1. Introduction

Cross-border transfer of digital twin datasets is an emerging and complex area of biotechnology law, data protection law, intellectual property law, cybersecurity regulation, international trade law and artificial intelligence governance.

A digital twin is a digital representation of a real-world physical object, person, biological system, industrial facility, medical device, infrastructure network or operational process. It uses real-time and historical data, computational models, simulation techniques and artificial intelligence to reproduce or predict the behaviour of its physical counterpart.

For example:

Healthcare: A digital twin of a patient's heart may contain medical imaging, genomic information, physiological measurements and treatment-response predictions.

Biotechnology: A digital twin of a human cell may contain molecular, genomic, metabolic and cellular-response datasets.

Manufacturing: A digital twin of a pharmaceutical production facility may contain machinery performance, production parameters and quality-control records.

Energy infrastructure: A digital twin of a power grid may contain operational data, predictive maintenance information and network vulnerabilities.

Public infrastructure: A digital twin of a city may contain transportation, population, environmental and infrastructure datasets.

Cross-border transfer occurs when these datasets are transmitted, accessed, hosted, processed, replicated or analysed in another country.

The legal difficulty is that digital twin datasets frequently combine several categories of information:

Personal and sensitive personal information.

Genetic and biometric information.

Commercially confidential information.

Intellectual property and proprietary algorithms.

Critical infrastructure information.

Artificial intelligence training and simulation datasets.

Predictive information generated through computational modelling.

Consequently, transferring a digital twin dataset internationally is not merely a technical data-export operation. It can constitute a regulated transfer of personal information, commercial secrets, protected intellectual property or security-sensitive information.

Central legal question: Under what circumstances can an organisation transfer a digital twin dataset from one jurisdiction to another while maintaining privacy, confidentiality, intellectual property protection, cybersecurity and regulatory accountability?

2. Meaning and legal characteristics of digital twin datasets

A digital twin dataset is not necessarily a single database. It may contain interconnected data layers.

An important distinction exists between the original physical-system data and the computationally generated information.

For instance, a hospital may transfer a patient's medical measurements to a foreign cloud provider. The foreign provider may then generate additional information through predictive modelling.

The legal analysis must therefore consider:

The original dataset.

Derived and inferred information.

Model parameters and simulation outputs.

Re-identification possibilities.

Access by foreign affiliates and subcontractors.

Subsequent transfers to additional countries.

A dataset does not automatically become anonymous merely because direct identifiers have been removed. A digital twin may retain enough distinctive characteristics to identify its real-world subject.

3. International legal framework

A. European Union: GDPR

The General Data Protection Regulation (GDPR) provides one of the most important legal frameworks governing international transfers of digital twin datasets.

The principal provisions are:

Application to digital twins

Suppose a German hospital creates a digital twin of a patient's cardiovascular system and transfers it to a Singapore-based AI company for predictive treatment analysis.

The hospital must examine:

Whether the original medical information is lawfully processed.

Whether the digital twin contains identifiable or re-identifiable personal information.

Whether the processing of health information satisfies Article 9.

Whether the international transfer satisfies Chapter V.

Whether the foreign recipient provides sufficient contractual and technical safeguards.

Whether subsequent transfers to other countries are permitted.

An important principle is that pseudonymisation does not automatically remove information from GDPR protection.

B. Schrems II and international data-transfer safeguards

The landmark judgment in Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (Case C-311/18, 2020), commonly called Schrems II, is particularly important.

The Court of Justice of the European Union invalidated the EU–US Privacy Shield because the protection available against certain US public-authority surveillance did not satisfy the required EU standard.

However, the Court upheld the validity of Standard Contractual Clauses (SCCs), subject to effective assessment of the circumstances of the transfer and supplementary safeguards where necessary.

Application to digital twin datasets

A company cannot assume that signing an international data-transfer agreement automatically makes a transfer lawful.

For digital twin datasets, a transfer impact assessment should consider:

Whether foreign authorities can obtain access to the dataset.

