India generates and hosts a significant share of the world’s data, but its domestic data centre capacity remains comparatively limited. The Parliamentary Standing Committee on External Affairs has cited estimates that India accounts for nearly 20% of the world’s data but only 3% of global data centre capacity. However, the Ministry of Electronics and Information Technology (MeitY) has clarified that standard global datasets do not support the 20% figure and that the 3% figure is indicative rather than precise.
The Committee’s 17th Report, India’s Role in Global Tech Diplomacy, Digital Governance, Outer Space Diplomacy, AI and Emerging Innovations, presented in September 2026, examines the implications of this gap for India’s technology diplomacy, digital governance and national security. It considers where Indian data is stored and processed, the risks associated with offshore infrastructure, and the country’s framework for data protection and cybersecurity.
Where is Indian data stored? India stores and processes data across domestic and overseas infrastructure. The Committee identifies a gap between the volume of data India generates and the capacity of its data centres to store and process it. This gap means that a portion of Indian data is stored or processed outside the country. However, the report does not quantify the volume or proportion of Indian data held overseas.
The report places India’s domestic data centre capacity at around 520 megawatts (MW) in 2020, rising to approximately 1.5 gigawatts (GW) in 2025. It projects capacity to reach around 2 GW by 2026 and more than 8 GW by 2030. The main data centre hubs are Mumbai, Bengaluru, Hyderabad, Chennai and Delhi-NCR.
However, these figures require qualification. MeitY told the Committee that it does not officially maintain data on data centre capacity. Its response cites industry estimates showing growth from 375 MW in 2020 to more than 1,500 MW in 2025, while other sections of the report use 520 MW as the 2020 figure. The report therefore contains differing estimates. The Committee also notes that the IndiaAI Mission has onboarded more than 38,000 GPUs at subsidised rates to support domestic AI development.
Why is offshore storage a concern, and what happens after a breach? The Committee identifies three concerns arising from the domestic capacity gap: latency, cost and data sovereignty. When data is stored or processed outside India, the country’s ability to determine the strategic implications of that arrangement becomes important. The Committee has therefore asked the government to assess how much Indian data is held overseas and what this means for national security and sovereignty.
The report also identifies risks associated with AI systems, which rely on large volumes of personal and sensitive data. These risks include data breaches, privacy violations, unauthorised access and misuse. MeitY told the Committee that the government is addressing these risks through the India AI Governance Guidelines, 2025, secure data architectures, privacy-preserving technologies and cybersecurity measures.
India’s legal framework includes the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. The report says these are supplemented by sector-specific guidelines and regulatory oversight.
However, the report does not set out a separate procedure for investigating a breach involving an overseas server. Nor does it specify how Indian authorities would secure evidence from a foreign company or enforce action against an overseas entity in an individual case. Instead, it recommends that India strengthen international engagement on data protection and cross-border cooperation.
What are the four avenues for complaints? MeitY identifies four routes for handling complaints relating to unauthorised access to personal data, fraudulent financial transactions and data scraping:
- Sector regulators: Complaints can be taken to the relevant regulator, including those overseeing banking and telecommunications. The report also refers to sector-specific guidelines issued by bodies such as the Reserve Bank of India (RBI) and the Unique Identification Authority of India (UIDAI).
- National Cybercrime Reporting Portal (NCRP): The portal is listed as an avenue for complaints involving cybercrime, including relevant cases of unauthorised access and financial fraud.
- Indian Computer Emergency Response Team (CERT-In): The national cybersecurity agency is identified as another route for addressing cybersecurity-related concerns. MeitY also refers to cybersecurity directions issued by CERT-In.
- Platform-specific grievance systems: Users can raise complaints through the grievance mechanisms maintained by the digital platforms or services concerned.
What policy gaps has the Committee identified? The Committee’s recommendations focus on the lack of verified data about India’s data centre capacity and the need to assess the consequences of offshore storage. In Recommendation 36, it says infrastructure planning should not rely on industry estimates alone.
It recommends that the Ministry of External Affairs (MEA) work with MeitY and other ministries to establish the “systematic collection and publication of verified data” on data centre capacity, utilisation and growth. This information should guide international investment and technology partnerships.
In Recommendation 37, the Committee asks the government to assess the extent of Indian data stored or processed overseas and its implications for security and sovereignty. It recommends that the MEA coordinate with MeitY and other ministries to examine these strategic implications and identify partnerships that could address verified domestic capacity gaps. The Committee asserts that the gap will not close on its own through market forces and that capacity needs to “quadruple” to meet the government’s own projections.
Recommendation 38 addresses AI-related data protection. The Committee recommends that the MEA work with MeitY to advance India’s priorities in bilateral and multilateral discussions, including safeguards for cross-border personal data. It also calls for cross-border cooperation on breaches involving overseas entities.
Also read:
- MeitY maintains no official data centre records; Parliament panel asks MEA to seek verified data
- Data residency is not enough, says Airtel at IMC 2026, as Indian rules still focus on location
The post Where is India’s data stored, and what happens if it’s breached? Parliament’s External Affairs panel flags gaps appeared first on MEDIANAMA.