Regulatory Lacunae In Indian Data Centre Governance
Author: LawSphereX
Category: Administrative & Regulatory Law
Published:
Updated:
REGULATORY LACUNAE IN INDIAN DATA CENTRE
GOVERNANCE Sonakshi Gopi, School of Law, Christ (Deemed to be University) Prashanth Sabeshan, Dentons Link Legal
1. Introduction
To call the twenty-first century an era of hyper-digitalisation would be an understatement. Technology has permeated almost every aspect of daily life, from adjusting ambient temperature to hosting boardroom meetings. The rapid pace of technological revolution and integration is in no danger of losing momentum - the drive for such innovation has become constant and relentless. To support this surge in use and rise in demand for technology, there is a need for robust data centres. Data centres house the computational infrastructure of a company. While most offices have dedicated in-house spaces for their IT equipment, with data localisation norms and the growing bandwidth to cater to customers across national borders, independent data centres have become an infrastructural necessity. Consequently, this requires an equally potent regulatory framework for their establishment and operation.
With 151 data centres, Meta planning to set up a data centre exclusively to meet growing demands for Instagram reels and AdaniConneX securing a $ 1. 44 billion loan to build data centres, it’s safe to say that the sector is experiencing an unabated boom in India. This paper aims to highlight some of the gaps in data centre regulation in India and potential considerations for resolving them. The gaps identified are from policy, IT, foreign investment, telecom, energy and real estate standpoints.
2. Regulatory and policy standpoints
While the MEITY released a Draft Data Centre Policy in 2020, India does not have a comprehensive national framework to synchronise and simultaneously regulate the establishment of data centres and the various sectors that collectively constitute a data centre’s construction and operation.
At present, a host of laws need to be separately compiled with each infrastructural sector’s specific regulations. For instance, from an infotech standpoint regarding the computational equipment housed in a data centre, operators must adhere to the requirements under the IT Act
2000 (and its allied Rules) and the DPDP Act 2023. This reflects the regulatory trend prevailing
in the infrastructure sector - the absence of overarching legislation and the sub-sectoral approach (each sub-sector has its framework) due to the quasi-federal governmental set-up in India. The scope for legislative jurisdiction of both the central and state governments has been clearly outlined in the Union, State and Concurrent Lists under the Seventh Schedule of the Constitution. Some semblance of regulation is provided by the catena of state data centre policies, with each providing its own unique set of incentives and offerings for the establishment of data centres within their respective territories. As of 2024, the following states have notified their policies - Andhra Pradesh, Odisha, West Bengal, Karnataka, Tamil Nadu, Telangana, Uttar Pradesh and Haryana.
Each policy contains subsidies for land and infrastructure, power, network connectivity, labour law benefits, tax holidays and approval mechanisms. A potential hiccup may manifest when a national data centre policy is enacted while the various state policies remain operational. Contrasting incentives between these policies might need to be discarded, harmonised or modified as circumstances may dictate.
3. IT standpoint
Prior to the introduction of the Digital Personal Data Protection Act in 2023 (“DPDPA”), the corporate cyberspace was governed by the Information Technology Act, 2000 and its allied Rules. With both laws in effect, companies are now bound by two sets of consumer data protection obligations, which sometimes overlap and require clarification. This section aims to highlight this legislative overlap and lay down the new implications stemming from the DPDPA for (a) data sovereignty, transfer and localisation and (b) the banking and financial sector. (a) Overlap between DPDPA and IT Act 2000 The DPDPA classifies body corporates between ‘data processors’ and ‘data fiduciaries’, subject to data usage, as separate sets of obligations. Section 8 of the Act provides that only data fiduciaries are statutorily obligated to compensate data principals for data breaches.
