‘Jiska data, uska adhikar’: What PM Modi’s data sovereignty pitch really means

Modi’s MANAV AI doctrine ties data sovereignty to Budget 2026’s data-centre tax holiday. Here’s what Indian law says for firms and citizens.

• PM Modi reveals MANAV, a 5-point AI plan at India AI Summit
• Budget 2026: Tax holiday for foreign firms using India data centers
• DPDP Act grants individuals rights over their personal data

Did our AI summary help?

At the India AI Impact Summit 2026, Prime Minister Narendra Modi unveiled a five-point framework for artificial intelligence called MANAV, short for Moral and Ethical Systems, Accountable Governance, National Sovereignty, Accessible and Inclusive, and Valid and Legitimate.

Then he distilled its most consequential element into a single line: 'Jiska data, uska adhikar.' Your data, your right.

In the Prime Minister’s Office summary, the phrase appears as: 'Data belongs to its rightful owner.'

The statement comes as India operationalises its Digital Personal Data Protection Act and, in the Union Budget 2026–27, offers a tax holiday until 2047 to foreign firms that use India-based data centres to power global cloud services.

What 'national sovereignty' means in data terms There is no universally accepted definition of data sovereignty.

The United Nations Conference on Trade and Development (UNCTAD) has noted that in a data-driven economy, 'ownership and sovereignty are being challenged,' and that the core issue is control over access and use of data. UNCTAD also cautions that digital sovereignty is often equated with storing data within national borders, but says the link between geographic storage and development 'is not evident.'

The Organisation for Economic Co-operation and Development (OECD) defines data localisation more concretely: legal requirements that data be stored or processed domestically, ranging from partial storage mandates to near-total transfer restrictions.

Against that backdrop, Modi’s use of 'national sovereignty' situates India within a broader debate about control over data, infrastructure and AI systems.

The Budget 2026 data-centre tax holiday

In the Union Budget 2026–27 speech, Finance Minister Nirmala Sitharaman announced a tax holiday until 2047 for foreign companies that provide global cloud services using India-based data-centre services. The incentive applies provided services to Indian customers are delivered through an Indian reseller entity.

She also announced a 15 percent safe harbour on costs where the India-based data-centre provider is a related entity.

The government release described the measure as aimed at anchoring AI-oriented infrastructure in India and providing long-term certainty for investors, noting the capital-intensive nature of AI data centres.

The measure also addresses concerns among foreign firms that using India-based data centres could expose their global cloud income to potential Indian tax liabilities.

The announcement places fiscal weight behind the sovereignty language in Modi’s speech: expanding compute capacity inside India while asserting control over how data is governed.

India’s legal framework: the DPDP Act

India’s primary personal data law is the Digital Personal Data Protection (DPDP) Act.

The Act gives individuals, referred to as Data Principals, statutory rights to:

• Access information about their personal data.
• Seek correction, updating and erasure.
• Use grievance redressal mechanisms.
• Nominate another person to exercise rights in cases such as death or incapacity.

The government has stated that the DPDP Rules, notified in late 2025, operationalise this framework with phased compliance requirements, including clearer consent notices and breach notification obligations.

The law also introduces the category of Significant Data Fiduciaries. The Central Government may designate entities based on factors including risks to individuals’ rights and risks to the 'sovereignty and integrity of India,' electoral democracy, security of the State and public order. Such entities face additional compliance obligations, including impact assessments and appointing a data protection officer based in India.

On cross-border transfers, the Act permits the government to restrict the transfer of personal data to specified countries or territories by notification.

How the speech and the tax policy align

In his summit address, Modi emphasised that AI should not reduce humans to 'data points' and that sovereignty requires rightful ownership of data.

Separately, the Budget offers fiscal incentives to expand data-centre capacity within India.

The connection is structural. Sovereignty language addresses control and rights. The tax holiday addresses physical infrastructure and compute capacity.

One concerns who governs data. The other concerns where data is processed.

What it means for companies

Companies processing personal data in India must comply with the DPDP Act’s requirements on lawful processing, consent, notice and data principal rights.

Entities designated as Significant Data Fiduciaries face enhanced obligations tied in part to sovereignty-related risk factors.

Companies training AI systems on publicly available personal data operate within the scope of the statutory exemption. However, AI governance guidance has identified this area as a subject of policy scrutiny.

Firms using official government datasets can rely on structured licensing frameworks, such as those provided through national open data platforms.

Cloud providers and infrastructure companies using India-based data centres may qualify for the Budget’s tax holiday, subject to conditions on routing Indian customer services through Indian entities and compliance with eligibility criteria notified by the government.

What it means for citizens

Under the DPDP Act, individuals have enforceable rights over their personal data held by data fiduciaries.

However:

• Personal data made publicly available by the individual falls outside the Act’s scope.
• The law allows exemptions for notified state instrumentalities in the interests of sovereignty, security of the State and public order.

In parallel, policy discussions on non-personal and community data have introduced the concept of benefit-sharing and trusteeship, though those proposals are not codified in binding statute.

“Jiska data, uska adhikar” expresses ownership in moral terms. The DPDP Act sets out the statutory rights. The Budget expands the infrastructure. Together, they define how India intends to govern data in an AI-driven economy.