India has begun consultations with global technology companies including Google, Amazon Web Services (AWS) and Apple as it works on a framework for a sovereign cloud for government data, people familiar with the matter said.
AWS and Google Cloud are among the world's largest cloud service providers, while Apple is one of the world's largest technology companies with substantial cloud infrastructure. All three are US-based companies.
India remains heavily dependent on US technology companies for cloud infrastructure. AWS, Microsoft Azure and Google Cloud are among the dominant providers serving Indian businesses and government-linked workloads, making control over critical infrastructure a central issue in the sovereign-cloud exercise.
A preliminary proposal has been drawn up by the Ministry of Electronics and Information Technology (MeitY). The next step is consultation with government ministries, which is likely to begin shortly, the people familiar with the matter said. A wider public consultation is expected in the next few months. The proposal seeks to define what constitutes a sovereign cloud, which government data should be hosted on it and what conditions cloud companies must meet to qualify.
"Companies such as Google, AWS and Apple can be consulted on the technology, architecture and security requirements, but the final product has to be indigenous to protect sovereign data," one person familiar with the matter said.
"India can, and should build its own sovereign cloud. Usage, limitations not just in terms of storage but use of such stored data, accessibility and availability will primarily decide if a cloud is truly sovereign," said NS Nappinai, Senior Advocate, Supreme Court and Founder of Cyber Saathi. "Protection as with any cloud platform will depend on the security frameworks and good practices adopted. Any data that impacts national security ought to be kept exclusively on sovereign cloud. There is no dearth of capability in India to Make in India. Whilst such indigenous initiatives should not be restrained from resorting to existing technologies globally, subject to the same not causing vulnerabilities,"
The proposed sovereign framework would impose a higher threshold on providers. People familiar with the proposal said companies would have to satisfy four broad parameters: legal safeguards, technological capability, operational capability and a Make in India component.
"There are around 46 safeguards under those four broad categories," the person said. "The objective is to assess not just where the servers are located, but who controls them, how they are operated and how much of the technology and supply chain is under Indian control."
MeitY has 29 empanelled companies that are expected to be eligible to bid under the proposed framework, the people said. The list includes domestic providers such as Jio Platforms, Yotta Data Services, Tata Communications, Sify and CtrlS.
The government's consultations with Google, AWS and Apple are intended to draw on expertise in cloud architecture, security and operations. The framework is being designed to determine which elements can be sourced from global technology companies and which must remain under Indian ownership and control.
The scale of the data involved is already substantial. The National Informatics Centre's National Data Centres have about 100 petabytes of storage capacity and around 5,000 servers supporting government cloud workloads, according to MeitY's 2024-25 annual report. More than 28,855 virtual servers had been provisioned for over 1,917 users and applications.
The infrastructure supports a wide range of government systems. MeitY's classification framework identifies Aadhaar, e-Courts, PAN, passports, railways, tax systems, UPI and voter ID among applications and datasets that can affect national security, financial interests or operational stability. It also identifies state-level systems including CCTNS police databases, jail records, land records, land registration, revenue courts and treasuries.
The government does not publish one consolidated figure for the volume of data held across these systems. The individual platforms give an indication of the scale. As of June 2024, India had generated 138.34 crore Aadhaar numbers. UPI had processed 24,100 crore transactions. DigiLocker has more than 72.43 crore registered users, according to government data from July 2026. The platform has become a repository for documents ranging from driving licences and educational certificates to insurance and government records.
Other government databases hold information that is more sensitive. Tax systems contain financial and income records. Passport databases contain identity and travel information. Police systems contain criminal and investigation records. Health platforms contain vaccination and other health information. Banking and payments systems contain transaction and financial data, although much of the banking infrastructure is operated outside the government cloud environment.
The proposed sovereign cloud is not intended to put all of this data onto one government server. The proposal is expected to classify workloads according to their sensitivity, likely ministry, and prescribe different levels of protection. "A sovereign cloud is not simply a data centre in India," another person familiar with the discussions said. "It is about who controls the infrastructure, who can access the data, which law applies, who operates the systems and whether the technology and supply chain can be trusted."
Existing government cloud infrastructure already has multiple security measures. MeitY says NIC systems use multi-layered access mechanisms to prevent unauthorised access and protect sensitive and personal information. Its National Data Centres have disaster-recovery arrangements, while the Delhi and Bhubaneswar centres are ISO 27001 certified.
Cybersecurity incidents show the limits of infrastructure alone. CERT-In has documented phishing campaigns targeting users of the government's email.gov.in service. In one campaign, attackers created websites resembling the NIC email service to steal government officials' credentials. Compromised accounts were then used to send malware-containing emails to other government organisations and users.
Other countries are pursuing similar models. The European Union is developing sovereign-cloud procurement standards covering legal jurisdiction, data, technology, operations and supply chains. France has its SecNumCloud framework for sensitive workloads, while Brazil is developing a national cloud aimed at retaining domestic control of infrastructure and data.
The idea builds on a government cloud programme that began in 2014, when the National Cloud was launched under MeghRaj. The initiative was intended to give government departments access to computing, storage and software services on demand. By June 2026, MeghRaj was being used by 2,323 government departments, compared with 342 in 2015-16. It supports platforms including DigiLocker, MyGov and the National Scholarship Portal.
Track Latest News Live on NDTV.com and get news updates from India and around the world
