We value your privacy & take necessary steps to protect your information.
REQUEST A CALLBACK
International arbitration is now the preferred mechanism for cross-jurisdictional disputes, driven by its flexibility and adaptability. Simultaneously, digitalisation through virtual hearings, e-filing and cloud repositories has transformed arbitration into a data-intensive process, elevating data protection from a compliance obligation to a procedural cornerstone. Contrasting jurisdictional responses now shape the global arbitral landscape. Divergent regimes such as European Union’s General Data Protection Regulation, 2016 (‘EU’s GDPR’) Singapore’s Personal Data Protection Act, 2012 (‘PDPA’) and India’s Digital Personal Data Protection Act, 2023 (‘DPDP’) directly impact data disclosures, cross‑border transfers, institutional liability and procedural finality. Within this mix, India’s evolving stance highlights the interplay between technological innovation and data privacy in modern arbitration.
From Rights to Pragmatism: Comparing the GDPR and Singapore Framework
Enforced in 2018, the EU’s rights‑centric GDPR model remains the most comprehensive data protection framework, imposing stringent obligations on the collection and cross-border transfer of personal data. Its extraterritorial reach and expansive definition of data processing significantly affects international arbitration, placing obligations on parties, arbitrators, counsels and institutions as data controllers. Data transfer to third countries necessitates equivalent protections such as adequacy decisions, standard contractual clauses or limited derogations for legal claims. Thus, GDPR compliance has transformed data protection from an afterthought to a procedural question that must be addressed from the outset of cross-border arbitration.
Where the GDPR proceeds from a rights-centric premise, Singapore adopts a more pragmatic approach balancing privacy against procedural efficiency. Singapore’s International Arbitration Act, 1994 governs cross-border disputes and the Arbitration Act, 2001 covers domestic disputes. Neither statute expressly mandates confidentiality; that obligation arises instead as an implied term at common law. Both Acts nonetheless provide for related court proceedings to be heard in private and empower tribunals to adopt protective measures for safeguarding sensitive information, reinforced by comprehensive institutional rules.
The Singapore International Arbitration Centre (‘SIAC’) Rules, 2025 integrate confidentiality and data protection seamlessly into arbitration. Rule 39 protects hearings, documents and awards, while Rule 61 requires Tribunals to address data protection issues at the outset of proceedings. Rule 60 further permits publication of awards only with written consent of parties and appropriate redactions.
Singapore’s PDPA imposes key obligations relating to data accuracy, protection and secure storage, breach notification and restricted cross-border transfer, all anchored in the consent requirement under Section 13. The First Schedule, however, permits collection, use and disclosure without consent where necessary for legal proceedings, arbitration or enforcement of legal rights. These exemptions reduce the risk that data protection obligations will be invoked tactically to resist document production or delay arbitral proceedings.
The Indian Landscape: Arbitral Confidentiality in the DPDP Era
India’s arbitration ecosystem stands at a digital crossroads, embracing Online Dispute Resolution (‘ODR’) and AI-driven analytics to unlock efficiency and global accessibility. Yet this transition from traditional roots to full digitization confronts acute challenges around confidentiality, data governance and regulatory alignment.
Prior to statutory reform, confidentiality in Indian arbitration relied largely on party agreements and judicial interpretation. Recognising this gap, the 2019 Amendment enacted Section 42A into the Arbitration and Conciliation Act, 1996 (‘Arbitration Act’), imposing a statutory duty of confidentiality of arbitral proceedings, barring disclosures essential to enforcement of award. The provision is conspicuously narrow- it does not bind counsels, experts, witnesses or tribunal secretaries, and admits no exception for court proceedings under Sections 34 and 37 of Arbitration Act, for legal advice, or for regulatory disclosure.
In this evolving landscape, the DPDP Act, establishes the cornerstone framework for data governance. Arbitral Institutions, Arbitrators & Counsels may qualify as Data Fiduciaries, independently determining the purpose and manner of personal data processing across proceedings, thereby elevating data accountability from contractual undertaking to stringent statutory obligation.
To preserve the efficacy of adjudicatory processes, Section 17 of the DPDP Act carves out specific exemptions for judicial and quasi-judicial functions. Section 17(1)(a) permits data processing necessary for enforcing legal rights or claims while Section 17(1)(b) exempts courts, tribunals and quasi-judicial bodies in India of notice and consent requirement when processing data in exercise of judicial function. . These provisions prevent parties from invoking data protection as a tactical shield against Tribunal‑ordered disclosure or evidence production.
These exemptions do not confer blanket immunity. Although notice and consent requirements are waived, Section 17(1) preserves the mandate under Section 8(1) and Section 8(5) for reasonable security safeguards to prevent personal data breaches. Tribunals and parties remain responsible for data accuracy, protection against unauthorised access and post‑arbitration anonymization. Section 17(1)(d) of the DPDP Act 2023 exempts the processing of personal data of Data Principals outside India, carried out by a person based in India pursuant to a contract with a person outside India. Drafted with the outsourcing sector in mind, the clause has incidental value for an India-seated arbitral institution administering a dispute between wholly foreign parties, disapplying the Chapter III rights and the cross-border transfer restriction in Section 16. Its utility is limited, however, by the requirement that no Data Principal be within India - a condition that will not apply in most disputes with an Indian nexus.
