Global Data Localization Laws And Competition Effects

1. Introduction

Data localization refers to laws, regulations, or regulatory conditions requiring particular categories of data to be stored, processed, accessed, or retained within a specified country's territory, or restricting the circumstances in which that data may be transferred abroad.

Localization can apply to:

• personal data;
• financial and payment data;
• health and genetic data;
• telecommunications data;
• government and public-sector data;
• critical-infrastructure data;
• children's data;
• strategic or national-security data;
• industrial and commercial datasets; and
• data used for artificial-intelligence training.

From a competition-law perspective, localization is significant because data is increasingly an essential input into digital markets. Restrictions on international data flows can alter market definition, entry barriers, economies of scale, network effects, switching costs, cloud competition, AI development, interoperability, and access to data.

The central tension is therefore:

Data localization may protect privacy, security and digital sovereignty, but excessive or discriminatory localization can fragment markets and strengthen incumbent firms that can afford multiple national infrastructures.

Localization is not necessarily anticompetitive. Much depends upon whether the restriction is necessary, proportionate, technologically neutral, non-discriminatory, and competitively justified.

2. Meaning And Forms Of Data Localization

Data localization exists on a spectrum.

A. Strict localization

The law requires data to remain physically within the country.

Example:

• certain financial or payment information must be stored domestically;
• specified government information cannot be transferred abroad.

B. Local-copy requirements

A company may transfer data internationally but must maintain a domestic copy.

This creates additional infrastructure costs but does not completely prevent international processing.

C. Conditional transfer regimes

International transfers are permitted only if particular safeguards exist, such as:

• adequacy decisions;
• standard contractual clauses;
• approved certifications;
• consent;
• regulatory authorization;
• security assessments.

D. Sectoral localization

Localization applies only to particular industries such as:

• banking;
• insurance;
• telecommunications;
• healthcare;
• defense;
• critical infrastructure.

E. Government-access localization

A country may require data to be locally accessible to domestic regulators or security agencies.

This can produce significant competitive consequences where foreign firms cannot provide equivalent governmental access.

3. Major Global Regulatory Models

A. European Union

The EU generally does not operate through blanket localization.

Instead, the GDPR establishes restrictions on international transfers and requires appropriate safeguards.

This distinction is important for competition law because a transfer restriction can simultaneously:

1. protect individual privacy;
2. restrict data pooling;
3. increase compliance costs; and
4. affect the competitive position of firms operating across borders.

The EU therefore increasingly faces a difficult question:

When does privacy protection justify restricting data access, and when does the restriction unnecessarily reinforce an incumbent's data advantage?

The recent EU approach to Google's search-data access illustrates the opposite side of the problem: competition regulation can require access to strategically important data while simultaneously requiring anonymisation and privacy safeguards.

B. China

China employs a comparatively extensive system involving:

• Personal Information Protection Law;
• Data Security Law;
• Cybersecurity Law;
• security assessments for certain cross-border transfers;
• restrictions concerning important data;
• requirements concerning critical information infrastructure.

China's model reflects both privacy/security objectives and digital sovereignty.

Competition effects can arise because multinational firms may have to construct separate data architectures for the Chinese market.

This can favor:

• large incumbent technology companies;
• firms with extensive domestic infrastructure;
• firms possessing regulatory expertise;
• companies capable of maintaining localized cloud and cybersecurity systems.

C. India

India has developed a mixed approach combining:

• personal-data regulation;
• sector-specific localization;
• financial-sector requirements;
• telecommunications requirements;
• government-data restrictions.

A particularly important example is financial/payment data regulation, under which certain payment-system data has been required to be stored in India.

The competition question is whether such requirements create a neutral compliance obligation or disproportionately burden smaller foreign or domestic entrants.

D. Russia

Russia has historically adopted particularly strong personal-data localization requirements.

The Russian model illustrates how localization can become a condition of operating within a national digital market.

Competition consequences may include:

• higher entry costs;
• reduced international scalability;
• increased dependence on domestic infrastructure;
• greater regulatory leverage over foreign platforms.

E. United States

The United States traditionally relies less on comprehensive data-localization rules and more on:

• sector-specific privacy legislation;
• national-security restrictions;
• financial regulation;
• export controls;
• government-contracting rules;
• restrictions concerning sensitive data.

The result is comparatively greater cross-border data mobility in many commercial markets, but increasing fragmentation in strategically sensitive areas.

