India and Its Ambitious Data Sovereignty Experiment
In the digital chessboard of the 21st century, India has evolved from a peripheral player to consolidating itself as a technological power with its own voice at a historic moment of internet fracture: while the United States defends market primacy, Europe exports regulatory ethics, China consolidates its information sovereignty, and Russia militarizes its digital ecosystem in the name of national security.
New Delhi, however, advances along a middle path: it seeks autonomy without isolation, materializing its strategy through two pillars: its new regulatory framework, the Digital Personal Data Protection Act (DPDPA, 2023), and the consolidation of its public digital infrastructure, known as India Stack. Both reveal a strategic project that combines data sovereignty, technological diplomacy, and a vision of Global South leadership.
Unlike traditional powers, India does not aspire to control the global flow of information, but rather to negotiate from a position of independence, becoming the “digital vote” that can tip the balance between competing regulatory, ethical, and economic models.
India’s Digital Context as a Non-Aligned Bridge
With over 900 million connected users (according to IAMAI, 2024), India is not only the world’s second-largest digital market but also the primary global laboratory for public-based digitalization.
Indian foreign policy, defined as strategic autonomy, positions it as a non-aligned actor that collaborates with the West on artificial intelligence and semiconductors while maintaining economic relations with China and technological cooperation with Southeast Asia and Africa. This position makes it a bridge between blocs.
However, this ambition faces structural contradictions, as India grapples with profound digital inequality between urban and rural areas; the concentration of data in large local platforms (such as Reliance Jio or Paytm); and institutional weakness in algorithmic oversight and cybersecurity, which generates tensions in the practical limits of its information sovereignty.
DPDPA: Data Protection or Bureaucratic Surveillance?
Approved in August 2023, the DPDPA constitutes India’s first comprehensive data protection law, partially inspired by the European model (GDPR), seeking to regulate the processing of personal information and establish basic privacy rights.
Similarities and Differences with GDPR
Both frameworks share fundamental principles: explicit consent, rights of access and deletion, and data processor accountability. However, the differences are revealing:
The point of greatest friction lies in the exemptions, as the law allows state agencies to bypass some essential requirements for reasons of national security or public investigation. The Future of Privacy Forum (2023) warns that these broad government exceptions could undermine the objective of protecting individual privacy.
In summary, the DPDPA reflects the permanent tension between citizen protection and governmental control: India legislates to assert its sovereignty, but its model still reproduces elements of centralization typical of the regimes it seeks to differentiate itself from.
India Stack: Digital Inclusion with the State as Big Brother
India has developed one of the most ambitious digital infrastructures on the planet: India Stack, a set of open-source public platforms articulated in four key layers:
- Aadhaar: Universal biometric digital identity.
- UPI (Unified Payments Interface): An instant payment system processing over 12 billion monthly transactions.
- DigiLocker: Cloud-based personal document repository.
- Account Aggregator: Unified financial data management.
The Indian Digital Citizen: A Day in the Ecosystem
To understand India Stack’s impact, let’s consider Priya (in an illustrative scenario based on real functionalities), a 32-year-old merchant in Mumbai: her day begins authenticating with her Aadhaar fingerprint to open her store. At 9 AM, she receives a payment of 5,000 rupees via UPI from a customer in Bangalore — the transaction takes 3 seconds with no commission.
At noon, she needs a loan to expand her business: through Account Aggregator, she instantly shares her financial history from three different banks with a fintech, which approves the credit in 15 minutes. In the afternoon, she downloads her vaccination certificate from DigiLocker for her son’s school paperwork.
This efficiency has an invisible cost: each of these transactions feeds the most complete digital profile any government has built on its citizens. The Indian state not only knows where Priya is, but how much she earns, how much she spends, with whom she trades, what health services she uses, and what documents she needs.
This infrastructure is an engine of digital inclusion by allowing millions of citizens to access financial and government services without foreign intermediaries. However, it turns the State into the primary repository of personal information, increasing the risks of surveillance and algorithmic control.
