The Quiet Fight Over Cross-Border Data Flows Shaping Digital Trade

What happened?

Rules governing whether and how data can move across national borders have become one of the most contested issues in international trade policy through 2026, as governments balance competing priorities of digital trade facilitation, data privacy protection and national security. Trade negotiators from major economic blocs have spent much of the year working through disagreements over data localisation requirements, rules that mandate certain categories of data be stored or processed within a country's borders, which businesses argue raise costs and fragment digital services.

The issue has moved beyond a narrow technical trade matter to become a genuine point of friction in broader economic diplomacy, with some countries expanding data localisation requirements for reasons including data privacy protection, national security concerns and a desire to build domestic digital infrastructure industries, while others push for stronger commitments to free cross-border data flows as a condition of deeper trade cooperation.

Key points

• Data localisation requirements, mandating certain data be stored within national borders, have expanded in several jurisdictions.
• Trade negotiators are increasingly treating data flow rules as a core component of digital trade agreements rather than an afterthought.
• Businesses operating internationally report rising compliance costs from navigating inconsistent data storage and transfer rules across markets.
• Governments cite privacy protection, national security and domestic industry development as justifications for restricting cross-border data flows.
• Small and medium-sized digital businesses face disproportionate compliance burdens compared with large multinational technology companies.

What we know

International trade and economic bodies tracking digital trade policy report that a growing number of countries have introduced or expanded data localisation requirements over the past several years, applying particularly to categories of data considered sensitive, such as financial records, health information and government-related data. These requirements vary considerably in scope and strictness, ranging from rules requiring a local copy of data be retained for regulatory access, to stricter requirements that prohibit certain data from leaving the country at all.

Trade agreements negotiated in recent years have increasingly included dedicated digital trade chapters addressing cross-border data flows, though the strength and enforceability of these provisions vary significantly between agreements. Some agreements include binding commitments to allow free data flows subject to limited exceptions, while others rely on more general, non-binding principles that leave considerably more room for individual countries to maintain or introduce restrictions.

Officials and experts

Trade officials involved in digital economy negotiations describe cross-border data flow rules as one of the more technically and politically complex areas of modern trade policy, noting that unlike traditional trade in physical goods, data flow restrictions often stem from legitimate domestic policy objectives around privacy and security rather than purely protectionist intent, making them harder to negotiate away through conventional trade liberalisation approaches. This has required negotiators to develop more nuanced frameworks that attempt to accommodate legitimate regulatory diversity while still facilitating digital trade.

Business groups representing digital and technology-dependent industries have argued that inconsistent and expanding data localisation requirements create real and rising costs, forcing companies to maintain duplicate infrastructure across multiple jurisdictions rather than operating efficient, centralised systems, costs that are often passed on to consumers or that particularly burden smaller companies lacking the resources of large multinational competitors to manage fragmented compliance requirements. Privacy advocates, meanwhile, have argued that some data localisation and cross-border transfer restrictions serve legitimate and important purposes in protecting citizens' personal data from being processed in jurisdictions with weaker privacy protections.

Background

The rapid growth of digital trade, e-commerce and cloud-based services over the past two decades has made cross-border data flows an increasingly central feature of the global economy, with data now moving across borders as part of ordinary business operations ranging from customer service to supply chain management to financial transactions. This growth initially proceeded with relatively limited specific regulation of cross-border data movement in most jurisdictions, treating data largely as an incidental feature of broader digital services trade.

Growing public and government attention to data privacy, catalysed in part by high-profile data breaches and concerns about how personal data is used and shared, alongside rising geopolitical tensions that have heightened national security sensitivities around data access, has led a growing number of countries to introduce more specific rules governing where and how data can be stored and transferred. This shift has occurred alongside, and sometimes in tension with, parallel efforts to negotiate international trade agreements aimed at facilitating rather than restricting cross-border digital commerce.

Detailed analysis

The tension at the heart of cross-border data flow policy reflects a genuine and difficult trade-off between competing legitimate objectives. Free cross-border data flows can support economic efficiency, enabling businesses to operate global digital services, benefit from economies of scale in data processing, and allow smaller companies in developing economies to access international markets and cloud infrastructure without needing to build costly local data centres. At the same time, unrestricted cross-border data flows can raise legitimate concerns about whether personal data receives adequate protection once it leaves a country's jurisdiction, and about whether foreign governments might gain access to sensitive data through legal or extralegal means once it resides on infrastructure located abroad.

This trade-off plays out differently depending on the type of data and the specific national context. Financial regulators in many countries have pushed for local data retention requirements specifically to ensure they retain the ability to access transaction records for supervisory purposes without depending on cooperation from foreign counterparts, a concern rooted in practical regulatory enforcement rather than broader protectionism. Health data localisation requirements often stem from a mix of privacy protection concerns and public health data sovereignty considerations, particularly following experiences during recent global health emergencies that highlighted the strategic importance of health-related data infrastructure.

The compliance burden created by inconsistent rules across jurisdictions falls disproportionately on smaller businesses, since large multinational technology and financial companies typically already operate data infrastructure across multiple regions and have dedicated legal and compliance teams to navigate varying requirements, while smaller companies attempting to expand internationally often lack the resources to build or lease compliant infrastructure in every market where localisation rules apply. This dynamic has led some trade economists to argue that, paradoxically, data localisation requirements intended in part to promote domestic digital industries can end up entrenching the market position of the largest incumbent technology companies, which are best equipped to absorb the associated compliance costs.

International efforts to establish more harmonised approaches to cross-border data governance have made incremental progress, including frameworks that allow certified companies to transfer data between participating countries under agreed privacy safeguards, and mutual recognition arrangements between jurisdictions with broadly compatible privacy regimes. However, these arrangements generally cover a limited subset of countries and data categories, leaving considerable fragmentation in the broader global data governance landscape that businesses operating across many markets must still navigate individually.

Developing economies face a distinct dimension of this debate, often weighing the economic benefits of participating in global digital trade and cloud infrastructure against a desire to build domestic data processing capacity and reduce dependence on infrastructure controlled by foreign, typically large, technology companies. Some have pursued deliberate strategies to encourage domestic data centre investment as part of broader digital economic development goals, even at the cost of somewhat higher near-term compliance costs for businesses, reflecting a longer-term industrial policy calculation rather than a purely regulatory one.

Why it matters

The rules governing cross-border data flows increasingly shape the practical cost and feasibility of operating a digital business internationally, affecting everything from e-commerce platforms to cloud service providers to companies offering AI-powered services that depend on processing data collected across multiple markets. How this policy landscape evolves will have real consequences for the pace and shape of global digital trade growth in the years ahead.

For consumers, cross-border data flow rules intersect directly with questions of privacy protection, since where and how personal data is stored and processed affects what legal protections apply to it. For policymakers, finding an approach that facilitates the genuine economic benefits of digital trade while addressing legitimate privacy and security concerns remains an unresolved and evolving challenge, with different countries continuing to strike quite different balances.

What happens next?

Expect continued negotiation over digital trade chapters in bilateral and regional trade agreements, with cross-border data flow provisions remaining a central and often contentious component. Some further expansion of data localisation requirements is likely in sectors deemed sensitive, such as finance, health and government services, even as broader digital trade liberalisation efforts continue in parallel for less sensitive categories of data.

Businesses operating internationally will likely continue to face a fragmented and evolving compliance landscape for the foreseeable future, making investment in flexible, adaptable data infrastructure and compliance capabilities an increasingly important competitive consideration for companies seeking to operate across multiple digital markets simultaneously.