Data Protection and International Arbitration: From Normative Tension to Integrated Procedural Governance

Abstract

The digitalisation of exchanges, the cross-border circulation of information, and the increasing reliance on technological tools in the conduct of proceedings have profoundly reshaped international arbitration. In this context, the protection of personal data can no longer be regarded as a peripheral compliance concern; it now affects the very conditions under which arbitral proceedings are organised, secured, and perceived as legitimate. This article offers a doctrinal analysis of the principal tensions between the requirements of the General Data Protection Regulation (GDPR) and the features traditionally associated with arbitration, particularly confidentiality, procedural flexibility, and the transnational nature of information flows.

The article argues that the relationship between international arbitration and data protection law should not be understood as an irreconcilable conflict, but rather as a normative tension capable of being managed through a more structured model of procedural governance. Drawing on the applicable European legal framework, the case law of the Court of Justice of the European Union, and institutional instruments developed for arbitral practice, the study examines the qualification of relevant data-processing actors, the legal bases available for processing, transparency obligations, as well as international transfers and data security requirements.

The study highlights the emergence of a hybrid model of normative accommodation, grounded in risk anticipation, the clarification of responsibilities, the contractual integration of compliance obligations, and the adoption of appropriate technical safeguards. It concludes by formulating practical recommendations for arbitral institutions, arbitrators, and practitioners aimed at strengthening compliance without undermining the effectiveness, coherence, or legitimacy of international arbitration.