4. Why Data Localization Matters To Competition Law

Data localization can affect competition through at least eight mechanisms.

1. Increased barriers to entry

A new entrant may need:

• domestic servers;
• local cloud infrastructure;
• cybersecurity personnel;
• domestic compliance systems;
• local data centers;
• regulatory approvals.

A multinational incumbent can spread these costs across a large customer base.

A small entrant cannot.

Thus:

Localization → fixed compliance costs → economies of scale → incumbent advantage.

2. Reduction of economies of scale

Digital businesses often depend upon centralized datasets.

For example, an AI company may train a model using information from:

India + Europe + United States + Southeast Asia + Africa.

Localization may force the company to maintain separate datasets.

This can reduce:

• training efficiency;
• model accuracy;
• analytics;
• personalization;
• fraud detection;
• demand forecasting.

Large incumbents may nevertheless maintain sufficient datasets in each jurisdiction.

3. Strengthening of network effects

Data frequently becomes more valuable as the number of users increases.

Suppose Platform A has:

500 million internationally integrated users.

Platform B has:

5 million users confined to one jurisdiction.

If localization prevents B from obtaining cross-border datasets, A's data advantage can become self-reinforcing.

This produces:

Data → better service → more users → more data → stronger market power.

4. Fragmentation of digital markets

A global digital market may become:

Global market → EU market → Indian market → Chinese market → U.S. market → national sub-markets.

This reduces international competition.

Localization can therefore produce geographic fragmentation, even when consumers experience the same digital service.

5. Cloud-computing concentration

Localization may require domestic hosting.

If only a few providers have sufficient domestic infrastructure, localization can increase concentration in:

• cloud computing;
• data centers;
• cybersecurity;
• managed services;
• data-processing infrastructure.

Thus a privacy regulation can unintentionally create infrastructure-level market power.

6. AI competition

AI is particularly sensitive because modern AI systems require enormous datasets.

Localization can affect:

• training datasets;
• inference;
• model evaluation;
• fine-tuning;
• reinforcement learning;
• healthcare datasets;
• financial datasets;
• multilingual datasets.

A jurisdiction with strict localization may therefore disadvantage smaller AI developers that cannot assemble sufficiently diverse domestic datasets.

7. Switching costs

If a platform's data must remain within a particular infrastructure, migrating to another provider can become technically difficult.

This can create:

data residency → infrastructure dependency → switching costs → customer lock-in.

8. Regulatory asymmetry

Localization may affect foreign firms differently from domestic firms.

A domestic incumbent may already possess:

• domestic servers;
• government relationships;
• local legal teams;
• local cybersecurity infrastructure.

A foreign entrant must construct these from scratch.

This creates a potential de facto discriminatory effect, even if the law is formally neutral.

5. Competition-Law Tests For Data Localization

Competition authorities should generally ask five questions.

Question 1: What is the legitimate regulatory objective?

Examples:

• privacy;
• cybersecurity;
• national security;
• financial stability;
• law-enforcement access.

Question 2: Is localization actually necessary?

Could the objective be achieved through:

• encryption;
• contractual safeguards;
• anonymisation;
• pseudonymisation;
• access controls;
• independent audits?

If yes, complete localization may be unnecessarily restrictive.

Question 3: Is the rule technologically neutral?

A rule favoring domestic cloud architecture over foreign cloud architecture may have discriminatory effects.

Question 4: Does the rule disproportionately burden entrants?

Authorities should examine:

• fixed compliance costs;
• infrastructure expenditure;
• regulatory complexity;
• minimum efficient scale.

Question 5: Does localization strengthen an already dominant undertaking?

This is perhaps the most important competition question.

6. Key Case Laws

1. Meta Platforms Ireland Ltd v Bundeskartellamt, C-252/21

Background

The German competition authority investigated Facebook's combination of data obtained from different sources.

The dispute concerned the relationship between:

• data collection;
• privacy law;
• user consent;
• Facebook's dominance; and
• competition law.

Importance

The CJEU recognized that data-protection considerations can be relevant to competition analysis where a dominant platform's conduct involves extensive personal-data processing.

The case is highly relevant to localization because it demonstrates that data governance and competition law cannot always be treated as separate regulatory silos.

Competition principle

A dominant digital platform cannot necessarily argue:

"This is only a privacy issue; therefore competition authorities have no role."

