News

Data Sovereignty and India’s New Privacy Law

India is one of the world’s biggest generators of online data, and the new Digital Personal Data Protection Act, 2023, continues a regulatory trend aiming to safeguard Indian data.

The Anthropic ‘Shock’ – Not the First, Won’t be the Last

The US Government’s decision in June 2026 to place export controls on Anthropic’s Fable and Mythos AI models came as a rude wake up call to the Indian IT industry. This order (that was recently lifted) excluded any non-US nationals (even within the US) from accessing these tools. While this raises practical compliance questions for private businesses operating across borders, it has wider implications for countries such as India.

This is not the first time that national security concerns originating outside India have impacted local digital infrastructure. In mid-2025 Indian oil company Nayara Energy suddenly found its corporate email systems to be unavailable. It emerged that Microsoft had suspended Nayara’s access to Outlook email, Microsoft Teams, and other cloud services in order to comply with EU sanctions against Russia. Nayara is a private refiner, backed by Russia’s Rosneft, accounting for about 8% of India’s oil refining capacity.

While access was restored after Nayara approached the Delhi High Court, this incident highlights the uncomfortable reality that India’s business ecosystem, like many nations, is dependent on platforms and systems that are controlled from outside its borders. With an increasingly complicated and unstable international order taking shape in 2026, getting caught in the crossfire of other nations’ conflicts is increasingly likely, if not inevitable.

The recognised need to enhance India’s Digital Sovereignty, loosely defined as its ability to control its own digital ecosystem, finds voice in a number of regulatory initiatives. This article examines how India’s new Digital Personal Data Protection Act, 2026 (DPDPA), works towards an important element of Digital Sovereignty, Data Sovereignty.

 

Current Regulatory Framework in India

India’s existing regulatory framework focuses on sectoral rules requiring localisation of certain kinds of data, aligned with broader sector-agnostic data security rules.

The Reserve Bank of India, the financial regulator, has long required banks and regulated entities to store payment data within India. Similar rules apply on insurance data and securities data, with requirements relating to local cloud storage. The Indian company law regulator, the Ministry of Corporate Affairs, too, has mandated that books of account, charter documents, and corporate records of PLCs should be stored in India for a defined period of time.

In addition to these, India’s Computer Emergency Response Team (CERT IN) operates a framework requiring mandatory reporting of cyber-incidents and vulnerability assessments, and requires logs to be retained for a period of six (6) months. Finally, a set of rules dating back to 2011 require all bodies corporate to maintain data security in relation to personal and sensitive personal data.

 

Does the DPDPA Move the Needle?

The DPDPA does not require data localisation in so many words, but some of its mandates and rules showcase an intent to control and guide the flow of Indian personal data.

The DPDPA is India’s first data protection regulation, and contemplates the setting up of a Data Protection Board of India to act as gatekeeper of digital personal data. In itself, setting up a data regulator that can guide and shape the narrative on data governance in India has immense value. In real terms, as we have seen, jurisdictional data protection authorities have the most impact on day-to-day data processing activities.

The DPDPA Rules released in late 2025 introduce yet another intriguing player – a concept of ‘Consent Managers’. These have to be Indian entities who can enable Indian data subjects to give consent to digital platforms. This opens the door for Indian companies to build privacy tech products, similar to the financial tech products built by account aggregators. These entities could serve as an important bulwark against global digital business platforms, given the scale and size of India’s market.

Rule 6 of the 2025 Rules also introduce seven basic, minimum data privacy safeguards that every data processor has to comply with. These include retaining logs and personal data for one (1) year, and security measures such as encryption, masking, tokenisation, etc. Businesses may be driven to use cheaper, local data security and cloud storage products that rely on ‘Made in India’ digital infrastructure, in order to comply with these minimum rules (that now carry a money penalty for non-compliance).

Processing children’s personal data will require ‘verifiable parental consent’ from their parents or guardians. This may be done through obtaining and storing ID documents, or virtual tokens, which in turn may make local processing and storage the preferred alternative. Even otherwise, while the DPDPA does not require local storage of children’s personal data, moving such data across borders may carry risk and businesses may opt for local storage as a less risk alternative.

Finally, the DPDPA has reserved judgment on a class of entities to be denoted as ‘Significant Data Fiduciaries’ (SDFs). SDFs will have to undertake data audits, DPIAs, and report compliance to the Board. Most intriguingly, Rule 13(4) of the 2025 Rules requires that SDFs have to abide by Government orders on processing of personal data, including where the personal data and traffic data pertaining to its flow is not transferred outside the territory of India. As such, the Rules allow to Government to decide who should localize data, what type of data is to be localized, and the conditions in which cross-border transfers are permitted.

 

Looking Ahead

Asserting Data Sovereignty against the might of long-established global digital business platforms will not be easy. That is not to say that it is impossible.

Take an example from the Indian payments sector. India’s United Payment Interface (UPI) was launched in 2016 as an alternative to global credit card networks. It now processes more transactions than card networks, and has been expanded to overseas territories including Singapore and France. UPI, too, was faced with entrenched global players in a crowded online payments market, which puts its achievement in context. The creation of an instant, zero-fee retail payments system in a market the size of India sounds impossible. And yet, UPI has reshaped the Indian retail payments market while pitted against global financial networks.

Of course, Data Sovereignty will need to be supplemented by concurrent development in fields such as local cloud data centres, developments in digital public infrastructure, and access to open commerce platforms. Finally, the institutional and political will to enforce digital laws will determine the future for Data Sovereignty in India.

 

 

Article provided by INPLP members: Vikram Jeet Singh and Prashant Mara (BTG Advaya, India)

 

 

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)