From the Washington Post:
The [Brazilian] government is now introducing changes in the project that are quite problematic. One of them mandates that companies that store any type of Brazilian data have their servers physically located in Brazil. The idea of the government is that having the servers here will make them available for the Brazilian courts. But this is a bad idea because it will create huge costs for companies.
Imagine if Brazil required every company that has Brazilian data in storage to have a server located physically here. That breaks the Internet because you remove from companies the ability to make these decisions based on efficiency. When you’re deciding where to have your servers, you’re doing it in a way that’s cost-effective. Imagine if other countries reciprocate, if [every country says] you have a Brazilian Internet company, they have to have servers in my country. The potential for balkanization is very high.
Is this allowed under WTO rules? Data storage sounds like a GATS issue, so perhaps it depends in part on what commitments have been made. If it violates the GATS, could it be justified under GATS Article XIV(c)(ii) as necessary for "the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts"?