Digital Sovereignty for Citizens
India needs control over critical digital systems without replacing foreign dependence with domestic concentration or surveillance
A government official sends an email from a foreign provider. A department coordinates on a messaging app controlled by a foreign company. A small business finds customers through a platform whose rules can change without its consent.
None of these choices is irrational. The services work, people already use them, and building an alternative is difficult. But add these decisions together and a question emerges: how much control does India actually have over the communications infrastructure on which its government, businesses and citizens depend?
I have written about this before. In India’s Urgent Need for Digital Sovereignty, I argued that a tax on foreign platforms could not substitute for building domestic capability. In India in a World of Open Markets and Closed Chokepoints, I argued that access to technology is not the same as control over it.
I still believe both. But there is a question those arguments do not fully answer: sovereignty for whom?
If India replaces a foreign platform with a domestic monopoly that can surveil users, exclude competitors or become a mouthpiece for the government, we may have changed the location of power without improving the position of citizens. If a regulator can order a platform to change its rules without an independent appeal, the country may gain leverage while an individual loses freedom.
A serious digital sovereignty strategy has to solve both problems. It must reduce dangerous dependence on foreign-controlled systems and limit the power of whoever replaces them.
Dependence is a source of power
A platform does not need to behave maliciously to exercise power. It can change prices, alter a ranking algorithm, close an account, revise its terms or discontinue an interface. For the company, this may be an ordinary business decision. For a merchant, a creator or a public institution that has built its workflow around the service, it can be a major disruption.
The difficulty is not merely that the platform is foreign. A domestic platform with a captive user base can impose arbitrary conditions too. Foreign control adds a further layer: decisions may be made under another country’s laws, geopolitical priorities and commercial interests, with limited recourse for people elsewhere.
India should therefore ask where dependence is consequential, where switching is difficult, and what alternatives would still work during a dispute or disruption. Government communications, payment systems, cloud services for essential operations, app distribution and access to customers deserve different answers. They have different risks and different technical requirements.
Trying to own every layer of every technology stack would be extraordinarily expensive and likely impossible. Treating all dependencies as harmless would be equally unrealistic. The task is to identify the dependencies that matter and reduce the leverage they create.
A protocol, not another government app
Take communications. Suppose an official department wants an address and messaging system that remains available even if it changes vendors. It should be able to move its accounts, preserve its records under applicable rules and communicate securely with other departments.
That does not require every official to use one government-built app. A more resilient design would define an interoperable protocol and security requirements, then allow several providers to build compatible services. A department could choose a provider, change it when performance deteriorates, and continue communicating with other participants.
Think of the distinction between an address system and a single building. The protocol defines how participants find and communicate with one another. The applications provide the user experience. If the application fails, the user should not lose access to the entire network.
This is easier to say than to build. Identity, spam prevention, accessibility, key management, recovery and reliability all require decisions. Interoperability can also create security weaknesses if a badly designed service is admitted to the network. A protocol needs testing, common security standards and a clear process for dealing with providers that fail them.
Most importantly, a shared communications system should not require a central operator to read everyone’s messages. End-to-end encryption, independent security audits and limited retention of metadata should be design requirements, not optional features to be added after adoption.
Public infrastructure can make markets more competitive, but it does not guarantee competition. An open rail can still support a small number of powerful apps. Rules for access, portability and fair treatment at the application layer matter as much as the protocol underneath.
The right to leave is part of sovereignty
A network becomes powerful when everyone important to you is already on it. That is useful: a messaging service is more valuable when it reaches your family, customers and colleagues. But the same network effect makes it difficult to leave, even if the service changes its terms.
Interoperability can reduce that lock-in. The European Union’s Digital Markets Act requires designated messaging gatekeepers to provide interoperability to eligible services on request. The European Commission has said the solution provided for WhatsApp and Messenger preserves end-to-end encryption. The obligations are phased and technically complex, and their existence does not prove that users will migrate at scale. They do show that competition policy can address the difficulty of switching networks rather than merely telling people to choose another app.
India should study what works and what does not, including the costs imposed on smaller providers, the risk of spam and whether users can understand the security properties of a conversation across services. The objective should be a genuine ability to communicate across networks, not a compliance document that leaves the incumbent effectively in control.
Portability matters too, but it is not a complete substitute. Exporting a list of contacts or a copy of old messages does not recreate the network of people who remain on a platform. Users need meaningful options for both moving their data and continuing to reach others.
Data localisation can create a market for capability
In my earlier essay, I argued for strict data localisation. I continue to support it, and not simply because I want a server physically located inside India.
A large domestic market creates an opportunity to build things that would otherwise remain dependent on decisions made elsewhere. If Indian demand requires data to be stored and processed locally, providers have a reason to invest in data centres, power infrastructure, cooling, networks, operations and the people who maintain them. Over time, that demand can support local suppliers and technical capabilities around the infrastructure. In the spirit of Ha-Joon Chang’s argument for using policy to develop productive capacity, the market is not just something a country opens or closes. It can also be an instrument for learning and investment.