Whether the recipient can resist disproportionate government demands.

Whether encryption prevents the foreign recipient from accessing plaintext data.

Whether biometric or genomic information can be re-identified.

Whether the foreign country provides effective judicial remedies.

The principle is especially important for digital twins containing medical, genomic and biometric information.

C. European Union Data Act

The EU Data Act (Regulation (EU) 2023/2854) is relevant because digital twins frequently depend on information generated by connected products and industrial systems.

It became applicable on 12 September 2025.

Its principal relevance includes:

Access to data generated by connected products.

Business-to-business data-sharing obligations.

Protection of trade secrets.

Fair and reasonable data-sharing conditions.

Switching between data-processing services.

Safeguards against certain unlawful third-country governmental access to non-personal data held in the EU.

Article 32 is particularly significant. It requires data-processing service providers to adopt appropriate technical, organisational and legal measures against third-country governmental access or transfer that would conflict with EU or Member State law.

Example: A French manufacturer operates an industrial digital twin using machinery data stored in an EU cloud environment. A foreign government demands access to the underlying non-personal operational dataset. The provider must consider Article 32 and the relevant international agreement and legal safeguards before complying.

Importantly, the Data Act does not create a blanket prohibition on ordinary international commercial data transfers.

Shaping Europe’s digital future+2

D. India: Digital Personal Data Protection Act, 2023

India's Digital Personal Data Protection Act, 2023 is particularly important for digital twin datasets involving Indian individuals.

Section 16 governs the processing of personal data outside India.

It permits cross-border transfers subject to restrictions that the Central Government may impose by notification on transfers to specified countries or territories.

Section 16(2) also preserves the operation of other Indian laws that impose a higher degree of protection or stricter transfer restrictions.

The Digital Personal Data Protection Rules, 2025 were notified in November 2025. Their commencement is phased, so the applicable obligations must be assessed against the relevant commencement provisions rather than assuming that every provision became enforceable immediately.

Press Information Bureau+3

Application

Suppose an Indian biotechnology company transfers a digital twin dataset containing genomic and clinical information to a foreign AI research institution.

The organisation should examine:

Whether the information constitutes digital personal data.

Whether a valid legal basis for processing exists.

Whether applicable consent and notice obligations are satisfied.

Whether the destination country is subject to a notified transfer restriction.

Whether another Indian law imposes stricter requirements.

Whether appropriate security and contractual safeguards exist.

A significant distinction must be maintained: Section 16 is not a general requirement that every personal-data transfer must receive individual government approval.

Other relevant Indian legislation

Information Technology Act, 2000, including applicable provisions concerning unauthorised access and disclosure.

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable during the relevant legal transition.

Patents Act, 1970.

Copyright Act, 1957.

Information Technology Rules and applicable cybersecurity directions.

Sector-specific requirements governing medical, pharmaceutical and critical infrastructure information.

The interaction between these laws is important because a digital twin may contain both personal information and proprietary technical material.

4. United States: International transfer and digital twin governance

The United States does not have one comprehensive federal privacy statute equivalent to the GDPR.

Instead, different federal and state laws may apply depending on the dataset, organisation and purpose.

Important legal regimes include:

1. HIPAA

The Health Insurance Portability and Accountability Act governs protected health information handled by covered entities and business associates.

A healthcare digital twin containing identifiable patient information may fall within HIPAA's protection.

Relevant issues include:

Permitted uses and disclosures.

Business associate agreements.

Security safeguards.

Authorised access.

Disclosure to foreign service providers.

Breach notification.

HIPAA does not impose a general prohibition on transferring protected health information abroad, but the covered entity remains responsible for applicable HIPAA obligations.

2. FTC Act

The Federal Trade Commission Act may apply where organisations make deceptive privacy promises or engage in unfair data-handling practices.

For example, a digital twin company that promises to retain patient datasets within the United States but secretly transfers them to overseas analytics providers may face regulatory scrutiny.