India’s Geopolitical Strategy
India is a geopolitical arbiter of cyberspace by collaborating with the United States in the Quad Alliance (along with Japan and Australia) to establish security standards in 5G and artificial intelligence, while simultaneously maintaining technological cooperation with Europe on privacy matters and with Russia on cyber defense.
Get Lidis Méndez’s stories in your inbox
Join Medium for free to get updates from this writer.
This technological diplomacy is an exercise in balance:
- With the U.S.: Seeks to attract investment but maintains independence in data regulation.
- With China: Maintains strategic competition, having blocked over 300 Chinese applications following the 2020 border conflict.
- With Europe: Partially aligns with the philosophy of digital rights, although its exemption system generates concern in Brussels.
India does not impose global standards, but conditions digital governance through its influence in multilateral forums and its role in the G20, emerging as a third way between state surveillance (China) and unregulated markets (U.S.).
The Risks of Soft Techno-Nationalism
India’s data model has positioned itself as a laboratory of technological sovereignty for the Global South; however, its autonomy is not without contradictions and implementation challenges (IAPP, 2024):
1. Lack of Transparency: The Digi Yatra Case
The Digi Yatra program, implemented in 2022, allows passengers to navigate airports using only facial recognition. In theory, biometric data is stored locally on the user’s phone and deleted after 24 hours. In practice, investigations by Privacy International (2023) reveal that:
- There is no independent audit of the data deletion system
- Private airlines have access to biometric information without clarity on its secondary use
- There is no effective mechanism for citizens to verify whether their data was actually deleted
- Consent is technically “voluntary,” but users who opt out face significantly longer wait times
This case illustrates the fundamental tension: technology promises efficiency, but governmental opacity transforms convenience into normalized surveillance.
2. Socioeconomic Gaps
Insufficient digital literacy keeps nearly 40% of the population outside the full benefits of the ecosystem. Even more concerning: those who cannot navigate the digital system face exclusion from essential services, from food subsidies to medical care.
3. Risk of Bureaucratic Surveillance
The Financial Times (2024) warns that excessive reliance on state digital tools could lead to a form of bureaucratic surveillance that erodes fundamental rights. When the State is simultaneously regulator, infrastructure operator, and primary data user, institutional checks and balances are structurally weakened.
Lessons for Latin America: Beyond the Indian Model
In summary, India emerges as a third emerging model in the global data system. Its success will depend on the balance between economic growth, individual rights, and international cooperation.
For Latin America, the Indian case offers a dual lesson: building digital sovereignty is possible, but it requires solid institutions, transparency, and, crucially, an empowered and data-literate citizenry to ensure algorithmic accountability.
References
The following reports, official documents, and specialized publications were consulted for this analysis:
- Carnegie Endowment for International Peace (2024). India’s Digital Policy and Global Positioning.
- Digital Guardian (2024). India’s New Data Protection Framework.
- Financial Times (2024). India’s biometric ambition: efficiency at the cost of privacy?
- Future of Privacy Forum (2023). Comparative Analysis: GDPR vs DPDPA.
- DGAP (2023). Geopolitics of Emerging Tech Powers.
- IAPP (2024). Implementation challenges of India’s data protection law.
- Internet and Mobile Association of India (IAMAI) (2024). Digital India Report.
- MeitY (Ministry of Electronics and Information Technology, India) (2023). Digital Personal Data Protection Act.
- MIT Technology Review (2024). The rise of India’s digital diplomacy.
- Privacy International (2023). Biometric surveillance in Indian airports: A case study.
Editorial Note: This article is part of my portfolio of analyses, where I seek to build bridges between the complexity of global politics and the digital infrastructure that governs our lives. If you’re interested in diving deeper into data sovereignty and the impact of the fourth industrial revolution on our lives, follow me on Medium or connect with me at https://www.linkedin.com/in/lidis-mendez/ to continue the conversation.
