The immediate catalyst was the European Union’s July 2025 sanctions package targeting Nayara Energy, the Indian refining company in which Rosneft holds a 49.13% stake. Reuters reported at the time that the sanctions disrupted export arrangements, tanker access and trade relationships, forcing Nayara to cut refinery throughput at its Vadinar facility from above full utilisation levels earlier in the year to roughly 70–80% capacity in subsequent months.
But inside India’s policymaking ecosystem, the bigger shock came later.
Microsoft suspended certain enterprise services to Nayara, affecting internal access to Outlook and Teams. Nayara approached the Delhi High Court arguing that the suspension interfered with access to paid-up licences, internal communications and operational systems. Microsoft later restored services after legal proceedings began. But by then, the policy damage was already done.
Officials across the finance ministry, the Ministry of Electronics and Information Technology (MeitY) and other departments reportedly began examining whether India needed a domestic legal framework similar to the European Union’s Blocking Statute - the EU’s long-standing anti-sanctions mechanism designed to counter the extraterritorial reach of foreign sanctions laws.
The concern was not ideological. It was infrastructural.
India’s Dependence Problem Is Deeper Than Policymakers Previously Assumed
India’s large enterprises today are deeply intertwined with foreign-controlled digital infrastructure layers in ways that were barely imaginable a decade ago.
Banks increasingly run hybrid workloads across hyperscale cloud systems. Energy companies rely on imported cybersecurity architecture and industrial data systems. Telecom operators depend on foreign software-defined network stacks. Airlines operate through global reservation and operational platforms. Large retailers and logistics firms run ERP environments built around ecosystems controlled by firms such as Microsoft, Amazon Web Services, Google Cloud, Oracle and SAP.
Most hyperscale cloud environments continue operating through globally integrated control planes even where compute infrastructure is physically located inside India. According to disclosures from several large Indian banks, a significant proportion of customer analytics, AI workloads, fraud-detection systems and digital-service layers now operate on public-cloud or hybrid-cloud environments supplied by foreign hyperscalers. Industry estimates from IDC and Gartner suggest India’s public-cloud services market crossed $8–9 billion in 2025 and continues growing at more than 20% annually, with banking, telecom, e-commerce and government workloads among the largest growth segments. In practice, sanctions enforcement logic, identity-governance architecture, privileged administrative escalation, threat-detection systems and compliance protocols often remain embedded within global operational frameworks governed by parent entities headquartered overseas. In effect, an Indian company may store its data inside India with its servers in Mumbai or Hyderabad and still remain vulnerable, as the operational kill switch remains outside Indian jurisdiction.
Much of this infrastructure is operationally sticky. Replacing it is not like changing a vendor contract. Enterprise technology ecosystems become embedded into workflows, audit systems, security protocols, compliance reporting, procurement approvals and customer operations over years. Several enterprise architects interviewed for this story said even partial migration of hyperscaler environments can require rewriting application layers, retraining staff, renegotiating vendor integrations and rebuilding audit controls, all of which would've initially taken years to embed as part of cloud-linked workflows.
Therefore, enterprise migration costs are prohibitive. Technology consultants working with large Indian conglomerates estimate that migrating complex SAP-linked or Azure-linked enterprise ecosystems can take 18–36 months depending on application complexity, regulatory architecture and integration depth. In sectors such as banking or refining, where operational downtime carries systemic risk, even temporary migration instability can become commercially unacceptable. One senior technology executive at a large Indian conglomerate described the situation privately as “soft lock-in masquerading as digital transformation.” Boards often believe they are buying software. In reality, they are gradually outsourcing operational continuity.
That dependency structure is now colliding with geopolitics.
The Policy Shift: From Data Localisation to Continuity Sovereignty
This explains why the Indian government’s emerging thinking appears notably more sophisticated than the earlier localisation-era debates.
The first generation of digital sovereignty policy focused heavily on where data sat geographically. That logic produced localisation frameworks, domestic storage mandates and data-transfer restrictions.
The second generation is about something harder: continuity control.
That is why policymakers are now reportedly exploring whether companies operating in critical sectors such as banking, telecom, energy and strategic infrastructure should eventually migrate toward “sovereign cloud” environments or India-governed infrastructure arrangements.
The phrase “sovereign cloud” often gets misunderstood as merely a local-data-storage construct. It is becoming something much broader. The real issue is not simply whether the data is local. It is whether the operational decision-making authority is local during periods of geopolitical stress.