Privacy Rights & Procedural Integrity
Government of India established India International Arbitration Centre (‘IIAC’) as a statutory arbitration institution under the IIAC Act, 2019. Regulation 39 of the IIAC Regulations, 2023 reinforce a rigorous mandate for confidentiality regime, requiring parties, Arbitral Tribunal, Emergency Arbitrator and the Centre to treat information relating to the proceedings as confidential, subject to limited exceptions including disclosures necessary for enforcing or challenging an Award, complying with court orders or binding legal provisions, pursuing a legal right or claim, or satisfying the requirements of regulatory authorities.
These exceptions run broadly parallel to the exemptions in Section 17 of the DPDP Act with the result that a disclosure permitted under the confidentiality regime will not ordinarily be obstructed by the data protection regime. Section 17(1)(a) exempts personal data processed for enforcing any legal right or claim, and Section 17(1)(b) exempts a body in India entrusted by law with a judicial, quasi-judicial, regulatory or supervisory function where processing is necessary to perform it. The IIAC's statutory origin makes it a strong candidate in Indian arbitration for clause (b), though its own functions under the Act are administrative rather than adjudicatory. It bears emphasis that Section 17 is permissive: it lifts the notice, consent and data principal rights that would otherwise attach, but imposes no positive duty of retention or production. These dual exemptive regimes provide a consistent legal pathway: they collectively ensure that the right to data privacy yields to the necessity of maintaining a confidential arbitral record. Consequently, this statutory convergence preserves the integrity of the arbitral process while upholding the finality and enforceability of awards in the Indian legal landscape.
Although Regulation 39 and Section 17 emphasise the preservation and processing of records for legal enforcement and quasi-judicial purposes, Courts in India have acknowledged that, in exceptional cases, privacy and reputational concerns may warrant restriction of public access to certain information. In Jorawar Singh Mundy v. UOI [2021 SCC OnLine Del 2306], Delhi High Court citing a Constitution Bench decision rendered by Supreme Court of India in K.S. Puttaswamy v. UOI [2017 10 SCC 1], held that the online availability of a judgment whereby Petitioner was ultimately acquitted of the charges levelled against him in the case, may cause irreparable prejudice and affect his professional and social life. Accordingly, the Court directed Indian Kanoon to block access to the said judgment by use of search engines such as Google/Yahoo etc. as an interim measure. The Court underscored a shift towards informational privacy that directly challenges traditional transparency and record-keeping norms in the legal landscape. For arbitration, the implications are specific rather than general, since awards are not public by default. The exposure arises where awards are published under institutional rules or where the award enters the public domain through challenge proceedings under Sections 34 and 37 of Arbitration Act- a route which Section 42A of Arbitration Act does not address.
Conclusion
The three regimes examined in this Article converge on a common recognition that arbitral confidentiality and personal data protection must be reconciled rather than traded off, but they arrive at markedly different settlements. The GDPR subjects arbitral data flows to a full compliance architecture and accommodates proceedings through defined lawful bases and derogations. Singapore layers a consent-based statute over detailed institutional rules, exempting proceedings from consent while preserving the accuracy, security and breach notification obligations that give the framework its substance. India, by contrast, exempts and retains almost nothing: Section 17(1) lifts consent and notice but also accuracy, breach notification, erasure and the cross-border transfer restriction, leaving only responsibility for data fiduciaries/data processors and reasonable security safeguards. The consequence is that the Indian position depends less on statute than the other two. Section 42A binds only the arbitrator, the institution and the parties, and does not address the disclosure that occurs when an award is challenged under Sections 34 and 37. Retention and post-award data handling fall outside the exempted regime altogether. What fills these gaps is institutional rules- Regulation 39 of the IIAC Regulations and party agreement, neither of which binds third parties or an un-cooperative counterparty in the way a statutory duty would. Much of the DPDP regime has only recently become operative through phased commencement of the Rules, so its practical demands on arbitral institutions remain untested. Whether an arbitral tribunal would fall within Section 17(1)(b) is unsettled.
As international arbitration increasingly becomes data-driven through virtual hearings and cloud-based repositories, India has the statutory scaffolding in place to steadily move towards a framework that aligns confidentiality, data governance and procedural accountability with global standards and maintain a calibrated balance between data protection, procedural integrity, enforcement efficacy and informational privacy. The continued evolution of this framework will depend not merely upon legislative intent, but upon consistent implementation, institutional autonomy and judicial reasoning. The gaps are ones which institutional practice can fill. With proportionate safeguards and sustained institutional confidence, India can strengthen its standing as a credible, secure and globally competitive arbitral seat in the digital era.