India’s AI Infrastructure Dream Faces a Triad of Deficits: Why Tax Holidays Alone Won’t Build a Digital Superpower 

India’s AI Infrastructure Dream Faces a Triad of Deficits: Why Tax Holidays Alone Won’t Build a Digital Superpower 

When Iran launched cyber-attacks on Amazon Web Services data centres in the UAE and Bahrain earlier this year, the message was unmistakably clear: in the 21st century, data centres are strategic assets, and targeting them is a form of economic warfare. The Iranian regime didn’t just release a list of targets—they explicitly categorized major US tech companies’ digital infrastructure as “enemy technology infrastructure.” For India, which is now betting big on becoming a global AI infrastructure hub, this geopolitical tremor should serve as a wake-up call. 

At February’s AI Summit, the government unveiled a headline-grabbing 21-year tax holiday for foreign companies to establish data centres in India. The result was staggering: pledges worth $240 billion for Indian AI and data infrastructure. On the surface, this looks like a historic coup—a validation of India’s ambition to position itself as the backend for the world’s artificial intelligence revolution. But beneath the celebratory headlines lie three deeply entrenched deficits that could turn this dream into a precarious house of cards. 

The Geopolitical Vulnerability Hiding Behind Indian Ownership 

The tax holiday comes with a seemingly prudent condition: foreign companies must procure services from a “specified data centre”—one established under an approved MeitY scheme, owned and operated by an Indian company. At first glance, this appears to safeguard data sovereignty. After all, under FDI regulations, an “Indian-owned” company requires Indian residents to hold more than 50 per cent of its shares. 

But here’s the uncomfortable truth that the government’s policy architecture hasn’t fully grappled with: Indian ownership is no shield against international sanctions. 

The ongoing Nayara Energy v. SAP India case before the Delhi High Court offers a chilling preview of what can go wrong. Nayara Energy, an Indian company, found itself on the receiving end of European Union sanctions not because of anything it did, but because Rosneft—the Russian state oil company—holds a 49 per cent stake in it. When EU sanctions kicked in, SAP India, whose parent company is German, withdrew its services. The Delhi High Court refused to grant Nayara interim protection. A perfectly legitimate Indian company, operating within Indian law, was effectively collateral damage in a geopolitical conflict thousands of miles away. 

Now transpose this logic to India’s new data centre ecosystem. Even with Indian majority ownership, a specified data centre with a minority foreign stake—whether from the US, Europe, or elsewhere—remains vulnerable. If sanctions are imposed, foreign parent companies or technology providers may be legally compelled to sever ties, withdraw services, or cut off access. The data stored within Indian borders could become inaccessible, or worse, a target. 

The French government understood this risk when it replaced Microsoft Teams and Zoom with indigenous alternatives earlier this year. Their calculus was simple: US law, specifically the CLOUD Act, allows American law enforcement to compel US companies to produce data stored anywhere in the world. For France, hosting sensitive government communications on American-controlled infrastructure was an unacceptable sovereign risk. India, by contrast, is inviting the very same infrastructure onto its soil without building adequate legal insulation. 

What India needs isn’t just Indian ownership on paper, but a robust legal framework that ring-fences domestic data centres from the capriciousness of international sanctions. This means legislating protections that prevent foreign sanctions from automatically triggering service terminations within Indian jurisdiction. It means creating carve-outs in India’s own sanctions compliance framework that prioritize national digital sovereignty. And it means being brutally honest about the fact that hosting foreign data centres is not the same as owning the capability to secure them. 

The Privacy Paradox: Whose Data Is Protected? 

There’s another legal ambiguity lurking in the shadows. The Digital Personal Data Protection Act, 2023 (DPDPA) was hailed as India’s answer to the global privacy movement. But Section 17 of the Act contains an exemption that could prove deeply problematic for the new data centre regime. 

Under Section 17, data of persons outside India is exempt from certain DPDPA obligations if it’s processed under a contract between Indian and foreign contracting parties. This means that a foreigner’s data stored in an Indian data centre for a foreign service provider—say, a European cloud customer—may not be entitled to the same breach notification protections as an Indian citizen’s data. If a data breach occurs, the foreign individual might never be informed. The Data Protection Board of India might never be notified. 

This creates a two-tier privacy regime on Indian soil: one set of rules for Indian data, another for the data of foreigners processed here. But here’s the catch—Section 8(1) of the DPDPA also mandates compliance “irrespective of any agreement.” The law is currently unclear on which provision prevails. Until this is resolved, foreign companies storing data in India face regulatory uncertainty, and individuals whose data resides here face uneven protections. 

This isn’t just a technical legal quibble. In an era where data is the raw material of AI, clarity on privacy obligations is foundational to trust. If India wants to be a global AI infrastructure hub, it must offer a predictable, transparent data protection framework—not a patchwork of exemptions and contradictions. 

