Foreign Investors’ Guide to setting up a Data Center in India: Legal, Regulatory, and Operational Guides

As the global digital landscape evolves, India continues to emerge as an attractive destination for investment, particularly in the industry of data infrastructure. With the surge in internet adoption, implementation of transformative technologies and increase in digital services, the country has witnessed exponential data generation.

India’s digital landscape progresses with a clear objective to make India a global hub of data centers. Evidenced in the recent union budget of India where the finance minister proposed that data centers would be included in the harmonized list of infrastructure, facilitating access to institutional funding and improving the project viability for long-term investors.

Such advancement in India has provided a beneficial opportunity for foreign investors, especially those looking to tap into a progressive market with an agenda of digital growth. However, navigating the complexities of Indian legal framework coupled with various other safeguards requires informed planning.

From a legal standpoint, India permits up to 100% foreign investment in data centers under the automatic route, subject to the condition that the investing entity does not fall under the category of the restricted countries, in which case such entity shall require a prior government approval. The favorable Foreign Direct Investment policy of India along with various other government schemes and efforts allows foreign investors to establish wholly owned subsidiaries or enter joint ventures with Indian partners.

One of the most critical legal considerations for foreign investors of data centers is the legislative landscape of India pertaining to data privacy and security. In addition to the Information Technology Act, 2000 and its subsequent rules particularly the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, the recent and landmark introduction of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) governs compliance obligations for entities processing personal data of the citizens of India. The DPDP Act encourages economic growth while also protecting and prioritizing citizen welfare. While the DPDP Act was enforced in 2023, the Government of India aims to enforce its subsequent rules in the year 2025, which provide the operational details and specific obligations of data fiduciaries, ensuring data accuracy and implementing security breaches. Currently, the Ministry of Electronics and Information Technology (“MeitY”) has invited feedback/comments from the public and stakeholders on the draft rules, in line with the Government’s commitment to adopt an inclusive approach to law-making.

Additionally, operating a data center in India involves licensing requirements under the telecom regulations and obtaining necessary approvals from the Department of Telecommunications. However, the exact licensing requirements depend on the nature of the proposed services offered by the investing entity. Further, considering that a data center under the IT industry is a combination of real estate, infrastructure and data operators, it would require all necessary licenses as applicable to commercial establishments operating in this industry, including operational licenses under the State-specific shops and establishment act, environmental clearances for construction and operation, a fire NOC among various others.

The MeitY has also introduced the draft Data Centre Policy in the year 2020, which intends to simplify clearances, promote investment, and incentivize domestic manufacturing. Pursuant to the policy, many State governments already offer a suite of benefits, including capital subsidies, exemption from stamp duty and electricity duty, fast-track approval systems, and discounted land prices in designated IT zones. Maharashtra, Tamil Nadu, Uttar Pradesh, and Telangana are among the States that have formulated dedicated data center policies to attract investment and provide regulatory clarity.

In India, foreign investors are usually restricted from directly owning or acquiring land. To get around this limitation, they often set up Indian subsidiaries or joint ventures with domestic data center operators or real estate developers. These business structures allow them to develop and manage the real estate assets necessary for data center construction.

Selecting an optimal site to locate a data center is extremely important for its long-term operational success. Another primary consideration is the availability of renewable energy sources, which is important not only to reduce energy expenditure but also to comply with India’s advancing legislations. The Indian government is putting a lot of money into infrastructure for renewable energy and smart grid technology. Some States, like Maharashtra and Tamil Nadu, have established dedicated power corridors along with open access and various other incentive policies aimed at encouraging green energy utilization by data centers.

Ensuring labour availability and compliance with employment laws are equally essential for the successful operation of data centers. India offers a large pool of technically skilled professionals in fields such as IT, network management, and facility operations. However, labour legislation, regulated both centrally as well as at the State level, mandate conformances to wage codes, working condition norms, as well as safety regulations.

Statutory labour compliances include adherence to Code on Wages, 2019, Occupational Safety, Health and Working Conditions Code, 2020, Industrial Relations Code, 2020, and the Code on Social Security, 2020: the four labor codes consolidating India’s labour laws. While the Central government has enacted these codes, their implementation is subject to the corresponding  State rules, most of which are in different stages of notification or enforcement.

For data center operations having a sizeable contractual labour force, for instance, security officers, maintenance engineers, and cleaning services, investors need to comply with the Contract Labour (Regulation and Abolition) Act, 1970, along with other local labour regulations.

To further mitigate risks, it is advisable to establish clear and detailed contractual safeguards in all workforce-related agreements. Beyond labour compliance, legal and operational risk mitigation also hinges on well-drafted commercial contracts. Agreements with vendors and facility operators should include compliance clauses mandating adherence to labour laws, periodic audits, and indemnity provisions in case of violations.

Additionally, long-term lease agreements for land and facilities must include clear clauses on tenure, termination, dispute resolution, and liability. Given the criticality of uninterrupted service delivery in the data center business, robust SLAs with redundancies are essential.

Another important element is proactively monitoring any prospective change in the regulatory landscape of India. India’s legal landscape is dynamic, especially in areas related to technology, data protection, and cybersecurity, particularly when the rules pursuant to the DPDP Act are yet to be enforced. Therefore, regular legal audits and compliance assessments are essential for investing entities to stay abreast of regulatory changes. Engaging external legal advisors ensures that emerging legal risks are identified and addressed promptly.

In conclusion, India’s data center market holds significant promise for foreign investors looking to participate in the country’s digital revolution. The combination of favorable FDI policies, regulatory framework and expanding digital demand makes it a compelling investment destination.

However, the path to success in India’s data center industry is not without its complexities. Foreign investors must navigate a multilayered legal and regulatory landscape, particularly with respect to land acquisition restrictions, sector-specific compliance requirements, labour law obligations, environmental regulations, and data localization mandates. Each of these areas involves interaction with multiple government authorities at the Central and State levels, making it essential for investors to adopt a carefully structured operational and legal strategy.

About the author: Shreyika Walia is an Associate at Ahlawat & Associates.

Disclaimer: The opinions expressed in this article are those of the author(s). The opinions presented do not necessarily reflect the views of Bar & Bench.

If you would like your Deals, Columns, Press Releases to be published on Bar & Bench, please fill in the form available here.