At the same time, competition authorities must respect the competence of data-protection regulators.

Localization relevance

The case provides a framework for analyzing whether restrictions on data combination or transfer:

• protect users;
• reduce data advantages;
• alter competitive conditions; or
• unnecessarily disadvantage rivals.

2. Schrems II, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, C-311/18

Background

The CJEU examined international transfers of personal data from the EU to the United States.

It invalidated the EU-US Privacy Shield and scrutinized the protection available when European personal data is transferred to third countries.

Competition significance

Although Schrems II was not an antitrust case, its economic consequences are highly relevant.

International transfer restrictions can increase:

• compliance costs;
• data-center requirements;
• contractual costs;
• cybersecurity expenditure;
• fragmentation of data infrastructure.

Competition principle

Cross-border data-transfer restrictions can change the competitive structure of digital markets.

A multinational company may have to operate:

EU data architecture + U.S. data architecture + jurisdiction-specific safeguards.

This increases fixed costs.

Localization relevance

Schrems II illustrates the difference between:

privacy-driven territorial restrictions

and

competition-driven market fragmentation.

Competition authorities must consider both.

3. Google LLC and Alphabet Inc. v European Commission — Google Shopping, T-612/17

Background

The European Commission found Google dominant in general search and abusive in relation to comparison-shopping services.

The General Court upheld the central finding of abuse.

Competition significance

The case established the importance of examining how a dominant platform controls access to data, visibility, and digital infrastructure.

Localization connection

Localization can produce an analogous problem.

If a dominant platform possesses the only meaningful dataset in a particular jurisdiction, territorial restrictions may make that dataset even more difficult for competitors to replicate.

Therefore:

Localization can transform an ordinary data advantage into a geographically protected data advantage.

Principle

Digital competition must consider:

• access;
• scale;
• data;
• visibility;
• network effects; and
• ecosystem advantages.

4. Google Android, Google LLC and Alphabet Inc. v European Commission, T-604/18

Background

The Commission found Google had abused its dominant position through various contractual and ecosystem restrictions concerning Android, Google Search, Chrome and the Play Store.

The General Court substantially upheld the Commission's findings, while adjusting aspects of the fine.

The case illustrates how dominance can arise from the interaction of several interconnected digital markets.

Competition significance

The Android case demonstrates the importance of:

• ecosystems;
• interoperability;
• default arrangements;
• contractual restrictions;
• network effects;
• platform scale.

Localization connection

Localization can strengthen ecosystem power when a dominant platform has the resources to maintain compliant infrastructure across jurisdictions while smaller competitors cannot.

For example:

dominant platform + localized data infrastructure + ecosystem integration

may become a significant competitive barrier.

5. Google LLC and Alphabet Inc. v European Commission, T-334/19 — Google AdSense

Background

The case concerned Google's conduct in online search advertising intermediation.

The General Court considered contractual restrictions and exclusivity arrangements affecting competitors.

Competition significance

The case demonstrates that contractual restrictions can preserve dominance where competitors depend upon access to a dominant platform's ecosystem.

Localization connection

Data localization can operate as a structural equivalent where competitors must satisfy costly territorial infrastructure conditions before they can compete.

The resulting effect may be:

localization requirement → increased cost → fewer competitors → greater platform concentration.

The case therefore helps illustrate why authorities should examine effects on competitive structure, rather than merely asking whether a rule is facially neutral.

6. United States and Plaintiff States v Google LLC — Search and Digital Advertising Monopolization

The U.S. Google litigation provides an important illustration of how control over data and digital infrastructure can contribute to durable market power.

The U.S. Department of Justice's continuing proceedings include remedies involving data sharing, interoperability and access for competitors.

Competition significance

The case demonstrates an increasingly important antitrust idea:

Competition remedies may need to address access to strategically important data and infrastructure.

Localization connection

Suppose a dominant firm controls the principal dataset in a country and localization prevents competitors from obtaining equivalent cross-border information.

The result may be:

localized data advantage → stronger incumbent position → weaker entry → reduced innovation.

The case therefore provides a useful analogy for assessing localization's effects on data-driven monopolies.

7. Google Search / Self-Preferencing Case, T-612/17

This case is particularly relevant to the concept of data advantage and platform leverage.

Google's ability to collect enormous quantities of search information contributed to its competitive position.