3. State privacy legislation

State laws may provide additional protections for sensitive personal information, biometric information and consumer health data.

4. Foreign government access

The US CLOUD Act and other applicable government-access laws create additional jurisdictional questions where digital twin datasets are stored or controlled by foreign or multinational cloud providers.

The organisation must distinguish lawful government access from unauthorised commercial disclosure.

5. Important judicial decisions and case laws

There is currently no established body of reported judgments specifically deciding the international transfer of digital twin datasets. However, several important decisions concerning privacy, international data transfers, joint control, territorial jurisdiction and informational autonomy provide the governing legal principles.

Case 1. Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (Schrems II)

Highly relevant

Court: Court of Justice of the European Union

Case number: C-311/18

Date: 16 July 2020

Facts: Maximillian Schrems challenged the transfer of personal data from Facebook Ireland to the United States. He argued that US surveillance laws failed to provide adequate protection for European personal information.

Legal issue: Whether international transfers based on Standard Contractual Clauses could continue when the destination country's laws potentially undermined the protections guaranteed under EU law.

Judgment: The Court invalidated the EU–US Privacy Shield but upheld Standard Contractual Clauses subject to effective safeguards and assessment of the recipient country's legal system.

Relevance to digital twin datasets:

Suppose an Indian or European healthcare organisation transfers a digital twin containing genomic and medical information to a foreign AI service provider.

The organisation must assess whether the foreign legal environment provides sufficient protection against:

Unauthorised government access.

Excessive surveillance.

Unlawful disclosure.

Inadequate judicial remedies.

Further unauthorised transfers.

Legal principle: Contractual transfer arrangements cannot independently overcome legal conflicts that make effective protection impossible.

Data Protection Commission+1

Case 2. Google Spain SL v Agencia Española de Protección de Datos

Court: Court of Justice of the European Union

Case number: C-131/12

Date: 13 May 2014

Facts: Mario Costeja González complained that search-engine results disclosed historical information about him that he considered harmful to his privacy.

Legal issue: Whether a search engine could be treated as a data controller and whether European data-protection law could apply to its processing activities.

Judgment: The Court recognised that search-engine operators could be data controllers and that individuals could, under appropriate circumstances, seek removal of links to personal information.

Relevance to digital twins:

Digital twin datasets are frequently processed repeatedly by cloud providers, research institutions and AI analytics companies.

The judgment supports the importance of examining the actual processing activities and the responsibilities of organisations that make personal information accessible through digital systems.

For example, a company cannot necessarily avoid privacy responsibilities simply by describing itself as a technical intermediary.

Legal principle: Organisations involved in the collection, organisation, indexing and processing of personal information may have independent legal responsibilities.

EUR-Lex+1

Case 3. Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV

Court: Court of Justice of the European Union

Case number: C-40/17

Date: 29 July 2019

Facts: Fashion ID embedded a Facebook social plugin on its website. The plugin enabled the transmission of visitors' personal information to Facebook.

Legal issue: Whether the website operator could be considered a joint controller despite not having direct access to the transmitted information.

Judgment: The Court recognised joint controllership for the collection and transmission operations where the parties jointly determined their purposes and means. Responsibility did not automatically extend to subsequent processing operations independently determined by Facebook.

Relevance to digital twins:

Consider a medical technology company that collects patient information and sends it to an overseas AI provider.

Both organisations may have legal responsibilities depending on their actual involvement in determining the purposes and means of processing.

The same analysis applies when:

A hospital supplies patient data.

A cloud provider stores the digital twin.

An AI company performs predictive modelling.

A foreign research institution receives derived outputs.

Legal principle: Lack of direct possession or access does not automatically eliminate responsibility for processing activities over which an organisation exercises joint control.

EUR-Lex+1

Case 4. Justice K.S. Puttaswamy (Retd.) v Union of India

Important Indian constitutional authority

Court: Supreme Court of India

Citation: (2017) 10 SCC 1

Date: 24 August 2017

Facts: The constitutional validity of the Aadhaar identification framework raised important questions concerning privacy and informational autonomy.

