Keeping India’s data inside India was the right first step. In the age of AI and autonomous agents, the harder question is who controls the infrastructure that data runs on.
For most of the past decade, India’s debate on digital sovereignty has been a debate about geography. The RBI’s 2018 directive requiring payment data to be stored in India set the template. Sectoral rules followed, and the Digital Personal Data Protection Rules, notified in November 2025, bring the full regime into force by May 2027.
Data localisation was the right first step. But it answers only one question: where does the data sit? It does not answer who can reach it, who runs the systems that process it, or who decides whether those systems stay on.
Residency is not control
A server can sit in Mumbai and still be governed from elsewhere. Foreign laws can compel providers headquartered in their jurisdiction to produce data wherever it is stored. And the layers that matter most, the control plane that provisions workloads, the identity system that grants access, the encryption keys and the update pipeline, often sit outside India. Local regions and partner-run models from foreign providers do not close this gap: the control plane, the keys and final operational authority still rest with a foreign parent.
AI raises the stakes
AI Models are trained on an enterprise’s most valuable data, and inference runs continuously inside credit decisions and clinical workflows.
Agentic AI deepens the dependence with calling APIs, moving money and updating records. When autonomous software executes decisions for banks, hospitals and government departments, the infrastructure beneath it becomes part of the decision chain. An access revocation or a policy change made abroad stops being an IT incident and becomes an operational one, at national scale.
India is building compute at speed. The IndiaAI Mission has onboarded more than 38,000 GPUs for shared use, and the government has spoken of scaling to 200,000. The question is no longer whether India will have compute. It is whether India will control it.
The four layers of sovereignty
Infrastructure-level sovereignty means asking four questions:
- Data: Where is it stored and processed? Most policy stops here.
- Control plane: Who operates the software that provisions and manages workloads, and from where?
- Identity and keys: Who can grant access to production, and who holds the encryption keys?
- Jurisdiction and continuity: Which laws can compel the provider, and would the service keep running if foreign support were cut off?
A sovereign cloud answers all four from within India.
What CIOs can do now
Sovereignty is set in policy, but it is enforced in procurement, one contract at a time. CIOs can start with four steps:
- Classify workloads by criticality, and hold AI and mission-critical systems to the four-layer test, not just a residency clause.
- Ask providers, in writing, where their control plane runs, who can access production, and which foreign laws apply to them.
- Hold your own encryption keys wherever the architecture allows.
- Test your exit: know how quickly a critical workload could move if a provider’s terms, ownership or jurisdiction changed.
Building it here
Indian enterprisesneed a sovereign cloud built from the ground up, not assembled from foreign platforms with a local address. A credible approach has providers owning the full stack within India: bare-metal and compute, the control plane, orchestration and identity. Workloads should run across multiple availability zones so that a single failure does not become a national outage. AI infrastructure must be controllable from India, with the keys, the access rules and the update pipeline under Indian authority. Sovereignty will only scale if enterprises are not required to operate this stack themselves, which makes fully managed delivery the expected model rather than an optional extra.
Data localisation drew a border around India’s data. As AI agents take on more of the country’s critical work, sovereignty must extend from where data rests to who runs the machines that act on it. That is India’s sovereign cloud moment, and it is not one we can afford to rent.
Authored by Vishal Sirohi, Founder & CEO, Island Computing