Technology industry executives have urged India to ensure its proposed sovereign cloud framework covers more than data storage.
What Should Sovereign Cloud Rules Cover?
Industry representatives have called for a framework that establishes who owns the technology, operates cloud infrastructure and controls access to sensitive government information.
Vivek Srivastava, executive vice-president and business head for cloud and cybersecurity services at Tata Communications, said sovereignty must extend beyond keeping data within national borders. He said the framework should consider technology ownership, operational control, infrastructure hosting and legal jurisdiction. Infrastructure considered sovereign to India should not contain components controlled by entities subject to foreign jurisdictions, he argued.
Srivastava also called for clearer definitions across government departments, noting that banking regulations already address operational control alongside data residency.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Why Do Sensitive Data Need Stronger Protection?
Industry executives have recommended different security requirements based on the sensitivity and importance of government information.
Tarun Wig, co-founder and chief executive of Innefu Labs, said servers handling national security, defence and law enforcement information should remain entirely offline and under government control. He warned that storing data domestically would not necessarily eliminate risks arising from foreign legal jurisdiction over cloud providers.
For less sensitive government operations, Wig supported a graded framework incorporating technical safeguards and contractual protections.
How Should Cloud Providers Be Regulated?
Nakul Jain, co-founder and chief executive of Aplyd and partner at Athena Infonomics, said sovereignty should combine domestic data storage, local operational control, encryption-key ownership and protection against foreign legal access. He recommended enforcing these requirements through technical design rather than contractual commitments alone.
Jain also urged alignment with existing Reserve Bank of India and Securities and Exchange Board of India regulations to avoid overlapping compliance obligations. Foreign cloud providers need not be excluded, he said, provided they demonstrate adequate operational and legal safeguards.
What Is the Government Planning?
The Ministry of Electronics and Information Technology has constituted a committee to develop a sovereign cloud framework for government data. The committee held meetings in July and is examining where different categories of government information should be stored and who should have access.
Tata Communications, which operates a government community cloud used by approximately 125 central government ministries, has participated in discussions concerning cloud requirements.
The industry’s recommendations highlight an important distinction between storing information in India and ensuring that sensitive systems remain under Indian control. The proposed framework could address that distinction through risk-based safeguards, clear operational responsibilities and protection against foreign legal access.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
