NEW DELHI — As India cements its status as one of the world’s most prolific generators of digital footprints, a quiet yet profound strategic vulnerability sits at the heart of its technological ascension. While the nation produces a staggering volume of the world’s data, its domestic physical infrastructure to store, process, and secure that digital wealth remains severely constrained.
This paradox—balancing hyper-digitization with physical infrastructure deficits—is the focal point of a hard-hitting parliamentary evaluation. The Parliamentary Standing Committee on External Affairs, in its landmark 17th Report titled India’s Role in Global Tech Diplomacy, Digital Governance, Outer Space Diplomacy, AI and Emerging Innovations, has cast a sharp spotlight on the friction between India’s global digital footprint and its domestic data storage realities. Released in September 2026, the report brings to the fore critical questions regarding data sovereignty, national security, offshore dependencies, and the aggressive scaling required to protect India’s digital future.
1. Main Facts: The Capacity Crunch and the Data Imbalance
At the core of the parliamentary inquiry is a stark statistical divergence that has reignited policy debates across New Delhi’s corridors of power. According to estimates cited by the Committee, India accounts for nearly 20% of the world’s total data generation, yet it commands a paltry 3% of global data centre capacity.
This acute mismatch between creation and custody means that a significant, albeit unquantified, volume of Indian data is routinely offloaded onto foreign servers, hosted across offshore data centres managed by multinational cloud providers. The geopolitical and security implications of this reliance are manifold, touching upon everything from commercial latency and operational costs to the ultimate enforceability of Indian law over foreign-held information.
However, navigating the quantitative metrics of India’s digital infrastructure is a challenge in itself. The Ministry of Electronics and Information Technology (MeitY) pushed back against the ubiquity of these global datasets during parliamentary hearings. MeitY clarified that standard global tracking datasets do not formally validate the 20% generation figure, and characterized the 3% capacity metric as “indicative rather than precise.”
Despite these bureaucratic caveats, the trajectory of domestic capacity is undeniably upward. Industry estimates accepted by the panel show that India’s domestic data centre capacity stood at approximately 520 megawatts (MW) in 2020, expanding rapidly to roughly 1.5 gigawatts (GW) by 2025. Projections indicate this figure will hit 2 GW by 2026, on a steep path toward surpassing 8 GW by 2030.
Geographically, this growth remains heavily concentrated. The nation’s primary data centre ecosystems are tethered to five major metropolitan hubs:
- Mumbai (the undisputed financial and submarine cable landing capital)
- Bengaluru (India’s Silicon Valley)
- Hyderabad (the emerging tech and cloud cluster)
- Chennai (a vital southern gateway for submarine cables)
- Delhi-NCR (the political and northern enterprise powerhouse)
2. Chronology: The Evolution of India’s Data Policy Landscape
To understand how India arrived at this crossroad of infrastructure deficit and diplomatic maneuvering, one must trace the evolution of its digital policy framework over the past two decades:
- 2000: Enactment of the Information Technology Act, 2000 (IT Act), laying the primary legal bedrock for e-commerce and cybercrimes in India, though long before the era of hyper-scale cloud computing and generative AI.
- 2017–2018: The Justice B.N. Srikrishna Committee report sparks nationwide discourse on data localization, framing personal data as a sovereign asset and seeding the conceptual framework for modern data protection legislation.
- 2021: MeitY introduces the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, tightening accountability for social media intermediaries and setting traceability mandates.
- 2023: Parliament passes the historic Digital Personal Data Protection (DPDP) Act, 2023, establishing the legal framework for processing digital personal data, recognizing individual rights, and imposing heavy penalties for data breaches.
- 2025:
- MeitY rolls out the India AI Governance Guidelines, 2025, creating a protective shield against the unique vulnerabilities introduced by artificial intelligence and large language models.
- The government accelerates the IndiaAI Mission, onboarding more than 38,000 Graphics Processing Units (GPUs) at heavily subsidized rates to fast-track domestic computing power for AI startups and researchers.
- September 2026: The Parliamentary Standing Committee tables its comprehensive 17th Report, explicitly linking domestic infrastructure limits to foreign policy, tech diplomacy, and national sovereignty.
3. Supporting Data: The Trajectory of Infrastructure and AI Interventions
A closer look at the numbers underscores the massive capital expenditure and policy intervention required to bridge India’s infrastructure gap. The Committee noted that market forces alone will not organically close the deficit; rather, total capacity needs to quadruple over the next four years to meet the government’s own projected demands.
