approach for India's data protection framework, saying the rules should ensure that innovation is not "stifled" by the focus on driving localisation.

Nasscom Chairman Rishad Premji said the draft stipulates that critical data has to be stored exclusively in India.

However, the clarity on what comprises this category is yet to be provided, he added.

Premji, who is also Wipro's chief strategy officer, stated that a balanced approach is required as localisation mandates can also stifle innovation for startups.

The draft personal data protection bill, which was introduced recently, has drawn mixed response from the industry. While most have welcomed the overall framework, many have also raised concerns around provisions that include a mandate to set up local servers in India for storing "critical personal data," a classification that will be done by the Centre.

This is likely to have implications for the technology firms, especially, those in areas like finance and health care that handle multitude of user data ranging from names and addresses to financial information.

Another policy in the works for the e-commerce sector in the country has similar mandates of localisation for the data of Indian residents.

Previously, Nasscom had said mandating localisation of all personal data could become a trade barrier in the key markets.

Also, startups from India that are going global may not be able to leverage global cloud platforms and face similar barriers as they expand in new markets, it had contended.