This paper examines the nature and evolution of data localisation measures and their impact on business activity. It highlights that data localisation measures are growing and increasingly restrictive. By early 2023, 100 such measures were in place across 40 countries, with more than two-thirds combining local storage requirements with flow prohibition, the most restrictive form of data localisation. Insights gained from businesses operating in the e-payments, cloud computing, and air travel sectors suggest that data localisation can have unintended consequences. It not only increases operating costs, with implications for downstream users, but can also lead to increased vulnerabilities to fraud and cybersecurity risks, and reduced resilience to unexpected shocks. While international regulatory efforts have largely taken place through regional trade agreements (RTAs), this paper calls for continued monitoring of the regulatory environment with a view to informing efforts to agree on global rules that take into account legitimate public policy objectives while avoiding excessive fragmentation, especially through discussion at the WTO under the Joint Initiative on e-commerce.
