Section 21-A – Data Classification and Localisation Requirements

(1) The Central Government shall establish a data classification and tiering system that defines storage, access, and transfer requirements based on data sensitivity and strategic importance. The system shall include the following tiers:

(i) Tier 1: Critical National Security Data

(a) Characteristics: Includes data with direct national security implications, sensitive government infrastructure data, critical defence information, and biometric/sensitive personal identification data.

(ii) Tier 2: Strategic Sectoral Data

(a) Strategic Sectors Designated:

(i) Healthcare

(ii) Financial Services

(iii) Critical Infrastructure, and

(iv) Emerging Technology Research

(iii) Tier 3: Commercial and Research Data

(a) Characteristics: Includes non-sensitive commercial data, academic and research collaboration data, and open-source AI training datasets.

(2) To promote responsible data management and adherence to localisation requirements among companies, the Central Government shall provide incentives aligned with the entity’s AI classification under Chapter II. Incentives include:

(i) Tax Benefits: Available for entities compliant with localisation protocols, with additional consideration given based on the AI system’s classification type under the commercial methods of classification in Section 6.

(ii) Expedited Cross-Border Approvals: Reserved for institutions with demonstrated responsible cross-border data management, particularly those operating high-risk AI systems or classified under AI-IaaS and AI-Com as per methods of classification in Section 5 due to their integration with sensitive digital infrastructure.

(iii) Recognition Certificates for Exemplary Management Practices: Granted to institutions that demonstrate best practices in data management, security, and AI governance, taking into account methods of classification in Sections 5 and 7.

(3) The framework shall be rolled out in phases over 24 months and include:

(i) Regular review and recalibration to adapt to emerging technological and policy challenges.

(ii) Stakeholder consultation mechanisms to incorporate feedback from industry, academia, and government entities.

(iii) Capacity building programs to support entities in implementing and maintaining compliance with these standards.