Cross-border flows of non- personal data

The OECD experience

In June 2025, the OECD released a report on the classification of measures affecting cross-border flows of non-personal data (i.e. data that does not identify specific individuals -¹ hereinafter – NPD). From 2000 to 2024, the number of measures to regulate NPAs has increased five times, both incentivizing and restricting data flows. According to the OECD measures affecting data flows include not only measures regarding cross-border data transfers but also measures affecting the accessibility of data between countries (e.g. the ability to view and use data stored in one country by users in another country). OECD experts estimate that cross-border data sharing can increase GDP by up to 2.5%

Based on the analysis of 124 measures, OECD experts identify 3 categories of measures:

1) Measures that encourage crossborder access to NPD and data sharing (17% of measures). For example, open government data initiatives that are accessible to foreign users, among others, fall into this category. For example, the US Open Government Data Act of 2019 sets out requirements for the publication of open data by federal agencies, including the availability of data to an unlimited number of people, including foreigng users.

2) Measures requiring companies to provide cross-border access to their NPD to the government and other companies. For example, in the US, the Foreign Lawful Use of Data Act of 2018 (CLOUD Act) obliges US electronic communications service providers to provide US government agencies with access to information, including information stored outside the US. In this category, 84% of measures require data disclosure to government agencies and only 16% - disclosure to third parties.

3) Measures prohibiting cross-border access to and sharing of NPD such as restrictions on cross-border data transfers (obtaining the authority's approval for each data transfer, the security risk assessment of data transfers abroad by the authority, etc.) and data localization requirements, which limit the ability of companies to transfer data for the purpose of storing it on servers in third countries. In total, localization requirements account for 35% of all identified NPD regulatory measures worldwide.

The largest number of measures are adopted for manufacturing data (e.g., data from internet devices in a factory), business data (e.g., transportation of goods), and government data (e.g. budget management data). It is noteworthy that for government data, 50% of measures have restrictive effects for public access, and only 40% are open data initiatives, including for foreign users.

Russia’s experience

In Russia, most measures are aimed at regulating personal data.

There are few initiatives regarding nonpersonal data. For example, from 2012 Russia has been developing the concept of open government data, but the published data are little involved in the domestic digital economy. Russia does not have the principle of “open government data by default” (i.e., the principle “publish everything that is not prohibited for publication”). As a result, only those data that are required to be published by law are disclosed.

Public data are collected and published to different degrees: the government publishes detailed financial data (e.g. tax data) but does not collect data on quality of life. Data are opened without regard to user demand for specific data compositions.

From the monitoring issue No. 6 (18), June 2025. Download the full issue (PDF) · issue page at the Gaidar Institute