Legal issue: Whether privacy is protected as a fundamental right under the Constitution of India.

Judgment: A nine-judge Constitution Bench unanimously recognised privacy as a fundamental right under Article 21 and the freedoms protected by Part III of the Constitution.

The judgment recognised informational privacy as an important aspect of individual autonomy.

Relevance to digital twins:

A digital twin of an individual may reveal:

Genetic characteristics.

Health conditions.

Behavioural patterns.

Physical characteristics.

Reproductive information.

Predicted future health risks.

The creation and international transfer of such information may therefore engage constitutional privacy concerns.

The judgment provides a constitutional foundation for evaluating state interference and the legal framework governing personal information.

Legal principle: Privacy is an essential component of dignity, autonomy and personal liberty.

Indian Kanoon

Case 5. K.S. Puttaswamy v Union of India (Aadhaar judgment)

Court: Supreme Court of India

Citation: (2019) 1 SCC 1

Date: 26 September 2018

Facts: The Court examined the constitutional validity of the Aadhaar scheme, including the collection and use of biometric and identity information.

Legal issue: Whether extensive collection and use of personal and biometric information satisfied constitutional requirements.

Judgment: The Court upheld important aspects of the Aadhaar framework while striking down or limiting certain provisions, including the mandatory private-sector use of Aadhaar authentication under Section 57 of the Aadhaar Act.

Relevance to digital twins:

Digital twins can contain biometric and physiological information that is substantially more detailed than conventional identity records.

The decision supports careful scrutiny of:

The purpose of collecting biometric information.

The proportionality of its use.

The necessity of retaining it.

The extent of private-sector access.

The potential consequences of misuse.

Legal principle: Collection and use of biometric information must operate within constitutionally permissible limits.

Case 6. Data Protection Commissioner v Facebook Ireland and Schrems (Schrems I)

Court: Court of Justice of the European Union

Case number: C-362/14

Date: 6 October 2015

Facts: Maximillian Schrems challenged the transfer of European personal information to the United States under the Safe Harbour framework.

Judgment: The Court invalidated the EU–US Safe Harbour adequacy decision.

Relevance: The case established that an international data-transfer framework must provide effective protection, rather than relying solely on formal assurances.

For digital twin operators, this is relevant when selecting foreign cloud providers, AI processors and international research partners.

Case 7. Wirtschaftsakademie Schleswig-Holstein GmbH v Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein

Court: Court of Justice of the European Union

Case number: C-210/16

Date: 5 June 2018

Facts: The dispute concerned a company operating a Facebook fan page and the processing of visitor information by Facebook.

Judgment: The Court recognised joint controllership between the fan-page administrator and Facebook in relation to certain processing operations.

Relevance: Digital twin operators must identify all organisations that participate in determining how datasets are collected and processed.

An organisation cannot assume that responsibility belongs exclusively to the foreign cloud platform.

Case 8. Google LLC v CNIL

Court: Court of Justice of the European Union

Case number: C-507/17

Date: 24 September 2019

Facts: The French data-protection authority required Google to implement a worldwide de-referencing obligation in connection with the right to be forgotten.

Judgment: The Court held that EU law did not generally require worldwide de-referencing. It required de-referencing on EU versions of the search engine and effective measures to prevent or seriously discourage access from EU Member States to the relevant links.

Relevance: The judgment demonstrates that privacy rights, territorial jurisdiction and the global reach of digital information must be carefully balanced.

A digital twin operator must therefore examine the geographical scope of applicable privacy obligations and the appropriate reach of correction, restriction and erasure measures.

Data Protection Commission+1

6. Cross-border transfer of genetic and biometric digital twin datasets

This is one of the most sensitive areas of digital twin governance.

A genetic digital twin may contain information about an individual's:

DNA sequence.

Genetic mutations.

Disease susceptibility.

Hereditary conditions.

