From Pakistan to Zambia, governments around the world are increasingly proposing and passing data
localization legislation. These laws, which refer to the rules governing the storage and transfer of
electronic data across jurisdictions, are often justified as addressing concerns such as user privacy,
cybersecurity, national security, and monopolistic market practices. Notwithstanding these laudable goals, data localization initiatives cause more harm than good, especially in legal environments with poor rule of law.
Data localization requirements can take many different forms. A government may require all companies
collecting and processing certain types of data about local users to store the data on servers located in the
country. Authorities may also restrict the foreign transfer of certain types of data or allow it only under
narrow circumstances, such as after obtaining the explicit consent of users, receiving a license or permit
from a public authority, or conducting a privacy assessment of the country to which the data will be
transferred.
While data localization can have significant economic and security implications, the focus of this piece –
inline with that of the Global Network Initiative and Freedom House – is on its potential human rights
impacts, which are varied. Freedom House’s research shows that the rise in data localization policies worldwide is contributing to the global decline of internet freedom. Without robust transparency and accountability frameworks embedded into these provisions, digital rights are often put on the line. As these types of legislation continue to pop up globally, the need for rights-respecting solutions and norms for cross-border data flows is greater than ever.
As more and more governments turn to data localization, these laws’ negative impact on digital rights are becoming increasingly clear. The multistakeholder community must come together to devise rights-respecting solutions in response.
In some cases, those in power may abuse such provisions to facilitate access to individuals’ personal data
and use the information to facilitate surveillance and carry out arrests, harassment, or even physical
violence. In Pakistan, for instance, where surveillance of political leaders, activists, and journalists is
rampant, the proposed Personal Data Protection Bill (PDPB) 2023 imposes some of the world’s most stringent data localization requirements, including a mandate that all personal data be stored locally within the country’s borders and that all entities that maintain and collect such data must register with the National Commission for Personal Data Protection. Digital rights activists have raised concerns that the bill’s data-localization requirements would allow the government to access the personal data of users more easily in cases in which tech companies refuse to share the information.
Data localization provisions have also been wielded to censor expression protected under international
human rights standards. In Vietnam, the government has leveraged data localization provisions under its Cybersecurity Law to compel social media platforms to remove “illegal” speech, which often includes criticism of those in power.
The growing trend of forcing companies to store data within national borders is a dangerous one,
especially for countries that lack the infrastructure and safeguards to protect sensitive information. When data is locked within less secure borders, it’s more vulnerable to breaches and misuse. This could lead to a surge in data leaks and privacy violations, leaving individuals with little recourse. Data localization can more broadly undermine the functioning of a global and interoperable internet, on which human rights rely.
This trend is also playing out at the multilateral level. In 2023, the former U.S. Trade Representative
changed the US’s position on cross-border data flows at the World Trade Organization amid negotiations
for the Joint Statement Initiative on E-Commerce, a surprising reversal of long-standing US policy to
support the free flow of data across jurisdictions to facilitate digital trade. Freedom House and other civil
society groups have raised alarm that the move legitimizes data localization.
Additionally, provisions in the UN Convention on Cybercrime – adopted in December 2024 at the General Assembly – could be interpreted as allowing authorities to compel individuals, even those working for foreign companies, to provide access to sensitive information without the knowledge of their employers or governments of the jurisdictions in which they are headquartered. Increased international cooperation on cross-border data sharing could also strengthen authoritarians’ ability to track people living in exile, potentially supercharging transnational repression, when governments reach across borders to silence dissent among exile and diaspora communities. For these reasons, organizations like GNI have been calling for a balance between combating cybercrime and protecting fundamental rights like privacy and freedom of expression. While international cooperation is essential, it must be carried out with appropriate safeguards to prevent abuse.
With the growing presence of data localization laws comes the growing need for rights-respecting
solutions that safeguard privacy, freedom of expression, and access to information while encouraging
innovation and cybersecurity. Multistakeholder collaboration is a crucial component in all of this.
Governments, civil society, the technical community, members of academia, and the private sector must
come together to create rights-respecting data protection frameworks and push back against existing
harmful ones. GNI, with its global multistakeholder composition, and Freedom House, with its deep
research and policy knowledge on the topic, are uniquely prepared to facilitate dialogues and knowledge-
sharing around data localization and its impact on human rights. As the global policy landscape continues to evolve, there is an urgent need for coordinated action to ensure that data protection laws uphold human rights and foster a secure, global, and open internet.