Infrastructures:India

Historical context

In light of decolonization and liberalization of the economy around the 1980s, India experienced a new wave of innovation and global economic relevance owing to their educated workforce (1). India has remained an enthusiastic participant in the global market and international political space, following the same trend as other economic powers that once promoted open trade relations, switching towards national interests - settling on a theme of self-reliance.

Digital Sovereignty Ambitions

“Digital sovereignty” is a concept that has been used by scholars and policymakers as an umbrella term to make claims over all aspects of digital infrastructures (2). In order to analyze the instruments used in India to pursue digital sovereignty, we must explore those instruments under the light of different conceptualizations deeply linked to this term. Therefore, we will resort to the following notions: 1. Technological sovereignty; 2. Internet sovereignty; and 3. Data sovereignty.

Technological Sovereignty

Technological sovereignty “refers to the efforts of nations and/or countries to create technologies that reduce American control over, and surveillance of technological systems, including the Internet” (3). Therefore, in this section we outline the main attempts from the Indian Government directed towards reducing their technological dependencies, especially when it comes to critical infrastructures.

One of the early instruments to gaining a broader control over India’s infrastructure was the Information Technology Act, 2000, (the “IT Act”) as amended by The Information Technology (Amendment) Act 2008. Section 70 of the IT Act invests the Government with the authority to define via an official notification certain computer resources as protected systems. The provision takes a further step in elaborating what counts as “Critical Information Infrastructure” (CII), defining it as the computer resource, the incapacitation or destruction of which shall have a debilitating impact on national security, economy, public health or safety.

In the protection of CII, Section 70A decrees the establishment of a dedicated national nodal agency, which shall be responsible for several measures including R&D relating to protection of CII. However, despite this regulatory effort, little was achieved during this time to address the topic of technological dependencies.

As a response, the Ministry of Electronics and Information Technology (MeitY) issued the country’s first National Cyber Security Policy (NCSP) in 2013. This Policy can be categorized as a soft law instrument aimed at steering the country towards building a secure and resilient cyberspace for citizens, businesses and Government. Among its many objectives, the Policy aimed at developing “suitable indigenous security technologies through frontier technology research, leading to widespread deployment of secure ICT products / processes in general and specifically for addressing National Security requirements”. The NCSP proposed many strategies to enhance security in the cyberspace, including:

• Strengthening the Regulatory framework.
• Creating a National Level Computer Emergency Response Team (CERT-In).
• Operating a 24x7 National Critical Information Infrastructure Protection Centre to function as the nodal agency for critical information infrastructure protection.
• Reducing supply chain risks by creating and maintaining testing infrastructure and facilities for IT security product evaluation and compliance verification as per global standards and practices.

Many of these strategies were followed through, albeit with different degrees of success when it comes to achieving sovereignty in the technological sphere.

To begin with, the NCSP led to the creation of the National Critical Information Infrastructure Protection Centre (“NCIIPC”). As the commanding authority accountable, the NCIIPC introduced the Information Security Practices and Procedures for Protected System Rules, 2018 (the “NCIIPC Rules”) and issued Guidelines for the Protection of National Critical Information Infrastructure, 2015 (the “NCIIPC Guidelines”) to safeguard India’s CII from unauthorized access, modification, use, disclosure and disruption to ensure a safe, secure and resilient information infrastructure for critical sectors in the country. Among these rules, certain requirements stand out, such as the mandatory inventories of hardware and software related to CII (Section 3(3-e) of NCIIPC Rules) and the promotion of indigenous Research and Development (R&D) regarding the protection of CII (Section 4.3.7 of NCIIPC Guidelines).

In addition, the India Stack (the “Stack”) was a nationwide government program that recognized societal inequalities enhanced and perpetuated due to lack of access to the internet and technology. As a socialist endeavor, the Government launched platforms to dissipate welfare functions, promoting digital literacy and enhancing electronic governance. These systems were conceived as being mostly indigenous and open-source, allowing India to now export this technology framework to other nations looking to build their own digital stack.

Furthermore, under the Public Procurement (Preference to Make in India) Order, 2017, MeitY issued a notification designating cyber security as a strategic sector, stating that "preference shall be provided by all procuring entities to domestically manufactured/produced Cyber Security Products" with preference granted to companies incorporated in India whose product IP and licensing revenue accrue domestically, and royalty payments abroad capped at 50% of the product's cost.