The Environmental Blind Spot: Water, Power, and a Warming Nation 

Sam Altman, speaking at an Indian Express event recently, brushed aside concerns about water consumption by AI data centres. His argument—that the resources consumed in training humans to an equivalent capability dwarf those used by AI—was clever but dangerously dismissive. Others have gone further, suggesting that environmental concerns are a “Western luxury” that India cannot afford if it wants to build infrastructure at scale. 

This perspective ignores a brutal demographic and geographic reality. India is home to 18 per cent of the world’s population but possesses just 4 per cent of its water resources. According to reports from Down to Earth, Planet Tracker, and the World Resource Institute, 50 existing Indian data centres are already located in zones facing high water stress. Now imagine adding hundreds more, each consuming millions of gallons of water daily for cooling, in a country where summer temperatures regularly cross 45 degrees Celsius and water scarcity already affects millions of lives. 

The tax holiday for data centres includes no mandatory environmental standards. There’s no requirement for water use reduction, no mandate for renewable energy sourcing, no cap on power consumption in a country still grappling with grid stability. This is not environmentalism for its own sake—it’s about ensuring that the infrastructure India builds today doesn’t become unviable tomorrow because the resources it depends on have been exhausted. 

Data centres are not just power-hungry; they are water-intensive. AI workloads, in particular, generate enormous heat, requiring constant cooling. In water-stressed regions, this creates direct competition between industrial use and human consumption. The government’s Ministry of Electronics and Information Technology (MeitY) must impose enforceable environmental standards as a condition for participating in the tax holiday scheme. This isn’t a luxury—it’s a survival imperative. 

The Capability Deficit: Warehouses Without Innovation 

Perhaps the most troubling deficit is the one that gets the least attention: the complete absence of technology transfer conditions in the current scheme. 

Foreign companies can avail the 21-year tax holiday without any obligation to share knowledge, co-develop technology, or build Indian manufacturing capacity. Under the prevailing India-US trade framework, India has already committed to buying up to $500 billion of US goods and services, including technology, and to eliminating import restrictions on US ICT equipment. The result is a policy architecture that incentivizes Indian companies to import equipment from the US rather than develop domestic alternatives. 

Data centres without technology transfer are warehouses. They store and process data, but they don’t generate innovation. They create jobs in construction and facilities management, but not in chip design, server manufacturing, or AI model development. India risks locking itself into the infrastructure tier of the AI value chain—the foundation upon which others build—while the capability tier—the intellectual property, the patents, the high-margin services—remains elsewhere. 

The MeitY scheme must be redesigned to require knowledge transfer and create direct incentives for Indian operators. This could take many forms: mandatory R&D spending as a percentage of revenue, joint development agreements with Indian firms, preferential treatment for companies that use domestically manufactured equipment, or requirements to establish AI research centres in India. Without such mechanisms, the $240 billion in pledges will build data centres, but they will be foreign-owned, foreign-equipped, and foreign-controlled—with Indian soil serving as little more than a convenient location. 

A Way Forward: From Infrastructure to Capability 

India’s ambition to become a global AI infrastructure hub is neither misplaced nor impossible. The country has clear advantages: a massive domestic market, a growing pool of engineering talent, competitive real estate and power costs, and a government willing to use fiscal policy to attract investment. But ambition without structural safeguards is a recipe for dependency, not sovereignty. 

The three deficits—geopolitical vulnerability, regulatory ambiguity on privacy, and environmental unsustainability—are not insurmountable. But they require a level of policy sophistication that goes beyond tax holidays and investment pledges. 

First, India needs a legal framework that explicitly protects domestic data centres from the extraterritorial reach of foreign sanctions. This could involve legislation that prohibits service termination based solely on foreign sanctions, establishes India’s own licensing regime for critical digital infrastructure, and creates clear procedures for managing sanctioned entities without disrupting digital services. 

Second, the government must clarify the DPDPA’s applicability to foreign data stored in India. If India wants to be a trusted data destination, it must offer consistent protections regardless of where the data subject resides. Ambiguity on this front will erode trust and ultimately deter the very investment the tax holiday is meant to attract. 

Third, MeitY must impose binding environmental standards. Water use reduction targets, renewable energy mandates, and location restrictions to avoid water-stressed zones should be non-negotiable conditions for participation in the tax holiday scheme. These measures will not only ensure sustainability but also give India a competitive advantage as global investors increasingly prioritize ESG compliance. 

Finally, and most importantly, the government must embed technology transfer and domestic capability-building into its AI infrastructure strategy. The goal cannot be merely to host the world’s data—it must be to build the world’s AI capability. This means using the leverage of the Indian market to demand knowledge transfer, incentivizing domestic manufacturing, and creating pathways for Indian companies to move up the value chain from infrastructure to innovation. 

The $240 billion in pledges is a testament to India’s potential. But potential is not destiny. Without addressing these three deficits, India risks building a digital infrastructure that is geopolitically exposed, environmentally unsustainable, and technologically dependent. The vision of being a global AI hub is within reach—but only if India moves beyond attracting investment to building genuine, resilient capability. The choice is clear: be the warehouse for someone else’s AI revolution, or build the foundation for your own.