India's Parliamentary Standing Committee on External Affairs has pointed at something real: the country's data-centre capacity does not match the data its people generate, so some Indian data is stored or processed abroad. The 17th Report, presented in September 2026 and covered by MediaNama on 15 October, asks the government to measure the problem before it legislates around it. That is the right instinct, and the strongest part of the report. The weaker parts are the numbers it leans on and the enforcement question it leaves open.
The case for the Committee's concern
The steelman is straightforward. A state that cannot say where its citizens' data sits cannot credibly promise to protect it. If a breach hits a server in another jurisdiction, Indian investigators depend on foreign courts and foreign companies. Sovereignty arguments about data are, at bottom, arguments about who can compel evidence and who can impose penalties. A Committee looking at foreign policy is entitled to ask whether India's digital diplomacy is working from a sound factual base.
The numbers do not hold up
The report cites estimates that India accounts for nearly 20% of the world's data but only 3% of global data-centre capacity, as MediaNama reports. MeitY told the Committee that standard global datasets do not support the 20% figure, and that the 3% figure is indicative rather than precise. MediaNama also reports that MeitY said it does not officially track capacity. It relies on industry estimates of 375 MW in 2020 and over 1,500 MW in 2025, while other parts of the report use 520 MW for 2020.
That matters because the Committee's headline conclusion is that capacity must "quadruple" to meet the government's own projections, and that market forces alone will not close the gap. A multiplier is only as good as its baseline. When the ministry responsible cannot say what the baseline is, "quadruple" is a rhetorical target, not a planning number. The Committee did not quantify how much Indian data is held overseas, so the gap it describes is asserted, not measured.
The claim that markets alone will not close the gap is also untested. Capacity reportedly grew from 375 MW to over 1,500 MW in five years on industry estimates, roughly fourfold. If those figures are even approximately right, the market has already delivered a quadrupling once. Whether it can repeat that depends on power, land and connectivity, which are infrastructure and permitting problems rather than reasons for a mandate.
What the recommendations actually ask for
The recommendations are more measured than the framing. Rec. 36 asks MEA, working with MeitY, to collect and publish verified capacity, utilisation and growth data rather than rely on industry estimates. Rec. 37 asks the government to assess how much Indian data is stored or processed overseas and what that means for security and sovereignty. Rec. 38 asks MEA and MeitY to press for cross-border safeguards on personal data in AI discussions and for cooperation on breaches involving overseas entities.
Sequencing here is sensible: measure, then decide. A pro-innovation reading welcomes it. Localisation mandates written before the data exists tend to raise costs for startups and smaller firms, which cannot absorb duplicate infrastructure the way large platforms can. India's existing law already points the other way. As PRS Legislative Research describes the Digital Personal Data Protection Act, 2023, it permits transfers abroad except to countries the central government restricts by notification. An open-by-default regime with targeted exceptions is the proportionate design, and the Committee's recommendations do not propose abandoning it.
The gap the report leaves open
The most consequential omission is procedural. MediaNama notes that the report sets out no separate procedure for investigating breaches involving overseas servers, and does not explain how Indian authorities would obtain evidence from a foreign company or enforce action against an overseas entity in an individual case. Its answer is more international engagement.
That is a diplomatic aspiration, not a mechanism. The report describes complaint routes through sector regulators such as RBI and UIDAI, the National Cybercrime Reporting Portal, CERT-In and platform grievance systems. CERT-In's April 2022 directions, which require incident reporting within six hours, already bind entities operating in India regardless of where their servers sit, according to law-firm summaries. The real gap is cross-border evidence-gathering, which is a question of mutual legal assistance and bilateral agreements, not rack space in Mumbai.
This is where the Committee's two threads should connect. If the worry is breach response, then building domestic capacity is an indirect and expensive remedy. A narrower toolset would do more: clear evidence-request protocols with major hosting jurisdictions, local points of contact with legal accountability, and published statistics on how often cross-border requests succeed. Hosting data at home does not guarantee that a domestic company's breach is investigated well, and hosting abroad does not make it uninvestigable.
Related fault lines
The same week produced reminders of how India's digital-governance tools are used. MediaNama reported that the Ministry of External Affairs told the Committee India has no stand-alone policy document consolidating digital governance, AI, cyber and space diplomacy. Separately, the Kerala High Court gave the government four weeks to respond to a challenge to the blocking of BitChat, which the petition says did not follow the 2009 blocking rules. Strategy that is scattered across missions and mechanisms is the context in which sovereignty arguments get stretched to cover almost anything. I found no October 2026 action on the IT Rules themselves.
What to watch
The test is whether the government accepts Rec. 36. Publishing verified capacity numbers would settle the 20% and 3% dispute and expose any gap between rhetoric and reality. If the figures show rapid private-sector growth, the case for mandates weakens. If they show a real shortfall, the policy response should be power, land and permitting reform, plus a cross-border evidence framework, before any localisation requirement. Evidence first, instruments second: the Committee asked for the first step. The government should take it before anyone acts on the second.