Family relationships.

Biological ageing.

Predicted response to treatment.

Unlike an ordinary password or identification number, genetic characteristics cannot simply be changed following a data breach.

Principal legal concerns

1. Re-identification

A supposedly anonymous genetic dataset may be matched with publicly available genealogical or demographic information.

2. Familial privacy

Genetic information concerning one person may reveal information about biological relatives who never consented to the original research.

3. Secondary commercial use

A foreign recipient may use the transferred dataset to develop pharmaceutical products, predictive health models or commercial research databases.

4. Discrimination

Genetic predictions may be used improperly in employment, insurance or other consequential decisions.

5. Permanent informational exposure

The consequences of disclosure may continue long after the original research project has ended.

Relevant legal safeguards

Explicit and sufficiently informed consent where required.

Appropriate research ethics approval.

Pseudonymisation and encryption.

Strict access controls.

Separation of identity keys from research datasets.

Limits on secondary use.

Restrictions on onward transfer.

Data retention and deletion provisions.

Independent audits.

A particularly important distinction is that consent to participate in medical research does not necessarily amount to unrestricted consent for international commercial exploitation of the resulting digital twin.

7. Intellectual property and ownership of transferred digital twin datasets

International transfer creates complex questions concerning ownership and control.

A digital twin may combine information owned or controlled by different parties.

A. Copyright protection

Under the Indian Copyright Act, 1957, original literary works, including qualifying computer databases and computer programs, may receive copyright protection.

However, copyright does not automatically grant ownership over every individual fact contained in a dataset.

B. Trade secrets

Digital twin datasets may reveal confidential manufacturing processes, pharmaceutical formulations, industrial vulnerabilities and predictive algorithms.

Their transfer may constitute a breach of confidentiality obligations if appropriate authorisation is absent.

C. Patent law

A digital twin may incorporate patented technology, including sensor systems, medical devices, simulation techniques and industrial processes.

The transfer of a dataset does not automatically transfer ownership of the patents associated with the technology.

D. Contractual ownership disputes

International agreements should specify:

Ownership of source data.

Rights to derived datasets.

Rights to train AI models.

Ownership of improvements.

Permitted research uses.

Commercial licensing rights.

Restrictions on reverse engineering.

Post-termination deletion obligations.

An especially important issue arises when a foreign AI provider generates a new predictive model using a digital twin dataset. The parties must determine whether the resulting model may be retained or commercialised after the original transfer agreement ends.

8. Cybersecurity and national security restrictions

Digital twin datasets can reveal the internal functioning of critical infrastructure.

For example, a digital twin of an electricity transmission network may contain:

Substation configurations.

Grid-load information.

Equipment vulnerabilities.

Network topology.

Predictive failure information.

Cybersecurity weaknesses.

Transferring such information to a foreign cloud provider may create national security risks.

Principal legal concerns

A. Unauthorised foreign access

Foreign governments or third parties may obtain access to sensitive infrastructure datasets.

B. Cyber espionage

Industrial digital twins may expose confidential manufacturing processes and infrastructure vulnerabilities.

C. Data manipulation

An attacker may modify simulation parameters, resulting in inaccurate predictions and potentially dangerous operational decisions.

D. Supply-chain attacks

A foreign software provider may introduce vulnerabilities through software updates, subcontractors or compromised infrastructure.

E. Digital twin sabotage

Manipulation of the digital twin may cause operators to make incorrect decisions concerning physical infrastructure.

Relevant Indian regulatory considerations

The following may become relevant depending on the nature of the dataset and organisation:

Information Technology Act, 2000.

Section 70 concerning protected systems.

Section 70A concerning the national nodal agency for critical information infrastructure protection.

Section 70B concerning CERT-In.

Applicable CERT-In cybersecurity directions.

Sector-specific cybersecurity requirements.

Applicable restrictions on sharing classified or strategically sensitive information.

The legal analysis must distinguish ordinary commercial datasets from information that qualifies as protected or critical infrastructure information.

