Cloud service providers likely to see increase in customers due to DPDP Act implementation

As the deadline for the implementation of the Digital Personal Data Protection (DPDP) Act approaches, cloud service providers in India are expecting a significant increase in their customer base. According to a Businessline report, there is now a surge in demand for sovereign clouds due to data protection regulations.

The primary deadline for the implementation of this law has been set for May 2027. However, the first phase of the process, related to consent management, is set to begin in the second week of November. Vaibhav Kaul, Managing Director of Protiviti Member Firm for India, stated that there are still several regulatory gaps in the overall process that need to be addressed. He emphasised that Indian companies must take appropriate governance, technology, and accountability measures to avoid violations of the rules. If these rules are violated, the penalty amount could reach up to ₹250 crore.

Due to these stringent penalty provisions, many cloud providers expect that companies will now move away from infrastructure models based on foreign-controlled platforms and turn towards Indian-controlled sovereign cloud platforms.

Piyush Somani, Managing Director and Co-founder of ESDS Software Solutions, predicted a jump in cloud demand during his recent earnings call. He stated, "We are very optimistic that next year when DPDP comes into effect, a chaotic situation will arise where people will want to leave foreign cloud platforms and move to ESDS. This will create the demand we are expecting. We are preparing to seize this opportunity."

Similarly, Sunil Gupta, Managing Director and CEO of Yotta Data Services, also spoke about the impact of this law. He stated that the impact of compliance will not be limited to customer consent alone, but will extend to the storage, processing, protection, and deletion of personal data, as well as maintaining greater control over the third-party service providers involved.

According to Sunil Gupta, the biggest impact will be seen in sectors where the volume of personal data is very high. Specifically, it will affect banking, financial services, insurance, healthcare, government departments, e-commerce, telecom, and large consumer-centric digital platforms. He believes this will lead to an increase in company spending on secure cloud infrastructure, data protection, cybersecurity, backup, disaster recovery, and managed services.

Gupta further clarified that the data protection framework does not ban foreign cloud providers, but increases institutional accountability for the protection of personal data. He explained the important difference between data residency and data sovereignty. He stated that merely storing data in an Indian data centre does not mean that the underlying cloud infrastructure, administrative access, encryption keys, or operational control are entirely within Indian jurisdiction. However, he does not expect all enterprises to move their entire IT infrastructure away from global hyperscalers.