For years, the cloud sovereignty conversation has centred on one question: where is the data stored? A new Deloitte report, “Sovereign cloud for India: Building trusted digital infrastructure for the AI era,” published in September 2026, says that question is no longer enough.
The stakes are rising fast. Citing IDC, the report notes that India’s public cloud market was worth US$10.9 billion in 2024 and is expected to reach US$30.4 billion by 2029, growing at 22.6% a year. With cloud now running citizen services, banks, supply chains and AI systems, Deloitte says the debate has moved from use to governance.
Residency is necessary, not sufficient
The report’s central message is simple: keeping data in India is a starting point, not the finish line. Providers can still face legal orders from the countries where they operate or are incorporated. Real sovereignty, Deloitte argues, means demonstrable control over data, compute, admin access, encryption keys, legal protection, resilience and exit.
Importantly, this is not a call to shut out global providers. The report says sovereignty does not require isolation or a single deployment model. Controls should match the sensitivity and risk of each workload.
Proof over promises
Deloitte sets out eight dimensions, from classification and data to operations, legal terms, technical control and AI governance. Each comes with a decision question and the evidence needed to answer it, such as customer-controlled keys, immutable logs and tested exit plans. As the report puts it, “Sovereignty is proven by evidence, not labels.”
Guarding against the off switch
One of the report’s sharper points concerns service cut-offs. It notes that sanctions-linked disruptions to Indian entities have shown a single provider’s action can halt operations even when residency rules are met. Deloitte recommends contracts that bar unilateral suspension, include government escalation rights, allow recoverable backups, and have tested continuity plans.
The GPU blind spot
The report also flags a common confusion: data residency and compute residency are not the same thing. Keeping data in India while tapping overseas GPUs over a network is not a like-for-like substitute. For sensitive workloads, providers should prove the GPUs themselves sit in India. Headline GPU counts alone, it says, are not enough evidence.
AI is the next layer
Deloitte describes AI sovereignty as the next layer of cloud sovereignty rather than a separate agenda. It proposes four control points: compute access, training data governance, model and audit control, and inference infrastructure. Critical AI systems should have fallback plans that allow models or providers to be swapped without disrupting public services.
Closing the gaps
India already has key building blocks, including MeitY’s cloud selection guidelines, GI Cloud (MeghRaj) and the IndiaAI Compute Programme. But the report calls for five upgrades: common playbooks across ministries, independent audits and monitoring, model contract clauses, data lifecycle standards and an AI assurance profile.
The bottom line
Stronger controls may raise costs and add complexity, Deloitte concedes, but they also bring resilience, accountability and bargaining power. The goal is not to slow cloud adoption but to make it governable, measurable and reversible for the workloads that matter most. In the report’s words, India’s path is “cloud with verifiable control.”