The broader principle is that a platform's control over a critical data-generating interface can influence adjacent markets.

Localization can magnify this effect when competitors cannot pool equivalent information internationally.

8. Facebook/Bundeskartellamt Proceedings

The German Facebook case also illustrates a broader structural concern: the competitive value of personal data can be inseparable from the conditions under which that data is collected and combined.

The competition authority therefore cannot always ignore:

• privacy restrictions;
• consent structures;
• data combination;
• cross-service data flows.

The case is especially useful for examining the intersection between privacy regulation and abuse of dominance.

7. Six Major Competition Effects Summarized

8. Data Localization And Market Definition

Localization can complicate traditional market-definition analysis.

Traditionally, a digital platform may be viewed as operating in a:

global digital market.

Localization may instead make the relevant market:

India-specific,
EU-specific,
China-specific, etc.

This raises an important antitrust question:

Is the geographic market genuinely national?

If consumers cannot freely access competing services because data cannot legally cross borders, the geographic market may become more localized.

Therefore, law itself can affect the boundaries of the relevant market.

9. Data Localization And Essential-Facility Theory

A particularly important issue arises where a dominant undertaking controls a dataset that competitors cannot reasonably reproduce.

Potential examples include:

• health databases;
• financial transaction data;
• search data;
• mobility data;
• telecommunications data;
• industrial IoT data.

If localization prevents rivals from accessing comparable international datasets, competition authorities may consider whether the resulting data bottleneck constitutes:

• an essential input;
• a refusal-to-supply problem;
• discriminatory access;
• exclusionary conduct; or
• an ecosystem foreclosure mechanism.

However, not every dataset is an essential facility.

Authorities must examine:

1. indispensability;
2. duplication possibilities;
3. technical feasibility;
4. legitimate privacy restrictions;
5. security concerns;
6. investment incentives.

10. Localization And Small Businesses

Localization can have a particularly strong impact on SMEs.

A multinational corporation may be able to operate:

• 20 national data centers;
• separate compliance teams;
• multiple cloud environments;
• jurisdiction-specific cybersecurity systems.

A startup may not.

Thus, apparently neutral localization rules can have a regressive competitive effect:

Large incumbent → absorbs compliance cost
Small entrant → cannot achieve viable scale.

This is a classic competition concern because regulatory compliance can become an endogenous barrier to entry.

11. Localization And Cloud Competition

Cloud computing represents one of the most significant areas of concern.

Suppose a country requires sensitive data to remain domestically hosted.

Only three providers may have:

• certified domestic data centers;
• government security accreditation;
• required technical architecture.

The localization requirement may therefore produce a concentrated market.

Competition authorities should examine:

• cloud concentration;
• interoperability;
• data portability;
• egress charges;
• switching costs;
• API compatibility;
• interoperability;
• multi-cloud functionality.

Otherwise:

data sovereignty may unintentionally become cloud-provider sovereignty.

12. Localization And Artificial Intelligence

AI creates a particularly difficult problem.

Large AI models depend upon massive and diverse datasets.

Localization may prevent firms from combining:

• medical data from different countries;
• multilingual datasets;
• financial data;
• consumer behavior data;
• mobility datasets;
• scientific research datasets.

The effect can be:

Large incumbent

Large domestic dataset + domestic infrastructure + capital.

Small entrant

Small domestic dataset + high compliance cost + limited computing capacity.

The result may be reduced:

• innovation;
• model diversity;
• accuracy;
• competition;
• research collaboration.

However, localization can also generate legitimate benefits where datasets involve:

• national security;
• highly sensitive medical information;
• children's information;
• critical infrastructure.

The competition analysis must therefore be proportionality-based rather than automatically anti-localization.

13. Data Localization And Digital Sovereignty

Modern localization laws increasingly reflect digital sovereignty.

Governments want domestic control over:

• cloud infrastructure;
• AI;
• telecommunications;
• strategic datasets;
• cybersecurity;
• critical infrastructure.

This creates a potential conflict between:

Regulatory sovereignty

and

International competition.

A country may legitimately want domestic control over strategic data.

But if every jurisdiction adopts maximal localization, the global digital economy can become fragmented.

14. Risk Of Regulatory Protectionism

One of the most important concerns is hidden protectionism.

A government might claim:

"Data must remain domestic for security."

But if the practical effect is:

foreign platforms face enormous compliance costs while domestic platforms face minimal costs,

the measure may function as an industrial-policy instrument.