9. Liability for unlawful cross-border digital twin transfers

Liability may arise at several levels.

A. Civil liability

Depending on the applicable legal system, affected individuals or organisations may seek:

Compensation.

Injunctions.

Restriction of processing.

Deletion of unlawfully transferred information.

Enforcement of confidentiality obligations.

Contractual damages.

B. Regulatory liability

Under the GDPR, violations of international transfer requirements may attract administrative penalties under Article 83.

Under India's DPDP framework, financial penalties may arise for violations of applicable statutory obligations, including security-related duties.

C. Criminal liability

Criminal liability may arise where the facts satisfy the elements of applicable offences, such as unauthorised access, dishonest extraction, disclosure or misuse of protected information.

D. Corporate and director accountability

Corporate governance failures may arise where management:

Ignores transfer restrictions.

Authorises unlawful foreign access.

Fails to conduct security assessments.

Conceals a data breach.

Permits unauthorised secondary commercial use.

The precise personal liability of directors depends on the applicable legislation and their role in the misconduct.

10. Contractual framework for lawful international transfer

A comprehensive cross-border digital twin transfer agreement should contain the following clauses.

Special importance of AI training restrictions

A foreign recipient should not automatically be entitled to use transferred digital twin datasets to train unrelated AI systems.

The agreement should distinguish:

Processing necessary to operate the original digital twin.

Generating outputs for the original customer.

Improving the customer's specific digital twin.

Training general-purpose AI models.

Commercialising derived datasets.

These activities may have different legal bases and contractual permissions.

11. Practical compliance framework

An organisation planning an international digital twin transfer should adopt a structured compliance procedure.

Cross-border digital twin transfer compliance

Dataset identification

Identify personal, biometric, genetic, medical, commercial and infrastructure information.

Jurisdictional assessment

Identify the exporting country, receiving country and countries from which remote access is possible.

Legal-basis verification

Determine the lawful basis for processing and the applicable international transfer mechanism.

Privacy and security assessment

Assess re-identification, surveillance, cybersecurity and onward-transfer risks.

Contractual safeguards

Execute suitable data-processing agreements, SCCs where applicable, confidentiality agreements and research-use restrictions.

Technical safeguards

Apply encryption, pseudonymisation, access controls, secure computing and audit logging.

Regulatory and ethical approval

Obtain any required regulatory authorisations, research approvals and institutional permissions.

Continuous monitoring

Monitor foreign access, changes in destination-country law, security incidents and subsequent transfers.

Termination and deletion

Ensure that datasets and unauthorised copies are returned, securely deleted or lawfully retained.

12. Hypothetical case studies

Case study 1: Indian hospital transferring a patient digital twin to Germany

An Indian hospital develops a digital twin containing MRI scans, genetic information, cardiovascular measurements and treatment predictions.

It transfers the dataset to a German medical research institution.

Legal questions:

Does the dataset contain identifiable digital personal data?

Is the processing lawful under Indian law?

Are applicable DPDP transfer restrictions satisfied?

Does the German institution comply with GDPR requirements?

Is the research covered by valid consent and ethics approval?

Are secondary commercial uses prohibited or separately authorised?

Legal outcome: The transfer may be permissible, but the Indian exporter and German recipient must independently satisfy the legal requirements applicable to their respective processing activities.

Case study 2: European pharmaceutical company transferring a digital twin to the United States

A pharmaceutical company develops a digital twin of a biological production facility.

The twin contains production parameters, employee information, proprietary algorithms and quality-control data.

Legal questions:

Does the dataset contain personal information?

Is an EU international transfer mechanism required?

Could US government-access laws conflict with EU protections?

Are pharmaceutical manufacturing secrets adequately protected?

Does the recipient have permission to use the data for independent AI training?

Legal outcome: The company should conduct a transfer impact assessment, establish appropriate transfer safeguards, separate confidential technical information from personal information where feasible and impose strict contractual restrictions.

