India's data-localisation debate usually concerns what the law says about where data may go. The question of where the data sits, and who clears the building it sits in, gets much less attention. On 14 October 2026 NITI Aayog's Frontier Tech Hub published a Data Centre Evaluation Framework, which speaks to the second question. All India Radio's report describes it as a decision-support tool for states, developed in consultation with the Ministry of Power and MeitY, and explicitly not another layer of regulation.
The framework does not discuss localisation. It still matters for the localisation debate, because in-country storage needs in-country buildings, and those buildings need power, water and permits.
What the framework asks for
As Outlook India summarises it, the document is organised around five pillars: power and energy, water and cooling, siting and environmental sustainability, economic and strategic value, and governance. Its main recommendations are:
- Additional electrical load should be approved only after the needed infrastructure is commissioned and agreed milestones are met.
- Facilities above 20 MW should be demand-response ready, with telemetry linked to State Load Dispatch Centres.
- Water availability should be assessed as a 20 to 30 year seasonal catchment balance. Recycled water should count only when it is contracted, connected and available.
- States should identify data-centre-ready zones and restrict development in high-risk areas, and large campuses should undergo a community impact assessment.
- Public support such as land, power-duty and stamp-duty relief should be quantified and tied to measurable outcomes.
- Approvals should run through a time-bound single-window system, backed by a centralised audit with MeitY as nodal ministry.
The release is dated 14 October. Coverage of the document varies slightly in the detail it reports, and I could not retrieve the NITI Aayog PDF directly, so the specifics above rest on the two news reports.
The case for strict control
The strongest argument for heavier rules is that data centres are not ordinary buildings. Outlook cites an estimate that a single AI data centre could use up to 20 lakh litres of water a day, though actual use varies. It also reports that Visakhapatnam alone has about 6,500 MW of proposed capacity, which experts want independently assessed. India's current capacity is about 1.4 GW, so approving projects on paper that the grid and aquifers cannot serve would strand investment and harm local communities. A regulator who demands proof of power and water before approval is not being obstructive.
Why guidance beats a mandate
The framework takes the approach that fits this problem. It is a template that states can adapt, not a statute. States differ sharply in grid strength, water stress and appetite for investment, and a single national rulebook would fit few of them. Publishing every clearance, fee and timeline in one portal also attacks the cost that most affects operators, which is uncertainty. Predictable approvals do more for domestic capacity than any mandate to store data locally.
That is the relevant contrast with the legal side. Section 16 of the Digital Personal Data Protection Act, 2023 takes an open-by-default approach: as PRS Legislative Research describes it, personal data may be transferred abroad except to countries the Centre restricts by notification. The Act passed Parliament in August 2023. Under the Rules notified on 14 November 2025, SCC Online reports, significant data fiduciaries must keep specified personal data and related logs in India unless transfer is allowed. Other cross-border transfers must meet conditions the Centre may specify. The relevant rules take effect eighteen months after publication, which on my reading is around May 2027.
India's model is therefore targeted localisation, aimed at the largest fiduciaries and at categories the Centre specifies. It is lighter than blanket mandates elsewhere in Asia-Pacific. Targeted localisation still needs somewhere to put the data, and the framework is about making that somewhere buildable.
Where the risks lie
The first risk is that guidance is optional. A state that skips the approval matrix or the community impact assessment loses nothing legally, and a state eager for investment may relax the power and water checks. That would reproduce the problem the framework describes.
The second risk is mission creep through the central audit. If MeitY's audit of operators' capacity and sustainability claims became a licensing gate, it would become a new compliance layer on top of the DPDP duties. The more the audit looks like certification, the more it will raise costs for the smaller domestic operators that localisation is meant to help.
The third risk is ambiguity about which cross-border conditions will actually apply. Until the Centre specifies its Section 16 restrictions and the significant-fiduciary data categories, operators cannot size in-country capacity against a known legal requirement.
What to watch
The test is whether states adopt the framework in practice, and whether MeitY keeps the audit advisory and transparent. Policymakers across Asia-Pacific should note the sequencing. India is building the infrastructure-governance layer before it has finalised the transfer rules, which is a sensible order if the framework stays a tool for faster, clearer approvals and does not become a second regulator.