Companies may be fiduciaries or processors, depending on whether they set up the data centres or entrust that responsibility to a third party. Even if a Data Centre was set up and operated by a thirdparty processor, a data fiduciary will remain responsible for complying with the provisions of the law, including concerning any processing undertaken on its behalf by a data processor. Depending on the terms of their data processing arrangement, contractual liability may be accorded to the processor to indemnify the fiduciary in the event of a data breach. On the other hand, the IT Act requires body corporates to pay compensatory damages for failure to protect personal sensitive digital data, breach of confidentiality and the unauthorised disclosure of personal information under sections 43A and 72, respectively.
This Act does not categorise body corporates based on data usage and imposes the same onus of data protection and liability for any breach thereof on all companies. The question before the appropriate legal authorities would be to determine under which of the two laws a Data Centre would be held liable for a personal data breach. With the imminent notification of Rules under the DPDPA and potential future AI regulations, there could be altered or additional obligations for data centre operators. (b) Implications (i) Cross-border data transfer, data localisation and data sovereignty Companies must set up data centres within the Indian customer service jurisdiction to adhere to data localisation and sovereignty requirements in the DPDPA. While not applicable to foreign personal data processed in India, data generated by Indian principals must be stored on local servers.
Barring exceptions under Section 17 of the Act, any transfer of data overseas for processing may be restricted subject to Government of India notifications, such as a negative list of nations to which transfers are not permissible. The Union government is even empowered to exempt certain or certain classes of data fiduciaries from most requirements of the Act on certain grounds, such as to preserve India’s sovereignty and integrity. (ii) Implications for the financial sector/RBI policies for banks and NBFCs on data storage or processing. Banks, NBFCs and fintech companies may be fiduciaries or processors subject to whether they set up the data centres or entrust that responsibility to a third party, as in the case of nonbanking/non-financial companies.
Generally, for the banking system, mainframes are set up by the banking company in a few countries, and edge data centres in other nations are set up by a third party that is outsourced to by the bank. Apart from the data localisation and sovereignty requirements in the DPDPA, banking/nonbanking companies must comply with the Payment Data Storage Mandate issued by the RBI. It requires all system providers to ensure that all data relating to payment systems operated by them is stored in a system only in India, except in specific cases. This data should include endto-end transaction details, and payment or settlement transaction information gathered / transmitted / processed as part of a payment message / instruction. In the case of foreign banks concerning domestic payment transactions, the data shall be stored only in India.
In contrast, the data may also be stored abroad for cross-border transactions. In its publication on Green Data Centres (GDCs), the RBI highlighted incentives under various state policies for green initiatives and recognised efforts by banks to set up GDCs like ICICI, HDFC, and Kotak Mahindra. This publication also suggested measures that could be undertaken to make data centres eco-friendly, such as acquiring LEED certification, using renewable energy, and using smart lighting solutions for office spaces.
4. Telecom sector standpoint
With networks forming an integral part of a data centre’s infrastructure, the telecom sector will be saddled with legal considerations such as right-of-way permissions, uncertainties under the nascent Telecommunications Act 2023, the capacity of the current network system, etc. As businesses and individual consumers adopt data-intensive technologies such as cloud computing, AI and IoT, coupled with the growing demand for digital services, the strain on existing telecom networks will intensify. There are also lingering issues of gaps in connectivity, especially outside urban areas, which could lead to bottlenecks and performance issues, hindering the efficiency to support the growing demand for high-bandwidth connectivity of data centre operations.
Telecom companies will need to invest in advanced networking technologies, such as 5G and fibre optic networks, to enable faster and more reliable data transmission. Furthermore, they must collaborate with data centre providers to ensure seamless integration and compatibility between their respective infrastructures.
The Telecom Act is silent about regulations regarding data traffic management, security audits for data centres, and CTI compliance, which could create challenges for the sector. Given the highly regulated nature of this sector, TRAI and DoT may have to devise a separate licensing mechanism for data centre operators, streamline the process for ‘Right of Way’ permissions and facilitate smooth cooperation with data centre operators by laying the framework on matters such as interconnection charges and peering arrangements. There is also an opportunity to capitalise on the existing optic cable networks by mandating that data centre operators seek lease agreements with the owners of presently unutilised dark fibres before approaching the appropriate regulatory authority for new cabling permissions.
