Taking control of data: India's quest for digital sovereignty and security

In a geopolitically charged tech landscape, digital sovereignty is crucial for India to safeguard its future-and that of its citizens

With 108 unicorns and a booming tech sector, digital adoption in India is accelerating fast, despite its vast and unique demographics, marked by stark contrasts. The transformative ability of the blockbuster ABCD technologies — or artificial intelligence (AI), blockchain, Cloud adoption, and data analytics — is undisputed, and they are increasingly seeping into our daily lives. We can no longer be complacent about AI’s impact on us, whether in retail and hospitals, agriculture or our defence systems. Yet one of the pressing challenges remains largely unresolved—data sovereignty. As technology continues to reshape the global economic order, India must realign its thinking and begin with the end in mind: Ensuring that its digital future is not dictated by external entities but built on a foundation of secure, sovereign, and self-reliant data governance.

 

In the wake of the new trade tariffs and tightened security in sensitive regions like Pahalgam, data security has become more than just a regulatory challenge — it is now a national security imperative. Cyberattacks targeting Indian infrastructure have surged. Between 2019 and 2023, cybersecurity incidents reported to the Indian Computer Emergency Response team (CERT-In) surged more than fourfold, with cases involving government organisations alone more than doubling during the same period. As India digitises governance, banking, and healthcare, even small breaches can trigger large-scale disruption. The government’s plan to make India a semiconductor hub is timely, but without parallel investment in end-to-end data protection — across public, private, and cross-border touchpoints — we risk becoming a data-rich but security-poor economy in an increasingly volatile world.

 

The world is taking an increasingly protectionist stance. European and United States data laws — particularly the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA)—are shaping global data privacy frameworks, prompting countries across Asia to refine their own regulations. Nations like China, Japan, and South Korea have enacted stringent data governance policies, balancing privacy with economic and security concerns. Southeast Asian economies, including Singapore and Indonesia, are tightening controls, wary of foreign tech dominance. As digital power shifts, the battle for data ownership is bound to become a defining issue in global geopolitics.

 

India is developing fast, and is on the path to transitioning from a middle-income to a high-income economy. Only a handful of Southeast Asian nations — Singapore, Hong Kong, Taiwan, and South Korea—have successfully made this leap. For India, the key to sustainable growth lies in a digital-first strategy, underpinned by strong data governance.

 

Favourable demographics

 

We have a lot going for us. India has made the fastest climb in the Global Innovation Index rankings since 2013 — rising from 65th place in 2013 to 39th in 2024.The Gartner Digital Workplace Survey ranked India as the most digitally dexterous country, ahead of the UK and the US, largely due to its large Gen Z workforce. With over 159,000 startups and a rapidly expanding digital economy, India is the third-largest startup hub globally. The country is expected to host over 620 global capability centres (GCCs) of Forbes Global 2000 companies by 2030, cementing its position as a technology powerhouse.

 

Historically, economic strategy was about market dominance and competition. Today, it is about control over data. Tech-led personalisation is transforming e-commerce, and AI-driven innovations — such as ChatGPT’s high-voltage debut — have shown that maintaining an edge in innovation and discovery is paramount. The buildup of phygital ecosystems, combined with India’s demographic advantage and demand-driven growth, is projected to push gross domestic product (GDP) growth to 5-6 per cent, even as the global economy stagnates at 1-2 per cent. While technology itself is fundamentally neutral, a regulator to protect our data is a step in the right direction.

 

As of February 2025, India has 153 data centres, with Mumbai leading the charge (38), followed by Bengaluru (21). The Indian data centre industry’s capacity will more than double to 2-2.3Gw by FY27, a Crisil Ratings report suggests. JLL India forecasts a total capacity of 1,521Mw by 2026, reinforcing India’s ambition to become a global hub for AI innovation and data infrastructure. This rapid expansion also brings heightened risks. The lack of a universally accepted digital sovereignty framework has turned the global digital ecosystem into a Wild West, where multinational firms exploit regulatory loopholes to dictate terms of data ownership. Despite stringent domestic laws, India has witnessed firsthand how global tech giants have sidestepped regulations to retain control over sensitive user data. OpenAI’s recent assertion in an Indian court — that removing ChatGPT data would breach US legal obligations—highlights this precarious power dynamic.

 

The irony is glaring. The world’s most populous nation generates vast amounts of data every second, but much of it is stored on foreign servers. It powers citizen services with cutting-edge tech—mostly built on Chinese chips, vulnerable to security breaches. This is bound to make us weak, especially in view of the geopolitical dynamics.

 

Ongoing innovation

 

India must champion the call for a binding global regulatory framework that ensures data sovereignty without stifling innovation. The AI Action Summit in Paris, co-chaired by Prime Minister Narendra Modi, attempted to address some of these concerns, but progress is tardy. “There is a need for collective global efforts to establish governance and standards that uphold our shared values, address risks, and build trust,” Mr Modi remarked at the summit. His words underscore the urgency of a robust digital sovereignty strategy. There are concerns, including those related to intellectual property rights, reliability, privacy, security, creation of morphed images and deepfakes, many of which can test our social cohesion. We certainly need to check this.

 

India must leverage its growing digital clout to establish a regulatory framework that safeguards citizen data while fostering global cooperation. Legal loopholes that favour tech monopolies must be closed. The public Cloud services market in India is projected to reach $25.5 billion by 2028, growing at a 24.3 per cent compound annual growth rate, according to the International Data Corporation. Without ironclad regulations, this growth will benefit foreign entities only.

 

As generative AI propels productivity into a new orbit, India must ensure that its data — its most valuable resource — remains under its control.

 

The author is chairman, EPIC Foundation, and Mission Governing Board, National Quantum Mission. The views are personal