This distinction is becoming increasingly important because many enterprise customers misunderstand what “India region” cloud infrastructure actually guarantees. Local data residency does not necessarily imply local governance autonomy.
The Reserve Bank of India’s increasing emphasis on operational resilience over the past three years provides important context here. RBI guidelines on digital banking resilience, cyber frameworks and outsourcing risk have progressively moved beyond traditional cybersecurity concerns toward continuity assurance for systemically important financial infrastructure.
The concentration issue is increasingly visible globally. In 2024, the Bank of England warned that systemic dependence on a small number of cloud service providers could create financial-stability vulnerabilities comparable to concentration risk in critical financial-market infrastructure. European regulators have since pushed “exit strategy” and “multi-cloud resilience” requirements for banks under the Digital Operational Resilience Act (DORA).
Indian regulators appear to be studying the same problem through a geopolitical lens: if critical financial infrastructure increasingly depends on a handful of foreign-controlled digital providers, then sanctions compliance, export controls or political escalation could theoretically evolve into financial-stability events.
That architecture matters during geopolitical stress events. Former senior cloud-security executives who advised multinational firms after the Russia sanctions wave have noted that modern cloud ecosystems are designed precisely around centralised policy propagation - meaning compliance actions can travel across regions far faster than traditional legal or diplomatic responses. In effect, hyperscalers optimise for global operational consistency; states optimise for sovereign discretion. The friction between those two models is now becoming visible.
Why the EU Blocking Statute Suddenly Looks Relevant
The model under examination is the European Union’s Blocking Statute - formally Council Regulation (EC) No 2271/96 - originally created in 1996 to protect European businesses from the extraterritorial effects of American sanctions targeting Cuba and later Iran.
Its underlying logic is straightforward but legally disruptive: one jurisdiction should not be able to dictate commercial behaviour globally merely because a company has some nexus to that jurisdiction.
The EU framework attempts to operationalise this principle in three ways:
- by prohibiting EU operators from complying with certain foreign sanctions;
- by refusing to recognise foreign judgments or administrative decisions arising from those sanctions; and
- by permitting affected entities to recover damages caused by those measures.
India’s interest in this framework signals something larger than tactical frustration over one sanctions incident. It signals that New Delhi increasingly sees extraterritorial sanctions compliance as a potential threat to economic sovereignty itself.
The Real Question: What Happens During Escalation?
Inside Indian boardrooms, the discussion is becoming more concrete.
General counsels, CISOs and infrastructure teams are increasingly beginning to map “jurisdictional dependency chains” - identifying which systems could become vulnerable if a sanctions or geopolitical escalation event affects vendors, upstream infrastructure providers or global software ecosystems.
The exercise often produces uncomfortable findings.
Many enterprises do not fully know:
- which workloads depend on foreign compliance architecture;
- where ultimate administrative override authority sits;
- whether local subsidiaries can legally resist parent-company sanctions directives;
- how quickly systems can be migrated if services are restricted; or
- whether backup arrangements actually function under stress conditions.
Several large Indian conglomerates have already begun internal “dependency mapping” exercises that go significantly beyond ordinary cybersecurity audits. According to technology-risk advisers working with infrastructure and financial-sector firms, boards are now asking questions that rarely surfaced three years ago: Which systems can continue operating in “degraded mode” if foreign cloud authentication fails? Which vendors possess unilateral suspension rights under master service agreements? Which operational workloads remain recoverable without external identity validation? How much of the company’s workflow architecture depends on persistent API connectivity with foreign-hosted systems?
One infrastructure adviser involved in business-continuity restructuring for a large Indian energy group said internal simulations conducted in late 2025 showed that disabling enterprise identity-management layers for even six hours could materially affect procurement approvals, refinery dispatch coordination, audit logging, and treasury-control workflows. The company subsequently accelerated segmentation of operational technology systems from corporate IT environments - a move that mirrors similar “air-gap resilience” trends emerging globally after the Colonial Pipeline ransomware attack in the United States and post-Ukraine cyber escalation in Europe.
Several large Indian financial and infrastructure groups have quietly begun exploring multi-cloud redundancy structures, segmented operational architecture and localisation of sensitive identity-management layers. The goal is not technological nationalism. It is survivability.
One cloud consultant advising Indian financial-sector firms described the emerging mood as “geopolitical business continuity planning.” Until recently, disaster recovery meant cyberattacks, natural disasters or power failures. Now, sanctions architecture and foreign compliance triggers are entering resilience models.
