The issue has gained significance as governments worldwide seek secure locations to store critical data while retaining sovereign control over it.\u00a0
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t| Photo Credit:
\n\t\t\t\t\t\t\t\t\t\t\tVIJAY SONEJI<\/p>\n
Countries such as the UAE and Singapore have expressed interest in establishing data embassies in India. However, the government\u2019s ambition to position GIFT City as a hub for foreign government data repositories faces a key legal challenge: the absence of a framework that provides protection to sovereign data comparable to diplomatic immunity.<\/p>\n
Legal experts with operations in GIFT City, including Cyril Amarchand Mangaldas and Khaitan & Co, said India currently lacks a dedicated legal framework defining the status of data embassies and providing enforceable safeguards for the data, systems and premises hosted in the country. They noted that foreign governments would require clear and binding protections covering issues such as search, seizure, interception, government access and jurisdiction before placing sensitive sovereign data in India.<\/p>\n
\u201cSeveral countries, including Singapore and the UAE, have shown interest in setting up data embassies in India. However, the single biggest hurdle remains the absence of a dedicated legal framework that grants data embassies formal recognition and provides the premises and data stored within them inviolability and immunity from Indian laws governing search, seizure, interception, requisition or other forms of access by domestic authorities,\u201d Ketaki Mehta, Partner, GIFT City, at Cyril Amarchand Mangaldas, told businessline.<\/p>\n
The issue has gained significance as governments worldwide seek secure locations to store critical data while retaining sovereign control over it. While International Financial Services Centres Authority (IFSCA) did not respond to queries on the matter, Mehta said treaty-backed legal protections would be essential to address concerns relating to data confidentiality, ownership, storage arrangements and exemptions from local laws.<\/p>\n
\u201cThe global precedent, such as the Estonia-Luxembourg model, relies on a bilateral agreement that extends protection to the data embassy even though it is not a traditional diplomatic mission,\u201d she said. \u201cEquivalent guarantees regarding access to data and exclusive control are necessary to ensure the security of highly sensitive sovereign assets,\u201d she added.<\/p>\n
The Estonia-Luxembourg arrangement is widely regarded as a benchmark for protecting sovereign data stored outside a country\u2019s physical borders. Under such arrangements, the legal status of the data, the premises housing the infrastructure and the rights of the participating countries are clearly defined through bilateral agreements.<\/p>\n
According to US-based business and technology research firm Gartner Inc, at least 15 per cent of nations in geopolitically volatile regions are expected to establish formal data embassy agreements by 2029, as governments seek to ensure continuity of critical state services amid rising geopolitical instability, growing cyber threats and risks associated with concentrating data within national borders.<\/p>\n
The Indian government first announced plans to facilitate data embassies in GIFT IFSC in the Union Budget 2023. The Interim Budget for 2024 further stated that such facilities would primarily be enabled through bilateral agreements. The IFSCA has since submitted a framework and concept note, including a draft MoU, which remains under examination by the central government, according to legal experts.<\/p>\n
Supratim Chakraborty, Partner at Khaitan & Co, said the challenge for India lies not in infrastructure but in legal certainty. \u201cIn response to changing geopolitical and regulatory realities, the global conversation has shifted away from the assumption of frictionless cross-border data flows towards trusted data flows. Under this framework, countries increasingly expect robust privacy protections, national security safeguards, regulatory certainty and predictable government-access rules before permitting critical governmental data to be hosted abroad. In this environment, data embassies may become even more relevant,\u201d Chakraborty said.<\/p>\n
He added that India\u2019s existing laws, including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, were not specifically designed for sovereign data embassies and do not clearly define how such facilities would interact with domestic legal and regulatory requirements.<\/p>\n
Experts said data embassies may not require full diplomatic immunity under the Vienna Convention on Diplomatic Relations. However, they would require functional immunity for the premises, information systems, equipment, communications, archives and sovereign data stored within them.<\/p>\n
Khaitan & Co suggested that India could consider establishing a \u201cdigital inviolability\u201d framework. \u201cUnder such a framework, India would retain territorial sovereignty and continue to regulate matters such as physical infrastructure, utilities and public safety. However, the sovereign data and information systems housed within the data embassy would remain under the exclusive legal control and jurisdiction of the home state, subject only to mutually agreed access mechanisms,\u201d Chakraborty said.<\/p>\n
The legal architecture for data embassies is also expected to involve multiple government agencies. Experts said Parliament would need to provide the legislative foundation, while the Ministry of External Affairs would likely lead bilateral treaty negotiations. MeitY would play a key role in data governance and cybersecurity standards, while IFSCA could oversee implementation within GIFT City.<\/p>\n
Copyright\u00a9 2026, THG PUBLISHING PVT LTD. or its affiliated companies. All rights reserved.<\/p>\n