India's sovereign cloud debate moves from where data sits to who controls it

A Deloitte report, covered by CIO&Leader on 16 October 2026, argues that Indian cloud buyers should look beyond data residency. Its line is that sovereignty is proven by evidence, not labels.

The eight things to prove

The report sets out control over data, compute, admin access, encryption keys, legal protection, resilience and exit. Customer-held keys, tamper-proof logs and a tested exit plan are examples of the evidence it suggests.

Two risks it highlights

• Service cut-offs. A provider's decision can stop operations even when residency rules are met. Contracts should limit unilateral suspension and require recoverable backups.
• Overseas compute. Data kept in India but processed on overseas GPUs is not the same thing. Sensitive AI workloads should show where the compute is.

The report cites a public cloud market of US$10.9 billion in 2024, expected to reach US$30.4 billion by 2029. It accepts that stronger controls can add cost and complexity.

Sample story, checked against the source on 17 October 2026. Confirm details with the source before you rely on them.

Source: CIO&Leader