5. Investment standpoint
The Indian government’s decision to grant infrastructure status to data centres is a positive step. This allows data centre companies to easily access credit at lower rates and attract foreign investment. However, the lack of a clear definition of a “data centre” creates classification challenges under the existing Foreign Direct Investment (FDI) policy (updated Oct 2020). For instance, it’s unclear if data centres qualify as real estate projects, and even if they do, can foreign investors still invest in the IT, energy, and battery storage components crucial for their operation? The current policy might force data centres to categorise their various infrastructure components (physical structure, energy, IT) under separate sectors, potentially hindering foreign investment opportunities.
Since local capital might not be sufficient for this growing sector, access to foreign equity (FDI) and debt (ECBs) is crucial. A precise categorisation that acknowledges the unique combination of physical, energy, and IT infrastructure within data centres is needed to streamline FDI and ensure this sector thrives. Since this is a growing sector, the cheaper cost of equity funding and debt availability will help this sector, just like the government did for the start-up sector.
6. Energy standpoint
Globally, data centres collectively consume 1% of the total electricity produced, exceeding that of some Latin American and African nations. With an average electricity consumption of 1000 kWh, data centres require an extensive power infrastructure to cater to the round-the-clock energy demand. This typically comprises an onsite power generator, captive power plant, or electricity connection from an external power line and backup generators to keep the servers running and constantly regulate system temperatures. With rampant technological innovation and digitisation, this energy demand is set to increase so much that there are talks of in-house nuclear reactors becoming an infrastructural necessity for data centres! This presents a unique opportunity to undertake green energy projects, with an added layer of government support through various policies and incentives.
These incentives typically revolve around green power tariff concessions, OPAC facilities, electricity duty waivers, etc. This segment of the article lays down the scope for opportunities and concerns with respect to data centres and OPAC, captive power plants, carbon trading and RPOs and backup and battery storage systems from the (a) energy consumers and (b) energy suppliers’ standpoints
7. Data centres as energy consumers
Most State policies offer incentives through tariff concessions/reimbursements, power bill subsidies [especially when bought from state-owned gencoms], electricity duty waivers and dual grid line connectivity. Due to the absence of a regulatory regime in India mandating green energy usage in DC operations beyond RPOs, the following incentives are offered to harness renewable energy - green power tariff concessions when a certain percentage of total power consumption is from a green energy source and for when renewable energy procured directly from power producers in the State through an open access system. Another incentive is installing adjunct captive power plants, especially to harness solar energy. Along with the concessions offered in the various policies, other incentives, such as the PLI for Solar Modules, can also be availed.
However, this is partly hindered by the non-availability of land subsidy for its construction and the investment-related requirements under the amendment to Rule 3 of Electricity Rules requiring each captive user to hold 26% equity in the power plant individually, among other requirements. Beyond the power generation portion of the infrastructure, there is a need for a robust backup power system - generally a combination of batteries and generators. Due to their highly flammable natures, the present green options pose a significant safety hazard, prompting the use of diesel-powered mechanisms or leaded batteries.
(a) Distribution companies and generation companies as energy suppliers The main challenge for energy suppliers is to provide uninterrupted power supply 24/7 since data centres are round-the-clock operations. Suppliers’ investment in grid connectivity is mitigated since most state governments intend to make provisions for dual grid power lines, as mentioned in their respective policies. Given the primacy awarded to renewable power generation in the various state and national data centre policies, distribution companies and generation companies can capitalise on the clean energy momentum and enter into long-term renewable energy PPAs with data centre operators.
However, these conventional energy producers and distributors face supply competition from captive power plants set up by the centre operators and data centre park developers who are eligible to get a licence for green power energy distribution and consumption within the parks. (b) Going green - the scope for a clean energy push, carbon trading and enforcing RPOs Given its inherently power-guzzling nature, the data centre sector is presented with a unique opportunity to be powered entirely by clean and sustainable sources of energy. Even without a legal mandate to utilise green energy undertaking, it behoves data centres to actively participate in the nascent carbon and renewable energy trading systems in light of the massive power demands and looming climate change concerns.