Despite the above, technological dependency is still an issue in India. The policy on data centers is a clear example of this, since these facilities have proliferated in India during recent years under a sovereignty discourse. Under India's Consolidated FDI Policy Circular of 2020 (DPIIT), data centers have not required prior government or central bank approval. Implying that the nation intends to favor foreign investment in their construction. These incentives mean that the infrastructure for data centers “will be built upon American foundation models and run on American chips” (4), a policy that ultimately benefits hyperscalers without offering much in return for affected populations.

This dilemma showcases one of the main tensions still prevalent in India: developing indigenous infrastructure for critical services in order to prevent dependency on third countries (as shown with the Stack) vs boosting investment by encouraging foreign companies to build digital infrastructures within Indian sovereign territories.

Internet Sovereignty

Internet or network sovereignty is a notion invoked by protectionists or nationalist agendas in an attempt to “control the digital networks and information running through them” (5).

The NCSP provided an adequate advisory and guideline basis which helped protect infrastructures and public services upon which the Digital India Scheme (DIS) was promoted. DIS sought to expand access to the Internet of Things from city to rural areas to facilitate government functions and financial transactions digitally through secured high speed broadband and digital public infrastructures (DPI), a foundational block of the Stack (6).

The India Stack is a three-stage e-government infrastructure project based on the digitalized Aadhaar platform, comprised of the Identity Layer (developed since 2009), the Payment Layer (developed since 2010), and the final Data Layer (building on the previous two layers), designed to combat money laundering and corruption, better monitor financial flows, and provide the Indian population with simplified access to financial services (7).

This is a pivotal policy to analyze for a better grasp on the internet sovereignty sought by the Indian Government. The main achievements of this initiative are the following:

• Aadhaar (Identity Layer): Served as a nationwide security and biometric unique identity scheme that created the world’s largest digital public infrastructure.
• Unified Payments Interface (Payment Layer): Enabled simple digital transactions between two mobiles to transition into a cashless economy with additional financial schemes such as demonetization and zero-cost bank accounts.
• DigiLocker(Data Layer): A secure cloud storage space run by the government to secure personal data documents for official purposes without physical paper dependency.

While being praised due to its efficiency and inclusionary potential, the stack’s increasing centrality in governance raises significant concerns. Significant concerns have been flagged as it relates to mass surveillance that consequently arises from the state's control over the network.

In addition, Section 69A of the IT Act bestows the Government powers over content, by ratifying the capacity to block on narrow grounds (sovereignty, security, public order, etc). Since 2023, though, the government has increasingly used a parallel channel, consisting of notice-and-takedown mechanisms through the "Sahyog" portal (operated by the Cyber Crime Coordination Centre of India) under Section 79(3)(b). This provision was intended for removal of content used for unlawful acts, and affected entities have claimed that the Government has attempted to extend its reach to override the restrictions built into Section 69A. This shift generated over 2,300 orders across 19 platforms in just one year (Oct 2024–Oct 2025) and is now being challenged in court.

The dilemma presented above showcases a new tension within the Indian digital framework: while certain provisions allow the Central Government to maintain an effective control over the network and the contents shared through it, a significant risk for citizens privacy rights and individual freedoms is arising as a result.

Data sovereignty

Finally, data sovereignty refers to “protecting and controlling information on and flowing through digital networks” (8). The Supreme Court's judgment in Justice K.S. Puttaswamy v. Union of India addressed the privacy concerns of the centralization of citizens’ data in Aadhaar, recognizing that the right to privacy would fall under Article 21 of the Constitution (originally reserved to the right to live). There has been much controversy around the societal ramification of a single identification mechanism including the exclusion of nonparticipants from fundamental public services.

The Puttaswamy decision formed the material foundation (9) of what would later be the Digital Personal Data Protection Act, issued in 2023. It delineated two groups (the “Data Fiduciaries”):

• Processors of data in the Indian territory or
• Processors of data outside of India, in the condition such processing is in connection with any activity related to offering of goods or services to Data Principals within Indian territory.

This is one of the main elements that is worth mentioning about this framework, as the extraterritorial reach of the law attempts to extend India’s sovereignty over its data beyond the borders of the country. Furthermore, Section 16(1) established that The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.

To complement the Act, additional Rules were issued in 2025 following the objections and suggestions received from the public by the Central Government. According to Section 13 (4), a Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India.

