Data sovereignty is now a part of national security. Discuss India's efforts to build a domestic cloud ecosystem in this context.

Data sovereignty is a nation's control over where its sensitive data is stored and processed, and which country's law governs it. Governance, defence and AI now run on the cloud. Data that sits abroad, or with firms answerable to foreign laws, has therefore become a strategic risk. India has responded with a layered domestic cloud ecosystem [1].

Why data sovereignty is a security issue

• Legal reach: a foreign-owned provider may have to obey its home country's laws, even when the data is stored in India.
• Strategic datasets: citizen records, policing data and language data such as BHASHINI's train AI models. If this data leaks or is accessed abroad, it can be used for surveillance or manipulation [1].
• Supply-chain risk: dependence on foreign infrastructure is a weakness during sanctions or conflict.
• Constitutional duty: Puttaswamy (2017) placed privacy under Article 21, so the State must secure citizens' data.

India's efforts

• Government cloud: MeitY launched MeghRaj (GI Cloud) in 2014. Today, 2,330 departments use MeghRaj 2.0, and NIC runs 4 National and 24 Mini Data Centres [1].
• Trusted providers: MeitY has empanelled 30 cloud service providers after STQC audits against ISO 27001, 27017, 27018 and 20000 [1][2].
• Graded localisation: the Cloud Selection Framework (March 2026) classifies data by sensitivity. Sensitive data goes to NIC and State Data Centres, and less critical work can use a hybrid setup [1].
• Legal backbone: the DPDP Act, 2023 requires consent and makes data fiduciaries accountable. It allows data to go abroad except to countries the Centre notifies [3].
• Sovereign AI compute: the IndiaAI Mission (₹10,371.92 crore) has 45,000+ GPUs [1]. A secure national cluster of 3,000 GPUs is planned for strategic uses [4]. BHASHINI has moved to an Indian cloud run by Yotta [1].
• Capacity and skills: data centre capacity is 1.57 GW, projected at about 8 GW by 2030. Skilling runs through FutureSkills PRIME and NIELIT [1].

Persisting gaps

• Storing data in India is not the same as controlling it: the Budget 2026–27 tax holiday for foreign cloud firms using Indian data centres brings in investment, but also brings foreign legal reach [5].
• Hardware dependence: the most advanced chips are still imported.
• Uneven capacity: State Data Centres differ widely, and data centres put pressure on power and water.

India's approach combines government-owned infrastructure, audited private providers and graded localisation. The next steps are to state clearly which data foreign providers may host, to link the cloud effort with the Semiconductor Mission, and to grow data centres on green power. Together these can turn data sovereignty from a slogan into real strategic autonomy and Atmanirbhar digital security.