1. Introduction

Cross-border enforcement of data protection violations refers to the legal mechanisms through which governments, regulatory authorities and courts investigate, prosecute and penalise violations of personal data protection laws involving individuals, organisations or digital platforms operating across different countries.

In the modern digital economy, personal information is frequently transferred between countries through cloud computing, international business transactions, artificial intelligence, online platforms and multinational corporations. Consequently, a data protection violation committed in one jurisdiction may affect individuals residing in several other jurisdictions.

For example, when an international technology company unlawfully collects personal information from Indian citizens, stores it in foreign servers and transfers it to third parties, questions arise concerning jurisdiction, applicable law, regulatory investigation, evidence collection and enforcement of penalties.

Cross-border enforcement therefore seeks to ensure accountability, protect individual privacy and prevent organisations from escaping liability merely because their operations are located outside the affected country.

2. Legal Framework Governing Cross-Border Enforcement

Different jurisdictions have developed legal frameworks for addressing international data protection violations.

A. European Union – General Data Protection Regulation (GDPR)

The GDPR provides one of the strongest international data protection enforcement frameworks.

Article 3 establishes territorial and extraterritorial application.

Articles 55–56 establish supervisory authority jurisdiction and the lead supervisory authority mechanism.

Articles 60–62 provide cooperation and consistency mechanisms between supervisory authorities.

Articles 77–82 provide complaint, judicial remedy, compensation and liability mechanisms.

Article 83 provides administrative fines for violations.

The GDPR can apply to organisations established outside the European Union when they offer goods or services to individuals in the EU or monitor their behaviour within the Union.

B. India – Digital Personal Data Protection Act, 2023

India's Digital Personal Data Protection Act, 2023 (DPDP Act) establishes obligations for processing digital personal data. Section 3 provides for territorial application, including certain processing outside India connected with offering goods or services to individuals in India.

Sections 8 and 10 establish important obligations concerning data fiduciaries and significant data fiduciaries. Sections 27–33 address the Data Protection Board of India's functions, proceedings, penalties and appeals.

The Act therefore provides a framework for addressing violations involving foreign organisations that fall within its territorial scope.

3. Important Case Laws

A. Google Spain SL v. AEPD and Mario Costeja González (2014)

CJEU, Case C-131/12

The Court of Justice of the European Union held that Google could be treated as a data controller in relation to its search-engine activities and that EU data protection law could apply to its activities through its Spanish establishment.

The judgment recognised the right to request removal of certain personal information from search results. It established that international internet companies cannot automatically avoid European data protection obligations by locating their principal operations elsewhere.

Legal principle: Territorial jurisdiction and accountability of multinational digital companies.

B. Weltimmo s.r.o. v. NAIH (2015)

CJEU, Case C-230/14

The dispute concerned a Slovak company operating a property website involving advertisements in Hungary. The Hungarian data protection authority imposed a fine for unlawful processing of personal information.

The CJEU explained that an establishment may exist where an organisation exercises real and effective activities through stable arrangements, even without a conventional registered office.

The judgment clarified how national regulators can exercise jurisdiction over foreign businesses.

Legal principle: A foreign company's effective economic activities may establish regulatory jurisdiction.

C. Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (Schrems II, 2020)

CJEU, Case C-311/18

This landmark judgment concerned transfers of European personal data to the United States. The Court invalidated the EU–US Privacy Shield because US surveillance laws did not provide protection essentially equivalent to EU standards.

However, it upheld the validity of Standard Contractual Clauses (SCCs), subject to an assessment of the destination country's legal system and effective protection.

The Court also emphasised that supervisory authorities must suspend or prohibit transfers where adequate protection cannot be ensured.

Legal principle: Cross-border data transfers require effective safeguards and enforceable individual rights.

Data Protection Commission

D. Google LLC v. CNIL (2019)

CJEU, Case C-507/17

The dispute concerned whether Google was required to implement the right to delisting across all versions of its search engine worldwide.

The CJEU held that EU law did not generally require worldwide delisting. However, search engines must ensure effective delisting across EU versions and take measures to prevent users within the EU from accessing delisted results through non-EU versions.