The abovementioned provisions are a clear indicator of India’s attempt to strengthen the control over their citizen’s data. While international transfers are less restricted than under the EU approach, foreign Data Fiduciaries would still be subject to Indian law, and the Central Government is in position of both banning transfers to specific countries as well as establishing data localization requirements for certain data elements. This structure, while not identical to the GDPR, still manages to reinforce the country’s data sovereignty claims.

Comparison with the EU

Although India and the EU both acknowledge technological sovereignty as a key objective, the corresponding frameworks, prioritization and approaches in the direction of achieving this starkly vary.

For instance, as it pertains to the domain of data governance and data protection, the EU has a comprehensive regulatory landscape that gives high-priority to the safeguarding of rights as evidenced with General Data Protection Regulation (“GDPR”) and the Digital Services Act, which institute well-defined rules on data privacy, and cross-border data flows. A distinguishing element of approaches relates to paradigms in place. The EU has adopted the ‘allowed list’ model that is rooted in adequacy decisions, while India has a ‘negative list’ model, meaning it permits cross-border data transfers unless specifically restricted. Both paradigms present different challenges and opportunities respectively. The European approach encourages third countries towards benchmarking for adequacy decisions, while India encourages strong relations to avoid a ban. This could explain the fact that India lacks an adequacy decision from the EU.

However, these two nations share similarities regarding their digital infrastructure policy goals. In a shared statement on the second meeting of the EU-India Trade and Technology Council, both countries agreed to “collaborate on working towards interoperability of their respective DPIs that respect human rights and protect personal data, privacy, and intellectual property rights” and “promote the strengthening of the EU and Indian semiconductor ecosystems to enhance technological capabilities and ensure supply chain resilience by developing sustainable, secure and diversified semiconductor production capacities”, showcasing a common aim at reinforcing data and technology governance. Both countries also attempt to extend the effect of their infrastructure regulations beyond its borders, with India’s IT Act applying to any offence or contravention committed outside India if the act or conduct involves a computer, computer system or computer network located in India (Section 75) and the EU requiring non-EU digital infrastructure and service providers offering services in the Union to appoint an EU representative (NIS2 Art. 26(3)).

Their main difference in that regard stems from the robustness of their legislation. While the EU has developed a strong sectorial cyber security framework in the form of the NIS 2 Directive (with the corresponding transpositions across Member States), India’s framework relies on an outdated law that generally applies to IT services (the IT Act) without the same degree of harmonized regulatory density. Furthermore, from a policy point of view, India has attempted to foster foreign innovation in developing digital infrastructures for data centers, favoring the presence of hyperscalers, whereas the EU has attempted to steer into the opposite direction and support the development of European cloud computing offerings. This shows a major difference in addressing an already identified issue regarding their respective technological dependencies.

References

• (1) Biswajit Maitra and Moutushi Chakraborty, 'Foreign Trade, Human Capital and Economic Growth in India under the Liberalised Trade Regime' (2023) 5(1) Journal of Asian Economic Integration 29, doi:10.1177/26316846221147581.
• (2) Plixavra Vogiatzoglou and Joris van Hoboken, 'The EU's Digital Sovereignty and Quantum Technologies: To What End?' (2026) 18(2) Law, Innovation and Technology, doi:10.1080/17579961.2026.2705118, 2.
• (3) Stéphane Couture and Sophie Toupin, ‘What Does the Concept of “Sovereignty” Mean in Digital, Network and Technological Sovereignty?’ (Social Science Research Network, 22 January 2018) 5https://doi.org/10.2139/ssrn.3107272
• (4) Vinit Ravishankar, 'Sovereignty After the Boom' (Disjunctions)https://disjunctionsmag.com/articles/sovereignty-after-boom/accessed 24 September 2026.
• (5) Vogiatzoglou and van Hoboken (n 2) 6.
• (6) Snehal A. Bagul, 'Guarding the Digital Gateway: An In-Depth Analysis of Cybersecurity Challenges in India' in Faisal Rehman and others (eds), Emerging Trends in Information System Security Using AI & Data Science for Next-Generation Cyber Analytics (Springer 2025) 69–71.
• (7) Sezgin Sönmez, 'The India Stack – Between Networked Growth and Territorial Control' (2025) 50(4) Historical Social Research 318,https://www.jstor.org/stable/27426713.
• (8) Vogiatzoglou and van Hoboken (n 2) 6.
• (9) Committee of Experts under the Chairmanship of Justice B N Srikrishna, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (Ministry of Electronics and Information Technology, 27 July 2018)https://www.thehinducentre.com/resources/article24561547.ece/binary/Data_Protection_Committee_Report-comp