India’s PSA backs risk-based cross-border AI data flows, challenging data localisation while raising questions over sovereignty, privacy and Big Tech power.