If any data centre operators have previously purchased Renewable Energy Certificates, they could be traded out with the new carbon credit system. While state data centre policies at present make no such provisions, in the future, state governments could incorporate renewable purchase obligations on local data centres as a part of state renewable policies. This could manifest contractually in power purchase and connectivity agreements with third-party energy suppliers who are supplying clean energy or encourage data centres to set up their own green energy-based captive power plants.
8. Real estate standpoint
While data in itself is intangible, the millions of gigabytes of data generated regularly require an elaborate infrastructure for processing, management and storage. This has allowed data centres to emerge as a distinct real-estate sub-sector in India, with more than 500 acres of land being acquired in 2022 alone to construct new data centres. The country’s data centre stock is predicted to rise to 20 million square feet by 2025. The construction of the data centres itself is a niche sector that can spur job creation across skill levels across the country. The final segment of this article focuses on real estate interests and opportunities in the data centre sector, as well as special construction requirements.
(a) Why data centres are of interest to and present opportunities for real estate companies/investors: (i) Demand for setting up data centres and government support The COVID-19 pandemic further bolstered the popular trend of digitisation. There was an increased consumer demand for digital services, offices experimenting with hybrid work models, technological advancements in the form of 5G and IoT and AI adoption, and new data privacy laws instituting localisation requirements. More data centres needed to be set up to cater to the increased demand for digital services, consequently requiring extensive land acquisition for their construction. Support from the central and local governments has been embodied in the various data centre and IT policies rolled out over the last decade. These policies offer a host of financial and non-financial incentives.
Concerning land acquisition, there are provisions for designated land parcels, setting up Data Centre Economic Zones (DCEZs)/ Data Centre Parks (DCPs) and land subsidies. (ii) The emergence of data centres as a new real estate asset class and the types of data centre real estate Data centres form part of the real estate alternative asset class, which includes co-living and co-working spaces. While having largely proved their mettle due to consistently high returns, similar to utility companies, the high interest rates raising the cost of funding has been a significant investment obstacle. However, the rising demand for new data centres has created more opportunities in the fragmented prefabrication and modular sector - enabling part of the construction process to be off-site. There are three main types of data centre real estate.
First, colocation facilities rent hardware and servers to smaller companies, housing multiple companies’ IT infrastructure under the roof.
Second, cloud or hyper-scale facilities exclusively store the data for one company. Third, edge data centres are smaller facilities that are located near end-users. There have been juxtaposing trends of shifting from captive to colocation data centres while some tech giants are bent on constructing their own mammoth-sized operations. Smaller enterprises remain dependent on specialist services. (b) Specialised construction requirements for data centres Unlike conventional residential and commercial properties, data centres have unique construction requirements given the nature of the housed infrastructure, the type of users and the various financial models to utilise such centres as hyper scalers, colocation and edge centres.
Furthermore, even the manner of tabulating rental costs varies from that of traditional properties - the amount payable is generally determined based on energy consumption as opposed to area square footage. The various state and national data centre policies each provide their building criteria to adhere to. For instance, the National Draft Policy suggests that data centres should be located on the first floor of a building, approximately 4000 square feet, and that the power panel should be capable of operating at 420V. Additionally, while selecting a site to construct a data centre, considerations such as the risk of natural disaster occurrences, availability of financial incentives such as land subsidies, energy supply and proximity to users need to be factored in.
9. Conclusion
Data centres impact many sectors, so they must be synchronised. Data storage and processing requirements will only grow, and special incentives will be needed to meet the demand. It is critical to ensure that contrasting incentives between these policies are addressed and that legislative clarity from the foreign investment, IT, and telecom standpoints is sought. Setting up green edge or colocation data centres may be the catalyst for the clean energy transition India needs while also being tenable on a real estate front.