This is a strategic choice. India is already a large consumer of digital services. It should use that demand to develop more of the infrastructure and expertise required to supply them. Otherwise, we risk contributing users, data and revenue while waiting for capability to emerge on its own.
Foreign providers should be welcome to build and operate in India under the same clear rules. The aim is not to exclude them or pretend that every data centre must be owned by an Indian company. Their investment, technical knowledge and competition can help deepen the ecosystem. The test is whether they meet India’s requirements for local operations, security, accountability and access to remedies, and whether the market permits Indian firms and workers to build capabilities alongside them.
Localisation alone will not deliver those outcomes. A data centre in India can still rely on imported equipment, foreign-controlled software and expertise concentrated elsewhere. If we want local capability rather than just buildings, the policy must be paired with reliable power and connectivity, training, opportunities for domestic suppliers, and procurement and competition rules that let more than one firm participate. We should measure progress by the quality of local jobs, operational expertise, supplier depth, reliability and the ability to build and maintain infrastructure, as well as by capacity installed.
There are costs and trade-offs. Local facilities need investment, electricity, water and land. Requirements can burden smaller firms, and badly designed rules can make backups or cross-border operations harder. Those are reasons to design and phase the policy carefully, provide workable compliance routes and assess its effects. They are not reasons to assume the capacity is better left abroad.
Localisation is also not a substitute for privacy. Data held in India must be protected from misuse by companies and the state. Strong encryption, lawful and proportionate access, independent oversight and effective remedies matter whether the operator is Indian or foreign. India’s Digital Personal Data Protection Rules provide part of the legal framework; their application is phased, and the obligations in a particular case depend on the applicable provisions and orders.
The point of localisation is to make India’s digital demand serve a broader national project: build the infrastructure, develop the people who operate it and retain a meaningful ability to govern it. Strong institutions determine whether that project creates a competitive ecosystem or simply gives another concentrated power centre easier access to citizens’ data.
Build an institution that can be challenged
I have argued for a dedicated digital regulator. The case is straightforward: digital platforms affect competition, speech, privacy and access to markets, but the relevant expertise is scattered across institutions. A regulator could develop technical capacity, investigate systemic risks and coordinate with competition and data-protection authorities.
The case against concentrating those powers is just as straightforward. The same institution could be used to pressure platforms over political speech, impose obligations that only incumbents can afford, or grant preferential treatment to a connected domestic player.
So its powers need to be designed around the possibility of misuse. At minimum:
- Its mandate should distinguish competition, consumer protection and security from decisions about lawful political speech.
- Orders should state their legal basis and reasons, be subject to independent appeal, and be disclosed wherever disclosure does not defeat a legitimate, narrowly defined investigation.
- Appointments, funding and removal should be structured to reduce direct political control, with transparent reporting to Parliament and judicial review.
- Access to private communications should require a lawful, necessary and proportionate process with independent oversight. A competition remedy should not become a pretext for weakening encryption.
- Technical standards should be developed openly, with security researchers, smaller firms and civil society able to challenge them.
Independence cannot be created by writing the word into a statute. The harder questions are who appoints the leadership, who controls the budget, what information is public, and whether a citizen or competitor can obtain a timely remedy when the institution is wrong.
What about a domestic champion?
There may be cases where India judges a foreign provider too risky and chooses to support a domestic alternative. Critical communications or infrastructure may justify a different level of scrutiny from an ordinary consumer app. Public procurement can help an early domestic supplier find customers. Limited support can be justified where a market would otherwise never emerge.
But there is a real cost to creating a captive market. A domestic champion can become expensive, politically protected and technically complacent. It can use national security as an argument against scrutiny long after the original need has passed. A local monopoly can still exploit Indian businesses; its owners’ passports do not make customers free.
If protection is necessary, it should have a defined objective, an expiry or review date, measurable performance requirements and a route for competitors to enter. Public support should buy capability and resilience, not a permanent entitlement to Indian users.
The question is not whether domestic firms should be allowed to grow. Of course they should. It is whether their growth depends on serving customers better or on preventing those customers from leaving.
A more useful definition of sovereignty
India should welcome foreign technology and investment under clear Indian rules, including data localisation requirements. It should also build domestic alternatives where dependence creates unacceptable leverage. Both foreign and domestic providers should meet real standards, compete for users and answer to strong institutions.
For the state, sovereignty means critical services can continue, be maintained and be replaced under pressure. For a business, it means access to customers does not depend entirely on the discretion of one platform. For a citizen, it means private communication is protected, choices are meaningful and a regulator can itself be held accountable.
These goals will sometimes conflict. Stronger oversight can create surveillance powers. Interoperability can create security risks. Domestic support can become protection for an incumbent. Pretending otherwise is not a strategy; it is how the trade-offs get decided without public scrutiny.
India needs more control over the systems on which it depends. The people using those systems need more control too. A digital sovereignty mission that delivers only the first half will eventually discover that it has created another chokepoint.