The Market Reality: India Cannot Simply “Replace” Global Tech Infrastructure
This is where much of the public conversation becomes detached from operational reality.
India cannot meaningfully decouple from global enterprise technology ecosystems in the near term. The domestic alternatives simply do not yet exist at comparable depth across hyperscale cloud, enterprise SaaS, industrial software, cybersecurity tooling and AI infrastructure.
Even China - despite two decades of industrial policy and massive domestic technology champions - still faces high-end semiconductor and software bottlenecks under American export controls.
India’s realistic pathway is therefore not autarky. It is layered resilience.
That likely means:
- stronger local contracting frameworks;
- continuity obligations for critical services;
- mandatory escalation windows before suspension;
- Indian regulatory review for critical-sector shutdowns;
- data portability requirements;
- operational escrow structures in select sectors;
- sovereign-cloud mandates for highly sensitive workloads; and
- systematic reduction of single-vendor dependency.
This is much closer to financial-system resilience thinking than to traditional technology regulation.
Why Multinationals Are Nervous About the Direction of Travel
Global technology firms understand the implications immediately.
An Indian anti-sanctions or continuity-protection framework would create direct conflict-of-laws exposure for multinational vendors operating across jurisdictions. A company could simultaneously face:
- sanctions obligations under US or EU law;
- export-control restrictions;
- shareholder and banking pressures;
- global compliance mandates; and
- Indian legal obligations prohibiting disruption of local critical services.
That is not a theoretical problem. It sits at the heart of why Europe’s Blocking Statute has historically struggled in practice. Many European firms ultimately prioritised access to the US financial system over Iranian or Cuban business despite EU protections. One reason the issue remains poorly understood outside specialist legal and infrastructure circles is that much of the real leverage sits not in headline regulation but inside boilerplate contractual architecture.
Enterprise cloud agreements routinely contain broad sanctions-compliance provisions, export-control clauses, suspension rights, jurisdictional carve-outs and force majeure language that receive limited scrutiny during procurement cycles. Several technology lawyers advising Indian infrastructure and BFSI clients say many enterprises historically negotiated uptime guarantees, pricing protections and data-security obligations far more aggressively than geopolitical continuity rights.
That is beginning to change. Lawyers advising Indian infrastructure and BFSI companies say enterprise cloud agreements historically focused heavily on uptime guarantees, data-security obligations and pricing protections, while sanctions-compliance clauses received comparatively limited negotiation scrutiny. That has begun changing after the Nayara episode. Several large companies are now reportedly seeking:
- mandatory escalation windows before service suspension;
- local regulatory consultation obligations for critical-sector disruptions;
- mirror-backup access rights;
- transition assistance clauses;
- local dispute-resolution mechanisms; and
- tighter definitions of “applicable sanctions law”.
One Mumbai-based technology transactions partner described the shift as “the arrival of geopolitical drafting in Indian enterprise IT contracts.” What used to be treated as remote sovereign-risk language is now migrating into operational negotiations between CIOs, legal teams and global vendors.
India’s version may therefore evolve differently. Rather than directly forcing companies to violate foreign sanctions law, New Delhi may focus more heavily on procedural continuity obligations - advance notice requirements, regulator consultation, localised governance structures and controlled transition mechanisms.
In effect, the Indian state appears less interested in fighting sanctions regimes outright and more interested in preventing sudden externally-triggered operational paralysis.
Why This Matters
The significance of the Nayara–Microsoft episode lies less in the immediate dispute than in the strategic lens it forced India to adopt.
India’s economy is digitising faster than its resilience architecture is evolving. Critical sectors increasingly operate atop foreign-controlled software ecosystems whose governance logic may ultimately sit outside Indian jurisdiction. The result is a new category of geopolitical exposure: operational dependency without sovereign control.
New Delhi’s emerging response suggests that India is entering a second-generation digital sovereignty phase - one focused not merely on storing data locally, but on ensuring that critical domestic systems cannot be externally interrupted without Indian oversight.
That shift will reshape enterprise contracting, cloud architecture, infrastructure regulation and geopolitical risk management over the next decade.
The central lesson from the Nayara incident is therefore not about one refinery or one sanctions regime. It is about a structural asymmetry at the heart of the modern digital economy: countries may appear digitally sovereign while the continuity of their critical systems remains dependent on decisions taken elsewhere.
Politics
Economy
Business
World
Defence
Law & Justice
Science & Technology
Rida Prime
About us