Case study 3: Cross-border transfer of a human genomic digital twin

An Australian biotechnology company develops a digital twin based on genomic and cellular information and transfers it to a foreign research consortium.

Legal questions:

Whether the dataset can identify the individual or biological relatives.

Whether the transfer complies with applicable Australian privacy requirements.

Whether research consent permits international disclosure.

Whether genetic information can be used for commercial drug development.

Whether foreign recipients can retain derived predictive models.

Legal outcome: A transfer agreement alone is insufficient. The organisation must establish appropriate legal authority, research permissions, privacy safeguards and restrictions on subsequent use.

13. Emerging legal challenges

Several unresolved issues will shape the future regulation of cross-border digital twin datasets.

A. Ownership of digital twins

Who owns a digital twin: the patient, hospital, technology developer, cloud provider or AI developer?

Existing legal frameworks often distinguish between ownership of the physical object, rights in personal information, intellectual property and contractual control over datasets.

There is no universal rule giving one party ownership of the entire digital twin.

B. Digital twin identity and personhood

A highly detailed digital twin may reproduce many characteristics of a real person.

This creates questions concerning informational autonomy, personality rights, privacy and misuse of personal representations.

C. Synthetic dataset transfers

Synthetic datasets generated from real digital twins may still contain identifiable or inferential information.

Their legal status depends on whether individuals can reasonably be identified or information about them can be inferred.

D. Algorithmic sovereignty

A country may permit the transfer of a dataset while restricting foreign control over the models, algorithms or infrastructure used to process it.

This creates a distinction between data sovereignty and algorithmic sovereignty.

E. Digital twin deletion

Deleting an original dataset may not eliminate all derived copies, trained models, backups and simulation outputs.

Future regulation will need clearer standards for deletion, model unlearning and continuing accountability.

F. Conflicts between national laws

A digital twin may be subject to the laws of the exporting country, the receiving country and the country where the cloud provider is incorporated.

Conflicting government-access demands may create serious jurisdictional disputes.

14. Important legal principles emerging from the case laws

15. Conclusion

Cross-border transfer of digital twin datasets represents a developing area of international technology regulation.

Its complexity arises because digital twins combine personal information, biometric and genetic datasets, commercial secrets, proprietary algorithms and potentially sensitive infrastructure information.

The most important legal principles are:

International data transfers must satisfy the applicable jurisdictional transfer requirements.

Personal information remains protected even when incorporated into sophisticated digital models.

Pseudonymisation does not automatically establish anonymity.

Organisations must identify their respective controller, processor and joint-controller responsibilities.

Intellectual property and trade-secret rights must be protected independently of privacy obligations.

Foreign government access and cybersecurity risks must be assessed.

Contractual permissions must clearly regulate secondary use, AI training and onward transfers.

Organisations must maintain accountability throughout the entire digital twin lifecycle.

For India, Section 16 of the DPDP Act, 2023, together with the applicable provisions of the DPDP Rules, 2025 and other sectoral laws, provides an important part of the legal framework. For the European Union, GDPR Chapter V, the Schrems judgments and the EU Data Act are particularly significant.

Ultimately, the governing legal principle is that transferring a digital twin across national borders must not become a means of escaping the privacy, confidentiality, intellectual property and security protections applicable to its underlying information.

16. Important legislation and judicial references for academic research

Primary research sources

India Code – Digital Personal Data Protection Act, 2023.

MeitY – Digital Personal Data Protection Rules, 2025.

EU Data Act – Official Regulation.

European Commission – Standard Contractual Clauses guidance.

Schrems II – Irish Data Protection Commission case summary.

Google Spain – CJEU judgment.

Fashion ID – CJEU judgment.

Puttaswamy – Supreme Court of India judgment.

Academic qualification: The judgments discussed above establish principles relevant by analogy. They should not be represented as decisions directly determining ownership or international transfer of digital twin datasets. The specific legal treatment depends on the dataset, purpose, sector and jurisdictions involved.