Examine how MeghRaj and the Cloud Selection Framework can make e-governance in India more efficient and more secure. What challenges remain?

MeitY launched MeghRaj (GI Cloud) in 2014. It gives departments IaaS, PaaS and SaaS on shared, distributed infrastructure [1]. In March 2026 MeitY added the Cloud Selection Framework, which decides where data goes based on how sensitive it is [1]. Together they move e-governance from each department owning its servers to a graded, sovereign cloud.

Efficiency gains

• Pay-as-you-use turns capital spending into operating spending. It also cuts deployment time and gives scalability, backup and service continuity [1].
• Scale: 2,330 departments use MeghRaj 2.0, and 30 cloud service providers (CSPs) are empanelled (Sep 2026) [1].
• Standardised procurement: CSPs list Public, Virtual Private and Government Community Cloud offerings on GeM [2]. Empanelment through the AMBUD portal runs 24x7x365 [3], so departments no longer have to appraise each vendor separately.

Security gains

• Audited trust: CSPs are empanelled only after an STQC audit against ISO 27001, 27017, 27018 and 20000 [4].
• Data classification: sensitive work goes to NIC data centres (4 national, 24 mini) and State Data Centres. Less critical work can use a hybrid setup with empanelled CSPs [1].
• Sovereignty in practice: BHASHINI moved to Yotta's Indian cloud, so its language datasets and AI models stay in India [1]. The DPDP Act, 2023 adds consent duties and conditions on cross-border transfer [1].

Challenges that remain

• Residency is not control: a foreign CSP running a data centre in India still answers to its home country's laws. The Budget 2026–27 tax holiday for foreign providers using Indian data centres widens this exposure [5].
• Uneven State Data Centres: capacity differs by state, so the most sensitive data may land on the weakest infrastructure.
• Adoption counts hide depth: "2,330 departments" does not show what share of their work has moved or whether costs fell.
• Vendor lock-in to a few large CSPs.
• Resource strain: capacity is 1.57 GW and heading to about 8 GW by 2030 [1]. BIS has PUE/WUE standards, but data centres do not have to report against them [6].

MeghRaj builds the platform and the Framework sets the rules for using it, so both efficiency and security have improved. Next steps:

• publish how much work has actually migrated and what it saved;
• state clearly what foreign CSPs may host;
• upgrade State Data Centres;
• make PUE/WUE reporting a condition for incentives.

This would deliver Digital India's promise of citizen-centric governance while protecting informational privacy under Article 21 (Puttaswamy, 2017).