Airtel pitches sovereign cloud and AI security at IMC, says data location isn't enough

Bharti Airtel used the India Mobile Congress 2026 in New Delhi to pitch its sovereign cloud, data centre and AI-driven cybersecurity services to businesses and government, showcasing them to Communications Minister Jyotiraditya Scindia on Thursday, October 8, 2026. Chairman Sunil Bharti Mittal briefed the minister at the company's stand. Airtel presented Airtel Cloud as a way for enterprises to meet data residency requirements on an Indian stack, and said its AI-powered security operations centre, iSOC, is already in use by select customers including Indian Railways and the Employees' Provident Fund Organisation (EPFO). At a panel during the event, an Airtel executive argued that keeping data in India is not, on its own, enough to make it sovereign.

"Sovereign cloud" has become one of the biggest selling points in enterprise technology. Banks, insurers, government departments and companies holding citizens' data face rules that require certain data to stay in India. Global cloud providers have built Indian data centres to meet these rules, and Indian players such as Airtel are now competing by arguing that a domestic provider offers more control.

Airtel's own executive made a sharper point: location is not the same as sovereignty. If data sits in India but the software, encryption keys or management of the system are controlled from abroad, a foreign government or company could still have access. That argument goes beyond what most Indian rules require today, which focus mainly on where data is stored. It is also, naturally, an argument that favours Indian providers.

For businesses deciding where to put sensitive workloads, the debate matters in practical terms. Questions to ask any provider include who holds the encryption keys, where the systems are operated from, and which country's laws could compel access. The answers affect compliance risk, especially for regulated sectors.

The security deployments are also significant. When large public bodies such as Indian Railways and EPFO rely on an operator-run security centre, it shows a shift toward buying cybersecurity as a managed service, bundled with connectivity, rather than building it all in-house. That model could spread to mid-sized firms that cannot afford their own round-the-clock security teams.

Short-term: Enterprises and government buyers evaluating cloud and security providers will hear more "sovereign" pitches from Indian telecom and cloud companies, and should test those claims on control and access, not only location.

Long-term: If India's rules move from data location toward control and access, domestic providers could gain ground in regulated sectors, and global providers may adapt by offering more locally controlled services.

Who is affected: Banks, insurers, government departments and other organisations handling sensitive data; cloud and cybersecurity providers; and policymakers shaping India's data protection and localisation rules.

Questions and Answers