Airtel’s Chief Business Officer Abhishek Biswal said at India Mobile Congress 2026 that storing data on servers in India alone does not ensure data sovereignty. Speaking on October 7 in New Delhi, Biswal emphasized that true sovereignty also depends on an organisation’s ability to access data without interference from foreign governments, highlighting limitations in current Indian data localisation rules, according to medianama.com.
Biswal explained that several Indian regulations, such as the Reserve Bank of India’s 2018 directive and CERT-In’s 2022 guidelines, focus primarily on where data is stored rather than who controls access. For example, RBI mandates payment system data be stored in India, while CERT-In requires system logs to be kept domestically for 180 days. However, CERT-In’s FAQs allow logs to be held abroad if they can be promptly produced on demand. The Digital Personal Data Protection Act, 2023, includes provisions to restrict data transfers to notified countries, but these come into effect only in May 2027.
The issue of access control gained prominence when Microsoft suspended Outlook and Teams for Nayara Energy in July 2025, citing EU sanctions, before restoring services shortly after. This incident underscored the risk that foreign governments or companies could restrict access to data even if it is stored in India. Biswal’s remarks highlight the need for Indian data policies to address not just localisation but also control and accessibility to ensure genuine data sovereignty.
The Digital Personal Data Protection Act’s Section 16, which will empower the government to restrict cross-border data transfers, is set to come into force on May 13, 2027, marking a key date for India’s evolving data governance framework.