Data sovereignty is both a legal concept and an architectural requirement. As a legal concept, it holds that data is subject to the laws of the jurisdiction in which it physically resides — meaning that data stored on servers in a foreign country is subject to that country's laws, including laws permitting government access. As an architectural requirement, it describes the need for organisations to maintain actual physical and logical control over their data — not merely contractual assurances from a third-party provider.
The Indian regulatory context
India has developed one of the world's most explicit data sovereignty frameworks across multiple sectors:
The RBI has required, since 2018, that all payment system data be stored exclusively in India. This applies to all payment system operators and their service providers. Subsequent circulars have extended similar requirements to NBFCs and banks' core banking data.
The SEBI cloud adoption framework (2023) requires that critical data, including trading data, investor records, and audit trails, be stored and processed within India. Overseas storage requires prior approval and strict contractual frameworks.
The DPDP Act 2023 empowers the Central Government to restrict cross-border transfer of personal data to certain countries — establishing a data localisation framework that will apply to all entities processing personal data of Indian residents.
The ABDM (Ayushman Bharat Digital Mission) framework requires that all health data — including ABHA-linked records — be stored within India and under governance frameworks that prevent foreign access.
Contractual assurances vs. technical sovereignty
A critical distinction is between contractual data sovereignty (a cloud provider contractually commits to storing data in India) and technical data sovereignty (the data physically resides on hardware you own, with no third party having access). Contractual sovereignty does not protect against foreign government subpoenas served on the cloud provider, hardware-level access by cloud provider employees, or service discontinuation decisions. Technical sovereignty — on-premise infrastructure — is the only way to guarantee that data remains under your control regardless of geopolitical or commercial developments.