Competition authorities should therefore distinguish:

genuine public-interest regulation

from

regulatory protectionism disguised as data sovereignty.

15. Competition-Friendly Localization

Localization does not have to be eliminated.

A competition-compatible framework could use:

1. Risk-based localization

Only genuinely sensitive datasets are localized.

2. Data portability

Consumers and businesses can move their data between providers.

3. Interoperability

Providers must support common technical standards.

4. Regulatory sandboxes

Small firms receive proportional compliance mechanisms.

5. Privacy-preserving technologies

Use:

• anonymisation;
• encryption;
• federated learning;
• secure multiparty computation;
• differential privacy.

6. Cross-border trusted environments

Data can be processed internationally without uncontrolled disclosure.

7. Competition impact assessments

Major localization rules should be evaluated for:

• entry barriers;
• concentration;
• SME effects;
• innovation;
• interoperability.

16. Difference Between Data Localization And Data Protection

These concepts should not be confused.

Data protection

Asks:

How should data be collected, processed and protected?

Data localization

Asks:

Where should data be stored or processed?

A country can have:

strong data protection + relatively free international transfers.

Another can have:

strong localization + extensive domestic regulatory access.

Therefore, localization is only one possible method of achieving privacy or security objectives.

17. Emerging Antitrust Doctrine

The global trend is moving toward recognition that data regulation and competition law overlap.

The emerging doctrine can be summarized as:

Privacy cannot automatically immunize exclusionary conduct, and competition law cannot automatically override legitimate privacy and security protections.

The EU's recent approach to search-data access demonstrates this balancing exercise: competition-oriented data access is being paired with anonymisation and security safeguards.

Similarly, U.S. digital antitrust remedies increasingly contemplate interoperability and data access where necessary to restore competition.

18. Key Legal Issues For Future Cases

Future litigation is likely to involve:

1. whether localization creates an unjustified entry barrier;
2. whether domestic storage requirements discriminate against foreign competitors;
3. whether localization strengthens dominant cloud providers;
4. whether localized datasets become essential facilities;
5. whether AI training data can constitute a critical competitive input;
6. whether governments can justify localization on national-security grounds;
7. whether privacy-preserving alternatives make localization unnecessary;
8. whether localization conflicts with digital-market legislation;
9. whether localization facilitates domestic incumbents' data advantages;
10. whether competition authorities can order data access notwithstanding privacy restrictions.

19. Overall Legal Assessment

The competition-law effect of data localization is context-dependent.

Potentially pro-competitive

Localization can:

• protect sensitive information;
• increase consumer trust;
• prevent security risks;
• create domestic digital infrastructure;
• reduce certain forms of foreign dependency.

Potentially anticompetitive

Localization can:

• increase barriers to entry;
• fragment markets;
• reduce economies of scale;
• strengthen incumbents;
• increase cloud concentration;
• restrict AI development;
• increase switching costs;
• reduce cross-border competition.

The decisive question

The correct competition-law inquiry is therefore not:

"Is data localization good or bad?"

It is:

"Does the particular localization measure pursue a legitimate objective through the least competition-restrictive reasonably available means, or does it unnecessarily protect incumbent market power?"

20. Conclusion

Global data localization laws are becoming a major structural issue in competition law.

They transform data from a purely informational asset into a territorially regulated economic resource.

The most significant competition effects arise when localization interacts with:

• dominant platforms;
• cloud computing;
• AI;
• digital advertising;
• financial technology;
• telecommunications;
• data portability;
• interoperability;
• network effects; and
• economies of scale.

The principal legal challenge is to reconcile privacy, cybersecurity and national sovereignty with open and contestable digital markets.

The emerging approach should therefore favor proportionate, risk-based localization, supported by interoperability, portability, privacy-enhancing technologies and non-discriminatory access.

The leading cases—particularly Meta v Bundeskartellamt, Schrems II, Google Shopping, Google Android and the U.S. Google monopolization proceedings—demonstrate that data governance can materially affect competitive structure even where the underlying rule is formally enacted as a privacy, security or sovereignty measure.

In short:

Data localization can protect digital sovereignty, but excessive localization can create territorial data monopolies, raise entry barriers and fragment global digital competition. The future of competition law will increasingly require authorities to evaluate these effects together rather than treating privacy, data governance and antitrust as completely separate fields.