Industry urges India to define sovereign cloud framework beyond data residency

⚡ Key Financial Takeaways

The framework should define sovereignty across the entire technology stack, not just data location.

Different categories of government data must be treated separately, with stricter rules for defence, intelligence and law‑enforcement workloads.

RBI’s existing guidelines already cover data residency, operational control and control‑plane ownership for banking data.

Foreign cloud providers can remain in the market if they prove domestic operational control and legal safeguards.

The Ministry’s committee, formed in July, is working to clarify data categories and access rights.

💡 Why It Matters

Defining sovereignty across the entire cloud stack ensures that sensitive government data is protected from foreign legal claims and that control remains in domestic hands. Clear rules will also guide ministries in selecting providers and prevent regulatory duplication, thereby fostering a secure and efficient public‑sector cloud ecosystem.

What the government is proposing The Ministry of Electronics and Information Technology (MeitY) has set up a committee to draft a sovereign cloud framework for government data. The draft is expected to move beyond the traditional focus on data residency and instead address who owns the technology, who operates it and who can access sensitive information.

Industry voices on sovereignty

### Tata Communications Executive Vice‑President Vivek Srivastava said India still lacks a common definition of a sovereign cloud. “We look at the entire stack,” he explained. “A sovereign infrastructure must have no component controlled by a foreign‑jurisdiction entity.” Tata Communications already runs a government community cloud used by about 125 ministries.

### Innefu Labs Co‑founder Tarun Wig argued that national‑security workloads need an even stricter approach: “Those servers should sit entirely offline and entirely within government control.” He warned that data residency alone does not prevent foreign legal claims over data held by overseas‑headquartered providers.

### Aplyd Co‑founder Nakul Jain said sovereignty should be judged by data residency, local operational control, domestic encryption‑key ownership and protection against foreign legal reach. He urged the framework to align with sectoral regulators such as the RBI and SEBI to avoid duplicate compliance.

Why this matters A clear sovereign‑cloud definition will shape how ministries, defence and law‑enforcement agencies store and process data. It will also determine whether foreign cloud giants can continue to offer services to the public sector, and under what conditions. The framework could set a precedent for other countries looking to balance data sovereignty with global cloud adoption.

Context India’s Reserve Bank of India already requires that banking data be stored in India and that the control plane remain under domestic control. The sovereign‑cloud proposal seeks to extend similar principles to all government workloads, recognising that the stakes differ across data categories.

What to watch The committee’s final recommendations are expected later this year. Key developments to monitor include:

1. The exact definition of “sovereign” and how it applies to different data classes. 2. Whether the framework will mandate complete domestic control for defence and intelligence data. 3. The conditions under which foreign cloud providers can participate. 4. Alignment with existing sectoral regulations to avoid regulatory overlap.

These decisions will influence procurement policies for ministries and could reshape the competitive landscape for cloud services in India.

🏛️ Background & Context

India has long debated the balance between adopting global cloud services and protecting national data. The RBI’s guidelines for banking data set a precedent for data residency and control, but a comprehensive sovereign‑cloud framework is needed to cover all government workloads, especially those related to national security.

👁️ What To Watch Next

The MeitY committee’s forthcoming report, expected later this year, will outline the categories of data, access rights and the role of foreign providers. Observers should track how the framework aligns with RBI and SEBI rules and whether it imposes stricter controls on defence and intelligence workloads.