How are data laws driving global companies to opt for Indian data centers

Last month, enterprise solutions provider SAP announced that it will make several cloud solutions like SAP S/4HANA Cloud and SAP Business Technology Platform on India-based data centers from mid-2024. The company said that it is taking this step in light of the regulatory requirements for data processing and storage which affects Indian businesses part of SAP clientele.

Notably, this trend is not exclusive to SAP, as other major players like content delivery network player Akamai and workflow management software provider Atlassian are also opting to store and process their Indian data within the country's borders. While the reasons range from India's emergence as the IT hub to lowering the latency,  the data protection laws in the country are also being attributed as a pivotal factor.

The Digital Personal Data Protection (DPDP) bill, which broadly focuses on the governance and the processing of digital personal data became an act this year in August. The government is now in the process of framing and rolling out the rules and regulations of the Act. To be sure, electronics and information technology minister Ashwini Vaishnaw, while speaking on the sidelines of India Mobile Congress 2023 said that the draft rules have already been drawn which will be released for public consultation ‘soon’.

It may be noted that with respect to data localisation, DPDP lays down restrictions for the cross-border transfer of data by a fiduciary through a whitelist-blacklist approach. This means that cross-border personal data transfer will be allowed, with the exception of countries restricted by the government. 

“Even though the Act in its current form may not be explicitly prescribing localisation of data, I have seen that many companies are cautious. They don’t want to take chances should there be a different interpretation in the future. Since India already is a good market and has an upcoming data center infrastructure, companies are looking at hosting data on India-based data centers,” said Sunil Gupta, the chief executive officer of the Mumbai-headquartered data center company Yotta. 

Gupta also added that several foreign apps that have been banned in the past in India are again approaching the government to resume operations. “To build a strong case, these app companies, many from geopolitically hostile countries like China, are localising their Indian data. This again could offer impetus to the already growing data center ecosystem in the country.” In 2019, ByteDance, the parent company of Chinese app TikTok announced its plans to establish local data centers.

The DPDP Act has undergone extensive deliberations over half a decade, with previous iterations containing more explicit data localization provisions for cross-border transfers. However, the current Act clarifies that existing sectoral laws with higher regulatory standards for personal data transfer outside India take precedence.

“One example is the Reserve Bank of India’s data localisation mandate. It covers a wide range of entities like banks, payment gateway providers, payment network operators, and payment service providers.  India being the most populous country in the world with a large digital payment ecosystem and a huge amount of transactions will give rise to data center growth,” said Mini Gupta, Cybersecurity Consulting Partner, EY India.

Further, we need to think of India beyond a data-generating market perspective, say experts. “I believe this (DPDP Act) will also lead to a huge inflow of data back to India. The Act hints that in those geographies where the data from India can go, data from those geographies can flow into India very freely,” said Yotta’s Gupta.

Echoing similar thoughts, AS Rajgopal, CEO  of NxtGen Datacenter and Cloud Technologies said that India has a massive opportunity in terms of leading the APAC region (beyond China) in terms of the data center industry. “The earlier data center hub for APAC was considered to be Hong Kong and later Singapore. Now both these regions are small in terms of data generated and region size. Given positive factors playing in favour of India, we can be positioned to become the hub for not just Indian markets but also of other APAC regions.

India as a market for data centers is already seeing a positive uptick. Data protection laws and state incentives, coupled with growing digital public infrastructure, 5G rollout, and use of new technologies like artificial intelligence (AI) and Internet-of-Things (IoT) devices will add 693 MW of data centers in India between H2 2023 to 2026, real estate consultancy JLL said in a report in October. This would entail a demand for 8.8 million square feet of real estate space. Data center infrastructure and real estate construction would require investments of $4.4 billion until 2026, the report further added.