Top tech companies deliver excellent new products as India tightens data rules: compliance as a service
Data Compliant Data (CAA) data refers to a model in which third-party service providers ensure that companies comply with Indian data regulations and compliance requirements.
Although the Digital Personal Data Protection (DPDP) Act 2023 does not require strict data localization, it is expected to significantly impact the landscape as data and metadata develop within India. Industry service providers expect data localization requirements to gain momentum due to increased privacy, security and national interest issues.
The DPDP ACT rules are expected to be notified later this year. This follows the 2018 Reserve Bank of India (RBI) Directive, which stipulates that all banks store data within India.
“We are embracing data sovereignty and are clearly leading the game to ensure that the entire data framework and data grid architecture enables metadata to live within the country,” Neelakantan Venkataraman said.
Tata Communications caters to large companies and small and medium-sized enterprises (small and medium-sized enterprises), which is a huge opportunity.
Venkataraman said many people think that India’s data is completely sovereign. Nevertheless, metadata, including privacy and PI (personally identifiable information) data, cannot be considered true sovereignty.
He added that more than 600 companies currently use Tata Communications’ cloud solution services. In its fiscal 2023-24 report, Tata Communications recorded ₹Data revenue was 171.81 million, including cloud services, as part of its broader digital offerings.
“I would say that there is not even a single data that should be moved out of the country,” he added.
Neelakantan further stated that rooting the entire technology stack in local data is crucial to establishing a generative AI model.
Data storage compliance
The Yotta data service owned by the Hiranandani Group has expanded its data center park nationwide. It is expected to meet the growing demand for compliant data storage, for businesses, regulated sectors, and for small and medium-sized enterprises (MSMES) (MSMES).
“We are consciously helping India achieve data sovereignty,” said Sunil Gupta, CEO and co-founder of Yotta Data Services.
Big tech companies such as Amazon, Microsoft, Google and Meta are worried that strict data localization will increase costs, complicate global operations and fragment the Internet. Some companies have partially complied by setting up local data centers (e.g., AWS expanded its presence in India, and Microsoft launched Azure in India). Others expressed concerns about strict rules, believing that cross-border data flows are crucial to innovation, global services and the digital economy.
Smaller players like digiboxx also offer cloud storage and enterprise backup solutions within India to meet growing business needs. Although security is not only determined by data location, local storage options have become increasingly popular due to localization requirements, such as those required by RBI. These tasks allow companies in various industries to choose local storage.
Digiboxx CEO Arnab Mitra toldMintFrom a national security perspective, data can be vulnerable to foreign surveillance and abuse.
“In many ways, local storage ensures that India has complete legal and operational control over its data, especially during critical times of geopolitical tensions,” he said.
Digiboxx provides compliance for BFSI (banking, financial services and insurance), government, media and entertainment, and legal companies. Many of its customers are small and medium-sized enterprises (small and medium-sized enterprises).
High stipulated costs for small and medium-sized enterprises
Mitra explains that spending a large amount per year for SMEs is often unsustainable, especially when features are bundled and those features are not fully utilized. Large companies may not mind paying such amounts, but for smaller companies, maintaining these fees can be challenging. He also stressed that digiboxx’s jurisdiction adherence to data on Indian soil can significantly benefit SMEs, thereby ensuring legal protection and operational controls.
Fintech Startup Finarkein operates in the realm where RBI requires data localization. It specializes in data and workflow orchestration of digital public infrastructure in India. The company raised $4.75 million before each round last August.
As co-founder Nikhil Kurhe explains, Finarkein relies on AWS to provide its services, but takes a multi-cloud multi-zone approach.
In 2018, the Reserve Bank of India directed that all payment data processed in India would be stored locally, allowing foreign entities to process only maritime data when retaining copies of that country. The move aims to enhance regulatory oversight and data security, greatly affecting players such as Mastercard and Visa.
Venture Capital Group is also excited about data governance as a space.
“Cybersecurity and data governance are two verticals we are closely watching, and we expect we expect more investment in this area,” said Chintan Antani, vice president of seeds and acceleration at IIMA Ventures.
Antani added that cross-compliance regulations require standardization – many small and medium-sized businesses are currently conservative about adoption.
Clarity of localization policies
Antani also stressed the need for clearer localization policies to support infrastructure investment, noting: “If land laws change and servers are outside, you will not be able to do anything and there may be unforeseen problems.”
However, smaller companies feel the brunt of increasing compliance requirements.
Tarun Sibal, co-founder of optical delivery company Cloud Photonix, noted that the burden of these regulations is particularly challenging for his company.
“For MSMEs that are already very stretched, the burden of compliance becomes even more important. We must carefully consider where we use data, but the associated costs and resource bandwidth add financial pressure to tight operations.”
Sibar pointed out that India’s growing regulatory landscape is not enough to allow companies to invest in local infrastructure confidently.
“For someone smaller like us, I don’t have a clear roadmap about what I need to cover and what I don’t have to worry about,” Sibar said.
Sibal also highlights the fluid nature of the data, as the data may pass through India but is stored overseas, complicating control and monitoring. Since the data has no physical boundaries, it determines where it is truly local and who is responsible for it.
