The India-UK Comprehensive Economic and Trade Agreement (CETA), which entered into force on July 15, cuts tariffs, expands market access for services and eases mobility for Indian professionals. Yet its digital trade chapter is comparatively modest in scope.
Around the same time, the Association of Southeast Asian Nations (ASEAN) concluded negotiations for its Digital Economy Framework Agreement (DEFA), a regional accord that goes much further in setting rules for the digital economy. The comparison is imperfect. ASEAN is an integrated regional market, whereas the India-UK agreement spans two distinct regulatory systems. Even so, DEFA may offer a useful reference point for India’s future digital trade agreements.
What India and the UK agreed
Chapter 12 of CETA establishes the basic foundations of digital trade, including paperless trading, legal recognition of electronic contracts and protection against mandatory disclosure of software source code. What it does not do is address the issues that increasingly define digital trade. It contains no binding commitments on cross-border data flows, no prohibition on data localisation requirements and no arrangement preventing tariffs on digitally-delivered products such as software downloads or streaming services. This cautious approach reflects not only India’s long-standing preference for policy flexibility over data governance, but also its desire to preserve industrial-policy flexibility as more goods and services become digitally deliverable.
India’s broader legal framework is more open than is often assumed. The Digital Personal Data Protection (DPDP) Act, 2023 adopts a ‘blacklist’ approach: personal data can be transferred to any country unless the government specifically restricts that destination. As of 2026, no such restrictions have been notified, making cross-border transfers broadly permissible under Indian law.
The UK’s legal framework also limits what could realistically have been agreed. Under the British data protection law, unrestricted transfers require either an adequacy decision—a status India has not received yet—or alternative legal safeguards. The absence of stronger commitments, therefore, reflects constraints on both sides rather than India’s reluctance alone.
Even so, the pact leaves room for future progress. Its ‘forward review’ mechanism offers a path for the UK to benefit from any stronger commitments on cross-border data flows or data localisation that India grants to future trading partners.
What ASEAN negotiated
DEFA goes much further. With negotiations concluding in May and the agreement to be signed later this year, it covers much of the ground addressed by CETA while adding rules on trusted cross-border data flows and non-discriminatory treatment of digital products—two topics that remain largely absent in CETA.
Some of this ambition reflects the negotiating context. ASEAN members were building on decades of regional integration and increasingly aligned regulatory frameworks. Yet what distinguishes DEFA is that it demonstrates governments can retain discretion over sensitive areas such as data protection while still committing to common rules that support digital commerce.
India’s concerns over cross-border data flows are legitimate. Financial supervision, cybersecurity and the governance of citizens’ data have become priorities for governments around the world. At the same time, India’s own legal framework already provides greater flexibility than its reputation for data localisation often suggests.
ASEAN’s model contractual clauses and data management framework illustrate a pragmatic middle ground. The former establishes contractual safeguards for cross-border transfers, while the latter helps firms classify data and apply proportionate protections. Together with DEFA’s planned provisions on data protection and cross-border transfers, they demonstrate how countries can deepen digital integration while retaining regulatory autonomy. India could encourage similar mechanisms for routine commercial transfers while maintaining localisation requirements for particularly sensitive sectors.
For now, CETA leaves cross-border data transfers and localisation to domestic law, creating additional compliance costs for Indian software services and fintech firms and greater regulatory uncertainty for investors in AI and Cloud infrastructure.
India also brings considerable strengths to these discussions. Its digital public infrastructure strategy has already exported governance models like UPI and digital identity systems to several countries—credibility India can use not just to respond to emerging digital trade rules, but to help shape them.
The India-UK digital chapter does not require immediate renegotiation. Its review mechanism, the DPDP Act’s default openness and the possibility of a future UK adequacy decision provide pathways for deeper cooperation. Even in its current form, CETA engages more extensively with digital economy issues than India’s recent agreements with Australia and the EU. Although both contain selected digital provisions, neither has a comparable standalone digital trade chapter.
DEFA nations’ collaboration, despite differing levels of resistance to digital trade, shows that India could build trust and interoperability without immediately displacing domestic law or sector-specific restrictions.
As digital trade becomes a ubiquitous part of international commerce, India’s future agreements will need to build on paperless trade and move towards establishing clearer rules for data, digital services and AI.
Ammu George | Lecturer, international business, Queen’s Business School, Belfast
Mukund Kishore | Researcher, Asia Competitiveness Institute, Lee Kuan Yew School of Public Policy, National University of Singapore
(Views are personal)
