As cloud infrastructure becomes increasingly integral to public services, financial systems, manufacturing, supply chains and AI-enabled applications
FinTech BizNews Service
Mumbai, 17 October, 2026: Deloitte India has published its recent report, titled “Sovereign Cloud for India: Building Trusted Digital Infrastructure for the AI Era”, exploring how India can strengthen digital sovereignty while enabling cloud adoption and AI innovation.
As cloud infrastructure becomes increasingly integral to public services, financial systems, manufacturing, supply chains and AI-enabled applications, the report highlights the need for a risk-based approach to cloud governance, with verifiable controls over critical and sensitive workloads.
Key highlights from the report:
The report emphasises that sovereign cloud does not require technological isolation or the exclusion of global cloud providers. Instead, the focus is on ensuring that critical workloads remain subject to appropriate Indian legal, operational and security controls while preserving access to global innovation.
Cloud computing now underpins a significant
share of India’s digital economy, public service
delivery, regulated-sector operations and
emerging AI workloads. According to IDC, India’s
public cloud services market is projected to reach
US$30.4 billion by 2029, reflecting a 22.6 % CAGR
over 2024-2029.1 Therefore, India’s focus has
shifted from whether to use cloud technology
to how to govern, procure and operate it
effectively, implementing clear, verifiable and
proportionate controls.
As cloud becomes a foundational layer for citizen
services, financial systems, manufacturing and
supply chains, Digital Public Infrastructure (DPI)
and AI-enabled systems, the nature of risk also
changes. Cloud decisions are no longer purely
technology or cost decisions; they now carry
implications for legal jurisdiction, operational
resilience, continuity of public services,
control over sensitive data and long-term
strategic autonomy. This creates the need
for a sovereign cloud approach that allows
India to benefit from scale and innovation
while ensuring that critical workloads remain
subject to Indian oversight, accountability and
control.
Sovereign cloud, for this paper, means a
workload-led governance and control model in
which cloud adoption is guided by classification,
Indian legal and policy requirements, and
verifiable safeguards across data, compute,
operations, legal accountability, resilience and
enforceable exit rights. For India, these controls
are anchored in different documents such as
Digital Personal Data Protection Act, 2023, the
applicable DPDP Rules, sectoral regulations,2 the
MeitY Cloud Empanelment Programme and
and other policies and standards. Sovereignty
does not require technological isolation, a single
deployment model or the exclusion of global
cloud providers. Rather, sovereignty requirements
shall be calibrated to the sensitivity, criticality and
risk profile of each workload, while respecting
existing guidelines, eligibility criteria and
recognised deployment options.3
International experience reinforces this balanced
approach. The EU Data Act4 supports portability,
cloud switching and interoperability between
data-processing services, and also includes
safeguards against unlawful third-country
governmental access to non-personal data held in
the EU. FedRAMP (Federal Risk and Authorisation
Management Program) demonstrates how
government cloud adoption can be channelled
through standardised authorisation and certified
marketplaces; and Gaia-X highlights the value of
interoperability, trust and control over data.5
India already has important building blocks
in place, including the Guidelines for cloud
selection framework,6
GI Cloud (MeghRaj),
government and state data centre capabilities,
the MeitY Cloud Empanelment Programme and
the IndiaAI Compute Programme. The recent
cloud-selection guidelines provide a baseline
under which workloads are assessed according
to their categorisation and aligned with
appropriate deployment options, safeguards
and procurement routes.
However, data location alone does not establish
sovereignty. Sovereignty to be assessed by
demonstrable control over data, compute,
administrative operations, encryption keys,
legal protection, resilience and exit, rather
than by location alone. Data residency is
necessary but not sufficient. Providers may
be subject to lawful orders in jurisdictions
in which they operate or are incorporated.
Practical exposure, therefore, depends on
factors such as corporate structure, data custody
and control, encryption design, contractual
commitments and conflict-of-law mechanisms.
Beyond data sovereignty, India now faces a
second frontier: AI sovereignty. As AI becomes
embedded in public services, financial systems,
healthcare, defence and critical infrastructure,
control over compute access, training data, model
artefacts and inference infrastructure becomes
strategically important. Global supply chains,
export controls and platform dependencies are
increasingly shaping access to AI infrastructure.
India’s sovereign cloud strategy to therefore
extend beyond hosting and localisation to include
AI compute, model governance, monitoring,
auditability and exit readiness.
