1. Global Models of Sovereignty

Hard Model: Russia (Law 242-FZ) - Personal data of Russians must be stored in Russia first. China PIPL - Critical data must stay in China.

EU Model - Adequacy Model: GDPR allows transfer only to country with essentially equivalent protection. Storing data in EU region of US provider does NOT take it out of US reach. EU courts judge transfers by who can access the data.

India Model - Soft / Sectoral Model:
India's DPDP Act 2023 doesn't mandate blanket localization but allows government to blacklist countries for data transfers. Hard localisation is sector-specific.

• RBI mandate: Payment system data must be stored exclusively in India. Foreign processing permitted only under strict conditions - if processed abroad, must be deleted abroad and brought back within 24 hours or 1 business day.
• SEBI: Critical governance, risk and compliance data must remain in India.
• IRDAI: Policy and claims data must be stored locally.
• UIDAI: Aadhaar data vault must be in India only.

DPDP Act uses negative-list: personal data can leave India unless Government restricts a specific destination or category. But DPDP Act also says stricter sectoral laws continue to apply, so RBI rule wins for payments.

2. Compliance Pillars for Banks

1. Legal Assessment: Does destination country have surveillance law that overrides contract?
2. Technical: Sovereign cloud - 100% Indian hosting, no cross-border traffic for critical data.
3. Contractual: SCCs + Transfer Impact Assessment.
4. Operational: Data fiduciary obligations under DPDP - consent, purpose limitation, security safeguards, breach notification.

India enforces via IT Act 2000, DPDP Act 2023, RBI localization for payments, CERT-In directives. Non-compliance risks fines up to 4% global turnover under DPDP, plus RBI license action.

3. Landmark Case Laws - Where Sovereignty Was Litigated

A) India - WhatsApp Pay vs RBI - Data Localisation Case (2018-2023) - CASC vs Union of India

Most important Indian sovereignty case.

RBI Circular 6 April 2018: All payment system operators shall ensure entire data relating to payment systems operated by them are stored in system only in India. Deadline 15 Oct 2018.

Centre for Accountability and Systemic Change filed writ in SC. Petition: one million citizens cannot be reduced to guinea pigs as their sensitive personal data including financial data cannot be stored outside India in contravention to RBI circular.

RBI informed Supreme Court that WhatsApp is storing payment data elements such as transaction ID, expiry of collect request, and retrieval reference number, outside India beyond permitted timelines.

Outcomes:

• SC in Rajeswari vs Union of India, 2023 INSC 968 (30 Oct 2023) dismissed plea on re-cycled numbers but flagged data privacy concerns.
• Feb 2023 Constitution Bench (5 judges) - WhatsApp Privacy Policy: SC directed WhatsApp to inform Indian users at large that they needn't accept 2021 privacy policy to use it. Functionality would remain unaffected till Data Protection Bill comes. Court warned: court would not allow sharing of even single piece of user data and company was free to leave India if it did not follow Indian laws.
• Current status: WhatsApp Pay trials stayed unless compliance report filed by RBI by Nov 29.

Principle: Payment data sovereignty is non-negotiable - even copy abroad is violation beyond 24 hours.

B) EU - Schrems I (C-362/14, 2015) and Schrems II (C-311/18, 16 July 2020) - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems

Schrems requested Irish DPA to investigate data transfers from Facebook EU to US servers based on concerns about NSA surveillance.

Judgment: Court of Justice of EU ruled that US law failed to guarantee adequate protection for EU personal data, and annulled Safe Harbor (2015) and Privacy Shield (2020) decisions. US surveillance law did not give protection essentially equivalent to EU law. It kept Standard Contractual Clauses valid, but required exporter to check that destination's law lets importer honour them.

For banks: Client financial information qualifies as both personal data and financial data. Compliance tightrope for banks transferring data abroad - cannot rest on private contractual arrangements alone. Even if data stored in EU, US CLOUD Act allows US agencies to access data held by US providers.

This is now template for India DPDP Rules - India will also assess foreign surveillance law.

C) Switzerland - Swiss Banks vs US DOJ - Federal Supreme Court 2015 - Article 8 FADP

In 2015 Swiss Federal Supreme Court issued noteworthy decision on right of access in connection with tax dispute between certain Swiss banks and US. Based on right of access set forth in Article 8 FADP, court obliged Swiss bank to provide its employees with copies of all documents transferred to US Department of Justice in April 2012 containing their personal data.

Shows clash: Swiss sovereignty says employee data cannot be sent to US without consent, but bank sent under US pressure. Court sided with data subject.

D) India - RBI vs Jayantilal N. Mistry (2015) 3 SCC 525

Supreme Court ruled RBI and banks could not hide behind trust and confidentiality to refuse sharing inspection reports and defaulters data under RTI. Transparency for public interest given primacy over blanket secrecy. Foundation for sovereignty: Regulator must have access to data inside India, not locked in foreign cloud.

E) US CLOUD Act vs EU GDPR - Global Banks Grapple Case

Under Clarifying Lawful Overseas Use of Data Act, US courts may still demand data stored in China, forcing banks to balance foreign disclosure requests against domestic export bans. EU's GDPR adds layer - Schrems II ruling struck down Privacy Shield. Banks with US parent storing Indian payment data in US violate RBI sovereignty.

4. Checklist for Data Sovereignty Compliance in Indian Bank

1. Inventory: Classify data - Payment data = hard localisation only in India. Cannot be stored abroad even encrypted.
2. Architecture: PDC + DR both in India, different seismic zones. Contract prohibits subcontractor storing abroad.
3. Access Control: No foreign admin access to payment data - even support from US team must be via Indian jump host.
4. Legal: DPIA + Transfer Impact Assessment for any non-payment personal data going abroad - blacklist check under Sec 16 DPDP.
5. Breach: Dual reporting - FDPIC equivalent in India is Data Protection Board + RBI + CERT-In within 6 hours.
   1. Audit: Quarterly proof that data deleted abroad within 24 hours if processed abroad.