India’s data centre infrastructure is booming—capacity will nearly double from 1.1 GW in 2024 to 1.7–2.0 GW by end-2026—but the regulatory frameworks lagged behind deployment. For SMBs outsourcing to Indian cloud providers or considering India-based infrastructure, this creates a due-diligence gap that’s both urgent and fixable.
India’s data centre opportunity is real. The numbers prove it: Microsoft announced $17.5 billion over four years for cloud and AI infrastructure there; Blackstone committed over $20 billion; and the Union Budget 2026-27 just offered a 20-year tax holiday to eligible foreign cloud providers using Indian data centres. The growth is structural, not speculative.
But here’s the hard part: regulatory frameworks are fragmentary and patchy. India has the Digital Personal Data Protection Act 2023 and CERT-In directives, sure. But they operate across a landscape of inconsistent central and state-level policies, no finalised national data centre policy, and enforcement that’s still ramping up. The Data Protection Board of India only became operational in late 2025. Meanwhile, data centre capacity is being deployed at a pace that outstrips the security audit infrastructure to verify it.
What does this actually mean for your business? Imagine you’re a 50-person B2B SaaS firm in Berlin. You’re looking to shift some customer data processing to an Indian cloud provider to lower costs and tap into the subcontinent’s lower infrastructure spend. The provider offers ISO 27001 certification—good. But you don’t have third-party audit proof that they refresh those audits annually, or that their incident response playbooks have been tested in the last 18 months, or that physical access logs are retained for the 90 days your compliance officer needs. These gaps exist because India’s regulatory ecosystem isn’t (yet) forcing the transparency that mature Western markets demand by reflex.
The Gap Isn’t Accident—It’s Architecture
India’s digital infrastructure push deliberately decoupled fiscal incentives from security mandates. The tax break is unconditional; the security framework is conditional on operators adopting practices that the regulator hasn’t yet formally required. Enforcement under the DPDP Act remains patchy, with penalties reaching INR 250 crore (roughly €30 million) per violation—large enough to scare, not large enough yet to have scared everyone into action.
State-level policy variation makes it worse. An operator in Telangana may not face the same audit or certification expectations as one in Mumbai. This creates a regulatory arbitrage: the provider with the lowest compliance cost, not the highest security posture, wins the race. And until the Data Protection Board of India has the bandwidth to audit and fine major operators at scale, that arbitrage persists.
The International Data Corporation and other analysts project USD 67.5 billion in committed foreign capital flowing into Indian cloud and data centre infrastructure over the next five years. At that scale of money flowing fast, security corners get cut. Not because operators are malicious—most aren’t—but because they can, and because the cost of cutting them is still lower than the cost of doing it right.
What This Means for Your Vendor Negotiation
Here’s my straightforward take: don’t assume that an Indian cloud provider’s lack of audit findings means they’re secure. Assume it means they haven’t been audited hard enough yet. Use that assumption to drive your SLA.
When you’re evaluating a provider, demand three things in writing:
Annual third-party audit proof — not self-certified, not internal reports. Annual SOC 2 Type II or equivalent attestation from a Big Four or equivalent firm. If they say “we’re compliant,” that’s not proof. If they say “we had an audit last year,” ask to see it. Many won’t have one. That’s your signal.
Incident response SLAs with teeth — CERT-In requires notification within 24–72 hours of becoming aware of a breach. Your contract should mirror that. But it should also specify who owns notification to you, within what window, and with what level of detail. If the provider hems and haws, they haven’t thought it through. Walk.
Data residency proof — you want certification, not promises. Under the DPDP Act, personal data can’t leave India without specific clearance from your government fiduciary (you). But data location—whether it’s actually on servers in India, not routed through Singapore or elsewhere—isn’t systematically verified by the Indian regulator. Your contract should require quarterly attestation of physical data location. Yes, it’s a cost for the provider. That’s the point.
Most Indian providers won’t have all three ready to go. Many will push back. That’s not because they’re bad actors; it’s because the market hasn’t yet demanded it at scale. By demanding it now, you’re forcing the market to mature faster—and protecting your business in the interim.
The Bigger Picture: Why This Matters
I’ve built AI solutions for clients across Europe and Southeast Asia for years. I’ve seen emerging-market infrastructure shortcuts work until they don’t. Indonesia’s power grid was cheap and stable until it wasn’t. Vietnam’s telecom licensing was flexible until a minister changed and it got strict overnight. The pattern is the same: cost advantage attracts capital; capital attracts regulation; regulation removes the cost advantage.
India’s data centre market is at the inflection point between steps two and three. The tax breaks and low construction costs are real. The regulatory tightening is coming—probably within 18 months, as the Data Protection Board gains enforcement muscle and the government settles the national data centre policy. When it does, compliance costs will climb fast.
If you’re signing a five-year contract with an Indian provider on the assumption that their costs stay low because they’re skating on thin security ice, you’re betting that the ice doesn’t crack while you’re on it. Smart money says: demand they thicken it now, before regulation forces them to and the cost gets passed to you.
FAQ
Do I need to move data out of India if regulations tighten?
No. Tightening regulations in India won’t automatically invalidate your contract or force you off Indian infrastructure. It means your provider’s compliance costs will rise, which they’ll pass to you in renewal negotiations. The protection you put in your SLA now—annual audits, incident reporting, data residency proof—will matter then. It gives you leverage to negotiate fairly, or to walk if the cost premium becomes unreasonable.
Isn’t SOC 2 Type II audit overkill for an SMB?
If you’re processing customer personal data, financial information, or health records, no. If your data is purely internal and non-sensitive, maybe. But most SMBs I work with handle customer data in some form. Once you do, you need audited proof that your vendor handles it securely. SOC 2 Type II is the global gold standard. It’s not overkill; it’s baseline due diligence.
What if my Indian provider refuses to share audit reports?
That’s your answer. They don’t have one, or they’re unwilling to disclose it. Either way, don’t sign. There are enough Indian providers with audits in place—or willing to hire an auditor before you sign—that you don’t need to take that risk. Make the audit a condition of contract signature, not a post-signature nice-to-have.
Sources
- India’s data centre opportunity and the compliance imperative — DWF Group
- Policy frameworks for Data Centres in India to protect the country’s sovereign data — OpIndia
- Cybersecurity 2026 — India — Chambers & Partners
- Data Center Development in India: Costs and Approvals 2026 — IMARC Engineering
- Cloud Data Hosting India Regulations FDI — Beacon Filing
- Analysing the Data Centre Policies of India — NASSCOM
If this resonates with your situation—if you’re evaluating cloud partners or reviewing vendor SLAs—let’s talk about it. Drop me a line at our contact page and tell me what you’re working through. Or catch my daily takes on emerging-market infrastructure and AI adoption on LinkedIn.
0 Comments