Legal principle: Data protection enforcement must balance territorial jurisdiction, privacy rights and freedom of information.

E. Meta Platforms Ireland – Facebook and Instagram Decisions (2022)

Irish Data Protection Commission, GDPR enforcement decisions

The Irish Data Protection Commission imposed fines of €210 million concerning Facebook and €180 million concerning Instagram for violations involving the legal basis and transparency of personal data processing.

The decisions arose from complaints by individuals in Austria and Belgium. They demonstrate how a lead supervisory authority can investigate a multinational platform while cooperating with other European regulators.

Legal principle: Cross-border regulatory cooperation can result in substantial penalties against multinational companies.

Data Protection Commissioner

4. Major Challenges in Cross-Border Enforcement

Cross-border enforcement faces several practical and legal difficulties.

1. Jurisdictional conflicts: Different countries may claim authority over the same data processing activity. Determining which regulator has primary jurisdiction can become complicated.

2. Conflicting national laws: One country may permit certain data transfers while another prohibits them. Organisations must comply with competing legal requirements.

3. Difficulty in collecting evidence: Important digital evidence may be stored on foreign servers. Investigators may require international legal assistance to obtain records.

4. Enforcement of foreign penalties: A regulatory authority may impose a financial penalty, but recovering the amount from an organisation without assets in that jurisdiction can be difficult.

5. Corporate restructuring: Multinational companies may distribute their operations among subsidiaries in different countries, complicating the identification of the responsible legal entity.

6. Government surveillance conflicts: Foreign intelligence and national security laws may conflict with the privacy protections required by another jurisdiction.

5. Mechanisms for Effective Cross-Border Enforcement

Several mechanisms improve international enforcement:

A. International regulatory cooperation: Data protection authorities exchange information, coordinate investigations and cooperate in enforcement proceedings.

B. Mutual Legal Assistance Treaties (MLATs): Countries use MLATs to obtain electronic evidence, financial records and other information required for investigations.

C. Standard Contractual Clauses: SCCs establish contractual safeguards for international data transfers, although contractual commitments alone cannot overcome conflicting destination-country laws.

D. Joint investigations: Regulatory authorities coordinate investigations into multinational organisations to avoid inconsistent decisions.

E. Extraterritorial jurisdiction: National laws may apply to foreign organisations where their activities affect individuals within the regulating jurisdiction.

F. International enforcement agreements: Bilateral and multilateral cooperation arrangements facilitate information sharing and regulatory assistance.

6. Position Under Indian Law

India's DPDP Act, 2023 is particularly relevant to cross-border enforcement.

Section 3: Establishes the territorial scope of the Act, including qualifying processing outside India.

Section 16: Authorises the Central Government to restrict transfers of personal data to specified foreign countries or territories.

Section 27: Provides for the functions and powers of the Data Protection Board of India.

Section 28: Provides for the Board's proceedings.

Section 33: Provides for monetary penalties for statutory contraventions.

An important commencement qualification applies: the notification dated 13 November 2025 introduced phased implementation. As of 5 November 2026, the principal substantive provisions, including Sections 3–17, are scheduled to commence 18 months after publication, on 13 May 2027. Accordingly, the full substantive cross-border enforcement framework should not be treated as already operational.

IndiaCode+1

7. Conclusion

Cross-border enforcement of data protection violations is essential for protecting privacy in an interconnected digital economy. International businesses must not escape legal responsibility simply because personal information is processed or stored outside the country where individuals reside.

The GDPR, India's DPDP Act and international judicial decisions establish important principles concerning territorial jurisdiction, regulatory cooperation, international transfers and corporate accountability.

Cases such as Schrems II, Google Spain and Google LLC v. CNIL demonstrate that effective data protection requires cooperation between national regulators, enforceable legal safeguards and meaningful remedies for affected individuals.

Ultimately, successful cross-border enforcement requires harmonisation of legal standards, international assistance, effective investigation mechanisms and accountability of multinational digital organisations.

Important cases for examination revision:

Overall legal principle: Data protection obligations must follow the processing of personal information across borders, while enforcement must respect jurisdictional limits, international cooperation and fundamental rights.