- An Airtel executive told India Mobile Congress 2026 that storing data in India is not enough for sovereignty. Access and control matter too.
- MediaNama notes that several prominent Indian rules test where data is stored. Its Nayara Energy examples show suppliers can suspend service.
- Ask each cloud and software supplier who can suspend service, who administers your logs, and what the contract says if sanctions apply.
An address is not a set of keys
Where a server sits tells you where data is kept. It does not tell you who can read it or who can switch it off.
Airtel's Chief Business Officer put that point to a panel in New Delhi on October 7, at IMC 2026. MediaNama covered the session.
Abhishek Biswal said sovereignty goes beyond storage. In his view it includes an organisation's ability to reach its own data when it needs to. He added a second test: could a foreign government shut that access off?
This shows a simple split. Residency is a question about geography. Sovereignty is a question about power. Many Indian localisation rules focus on residency, so the two are easy to confuse.
Three layers of control
Biswal described Airtel's approach in three layers. The first is data sovereignty. The second is control over the technology across its whole life.
The third he called operational sovereignty. It covers who can reach the physical infrastructure "but also the logs and the telemetry". Telemetry is the stream of records a system keeps about its own operation.
Logs matter because they show who did what, and when. A firm that cannot see or run its own logs has given up part of its control, even if the data never leaves the country.
How a foreign hand can reach local data
Biswal raised one route: a foreign jurisdiction forcing access to an Indian company's data, or switching a service off. He used the United States as his example.
He pointed to the US CLOUD Act of 2018. Under it, American authorities can order a provider under US jurisdiction to hand over data it controls. Where the data sits does not change that.
MediaNama adds a second route in its own background reporting: the supplier's off switch. Nayara Energy is a refiner part-owned by Russia's Rosneft. In July 2025, Microsoft cut its Outlook and Teams service, pointing to European Union sanctions.
MediaNama reports the services returned shortly before the Delhi High Court was due to hear Nayara's petition. This September, the same court ordered SAP India to bring back software support. Citing Business Standard, MediaNama says the court saw that suspension as prima facie a breach of contract.
One supplier restored service just before a hearing; a court later ordered another to restore support. These are two suppliers and one customer. They do not show how often this happens.
What several Indian rules test today
MediaNama notes that several prominent Indian localisation rules focus on where data is stored. The Reserve Bank of India's 2018 directive says payment system data must be stored only in India.
A 2022 CERT-In rule makes organisations keep system logs for 180 days, under Indian jurisdiction. Its later FAQs allow logs to be held abroad if they can be produced promptly on demand.
The 2023 Digital Personal Data Protection Act lets the government limit transfers of personal data to countries it names. That clause, Section 16, takes effect only on May 13, 2027.
The session left one question open. What earns an Indian cloud the label sovereign? Is local data enough, or must control be local too?
What the demand numbers do and do not show
Pablo Iacopino of GSMA Intelligence gave the panel survey figures. He said 75% of Indian enterprises rate tech sovereignty as very important to their digital transformation. He said they would pay about 15% more for it.
GSMA Intelligence's published research puts the average premium at 13%.
Treat these figures as unverified. MediaNama has asked GSMA Intelligence for the India sample size, the sectors, the survey date and how it defined "sovereign".
Moderator Vivan Sharan asked whether the premium pays for sovereignty or for better service. The GSMA speaker said enterprises ranked cybersecurity first.
Airtel is also a seller in this market. Xtelify, its digital unit, brought out Airtel Cloud in August 2025 and billed it as a sovereign platform.
MediaNama has asked Airtel how it defines operational sovereignty. It also asked whether any foreign partner can reach Airtel Cloud's control systems or logs. And it asked what Airtel's contracts say if sanctions hit a supplier. MediaNama says it will update its report when Airtel replies.
Questions to put to your team
Start with your supplier list. For each cloud and software vendor, ask who can suspend your service, and under which law or sanction.
Then ask who administers your logs and telemetry, and from where. A server in India run by foreign administrators may pass the address test and still fail the control test.
Ask what each contract says if a supplier faces sanctions or a legal order. In the SAP case, it took a court direction to bring support back.
Finally, ask what a sovereignty premium buys. If a vendor charges one, get its definition in writing.
An address is a fact about a server. Sovereignty is a fact about contracts, jurisdiction and who holds the keys.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: MediaNama.