Data Centre Capacity Growth Projections
| Year | Estimated Capacity (MW / GW) | Source / Context |
|---|---|---|
| 2020 | ~375 MW to 520 MW | Baseline period; early enterprise cloud migration. |
| 2025 | >1,500 MW (1.5 GW) | Rapid post-pandemic digital acceleration and hyperscaler investments. |
| 2026 (Projected) | ~2,000 MW (2.0 GW) | Current milestone tracking ongoing construction pipelines. |
| 2030 (Target) | >8,000 MW (8.0 GW) | Projected requirement driven by AI, 5G, and IoT proliferation. |
Furthermore, recognizing that computational power is the new currency of national sovereignty, the state has stepped in directly through supply-side interventions. Through the IndiaAI Mission, over 38,000 high-performance GPUs have been provisioned at subsidized rates. This intervention aims to democratize access to high-end compute resources, ensuring that Indian AI innovators are not forced to rely exclusively on foreign cloud monopolies for training complex models.
4. Official Responses: The Bureaucratic Standpoint and Divergent Metrics
The friction between parliamentary oversight and executive administration forms a vital subtext of the 17th Report. The Committee’s findings highlighted a glaring institutional blind spot: MeitY does not officially maintain an exhaustive, centralized inventory of domestic data centre capacity.
When pressed by lawmakers, MeitY officials candidly admitted that the government relies heavily on aggregate third-party industry estimates rather than a standardized, government-verified census of data installations. This methodological discrepancy explains why different chapters of the parliamentary report cite varying figures for the 2020 baseline (ranging between 375 MW and 520 MW).
Responding to concerns over the 20%-to-3% data imbalance, MeitY cautioned against accepting global datasets at face value, noting that quantifying global data generation remains an imprecise science fraught with methodological ambiguities. Nevertheless, the Ministry acknowledged the underlying strategic risks. It pointed toward the rollout of the India AI Governance Guidelines, 2025, robust cybersecurity architectures, and privacy-enhancing technologies as proof that the executive branch is actively fortifying the digital ecosystem.
5. Implications: Sovereignty, Security, and Cross-Border Complexities
The downstream consequences of a nation storing its intellectual property, citizen data, and critical workloads offshore extend far beyond mere economic cost. The Committee’s report identifies three core hazards stemming from the domestic capacity gap: latency, escalating operational costs, and the erosion of data sovereignty.
National Security in an Era of Offshore Storage
When sensitive national data resides on servers located in foreign jurisdictions, India’s strategic autonomy is tested. In the event of a geopolitical crisis, trade dispute, or massive transnational cyberattack, Indian authorities face severe legal and technical hurdles in securing evidence from foreign entities or compelling overseas corporations to comply with local investigative mandates.
The report explicitly highlights that current regulatory frameworks do not prescribe a distinct, fast-tracked protocol for investigating data breaches involving foreign-hosted servers. While the Information Technology Act and the DPDP Act, 2023, offer robust domestic guardrails, enforcing punitive action or extracting forensic artifacts from an overseas entity remains a complex diplomatic tightrope.
AI-Specific Vulnerabilities
Artificial intelligence systems present an entirely new tier of risk. Because foundational AI models rely on ingestion engines gobbling up vast tranches of personal, behavioral, and sensitive data, they expose citizens to unauthorized access, sophisticated data scraping, privacy violations, and algorithmic misuse.
To address complaints regarding unauthorized data access, fraudulent financial transactions, and malicious web scraping, MeitY has operationalized multiple avenues for citizen grievance redressal, yet the systemic prevention of offshore leakage remains a work in progress.
6. Strategic Recommendations by the Committee
To rectify these vulnerabilities, the Parliamentary Standing Committee has issued clear, action-oriented directives across its final recommendations:
- Systematic Data Collection (Recommendation 36): The Committee mandates that the Ministry of External Affairs (MEA) collaborate closely with MeitY and other line ministries to establish a verified, institutionalized mechanism for tracking data centre capacity, utilization rates, and growth pipelines. Infrastructure planning, the panel stressed, must never again rely solely on commercial industry estimates.
- Assessing Offshore Exposure (Recommendation 37): The government must immediately conduct a comprehensive audit to determine the exact proportion of Indian data processed and stored overseas. The MEA and MeitY are tasked with evaluating the national security implications of this reliance and forging targeted international technology partnerships to bridge the domestic deficit. The report reiterates that market forces alone will not quadruple capacity; active state facilitation is essential.
- Multilateral Diplomacy and Cross-Border Breach Cooperation (Recommendation 38): Recognizing that cyber threats do not respect national boundaries, the Committee urges the MEA to champion India’s data protection priorities in bilateral and multilateral forums. This includes establishing binding international protocols and mutual legal assistance frameworks for investigating and resolving cross-border data breaches involving overseas entities.
Looking Ahead
As India positions itself as a vanguard of digital governance and tech diplomacy—championing digital public infrastructure (DPI) on the global stage—closing the physical infrastructure gap at home is no longer just an industrial objective; it is a vital pillar of national security. Whether the state can successfully incentivize the quadrupling of its data centre capacity by 2030 will determine if India truly masters its digital destiny or remains tethered to foreign shores.
