Does Sovereign Mean Indian-Owned? A Legal Read

A joint secretary asked, in a meeting we were in, whether sovereign meant the company had to be Indian-owned. Three people answered three ways. All three were partly right. None of them was citing a section.

This is the legal split those three answers were reaching for. Get it into the file and the rest of the evaluation becomes calmer. Leave it mashed into one adjective and you will disqualify the wrong bid, or worse, qualify the wrong one.

What DPDP says about nationality

Nothing useful for this debate. The Act cares whether you process digital personal data, whether you are a fiduciary or a processor, and whether you have a lawful basis. It applies to Indian entities. It also applies to foreign entities that offer goods or services to Data Principals in India. Shareholding is not an element of the offence, the duty, or the exemption.

A foreign-owned processor that takes documented instructions, stores data where the contract says, and does not train on your records can be compliant. An Indian-owned processor that sends every prompt to an unlisted foreign model API can be non-compliant. The Act looks at processing. It does not look at the cap table first.

What procurement law can still require

Public buyers are not limited to DPDP. The Public Procurement (Preference to Make in India) Order can prefer Class-I or Class-II local suppliers based on local content. Departments can restrict a bid to DPIIT-recognised startups where GFR relaxations apply. Defence and certain strategic projects can impose ownership and control tests that have nothing to do with personal data.

Those are legitimate purchase policies. They should be written as purchase policies. Calling them DPDP is how a file gets challenged. Calling them sovereignty without defining the word is how a file gets confused.

Claim	Source of truth	Typical mistake
Must obey DPDP	Act + Rules + commencement dates	Treating a foreign processor as automatically unlawful
Must be Indian-owned	Tender eligibility, if any	Importing this into a DPDP opinion
Must use Indian local content	Make in India order and calculation	Confusing assembly of laptops with model weights
Must be DPIIT recognised	GFR / tender relaxation, if invoked	Treating the certificate as an architecture review
Must survive foreign compulsion	Risk acceptance by the department	Assuming an Indian subsidiary is unreachable by its parent

Control is the word people meant

When officers say we want an Indian company, they often mean we do not want a foreign parent to be able to turn this off or read this. That is a control and continuity requirement. It can be met by an Indian-owned on-prem stack. It can also be met by a foreign-owned on-prem stack with institution-held keys and a rehearsed failover. It is not met by an Indian-owned wrapper around a foreign API.

Write control. Then decide whether you also want ownership or local content. Three clauses. One adjective cannot carry them.

A clean way to write the tender

1. Data-protection and residency, scored as eligibility. DPDP roles, transfers, training ban, logs.
2. Continuity and compulsion, scored as eligibility or high-weight quality. Failover, keys, disclosed parent-company risk.
3. Local content, if the department has a policy, with a calculation method.
4. Startup relaxations, if used, as an eligibility path, not as a substitute for the first two.

Why officers reach for ownership

Ownership feels like control because in other sectors it often is. An Indian bank is easier to inspect than a foreign one. An Indian munitions plant is easier to nationalise in a crisis. Officers import that instinct into AI. The instinct is understandable. The mapping is wrong if the Indian company is a reseller of a foreign API.

Ask what they are actually afraid of. If the fear is cut-off, write continuity. If the fear is foreign compulsion, write keys and disclosed parent risk. If the fear is political optics, write a communications line and do not pretend it is DPDP. Optics are allowed. They are not a section of the Act.

Subsidiaries and the reach-through problem

An Indian private limited subsidiary of a foreign parent is an Indian contracting entity. That helps with GST, with service of process, and with GFR paperwork. It does not automatically block the parent from reaching logs, from changing the global acceptable-use policy, or from being compelled. Read the inter-company data processing terms. If they do not exist, assume reach-through.

How to brief counsel

Give counsel three questions, not a request to review sovereignty. Does DPDP require Indian shareholding for this processing. What tender conditions may we lawfully add. What residual compulsion risk remains if we contract with this entity. Counsel can answer those. They cannot answer is this sovereign without your definition.

Split the next tender into three races this fortnight

Day 1–2: decide, in writing, whether you want an ownership restriction, a local-content preference, or only control. Many departments want the third and write the first. That is the error. Get the secretary's preference on one page.

Day 3–5: counsel answers the three briefing questions. Does DPDP require shareholding. What may we lawfully add. What residual compulsion remains with this class of entity. File the opinion.

Day 6–10: draft four separate clauses — DPDP and residency, continuity and compulsion, local content if any, startup relaxations if any. Delete the word sovereign from eligibility. If someone wants it in the preamble, let them have the preamble.

Day 11–14: pre-bid Q&A. When a bidder asks does Indian-owned mean we pass sovereignty, answer with the four clauses. Repeat until the question dies. The market learns from your Q&A more than from your conference talks.

Objections you will hear — and what to do with them

Political leadership may want Indian-owned as a headline. Give them the headline in the preamble if they insist, and still write control as eligibility. Headlines that replace clauses produce Indian wrappers around foreign APIs. Those wrappers photograph well and fail quietly.

A foreign bidder will say DPDP forbids nationality discrimination. DPDP does not require you to ignore procurement policy. It also does not require you to pretend ownership is compliance. Keep the races separate and you will be able to defend both a restriction and a relaxation.

An Indian bidder will say their DPIIT certificate should skip the control rows. Certificates skip some GFR formalities. They do not skip keys, logs or transfers. If you let a certificate skip control, you have taught the market that paperwork beats architecture.

Counsel may hesitate to put residual compulsion in a public RFP. Put the requirement in the RFP and the detailed legal memo in a restricted annex. Hiding the issue entirely is how it returns as a newspaper question.

Someone will ask whether open-weight plus Indian company is enough. It is enough only if the rest of the stack matches. Open weights on a foreign control plane with a foreign APM is still a path. Ownership of the bidder does not close the path.

How this shows up in the file

The cleanest file we have seen on this topic had four clauses and no use of the word sovereign in eligibility. The preamble mentioned Atmanirbhar Bharat. The scoring sheet did not. The bid was protested once and the protest failed because the races were written down.

If your current draft mixes ownership, residency and DPDP in one paragraph, split it before legal vets. Counsel can defend four clauses. They cannot defend one adjective that means three things depending on who is speaking.

When a journalist or a PAC asks whether the system is Indian, answer with the four clauses. Anything shorter will be quoted without the controls. Anything longer will not be read. Four sentences is the design.

What the next noting must contain

“Does Sovereign Mean Indian-Owned? A Legal Read” belongs in a file, not only in a search result. A P6 Compliance/DPO should be able to point at one artefact that proves “Indian owned AI vendor rules”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Ownership, residency and control are three different legal questions. Tenders that mash them into one word lose both compliant foreign vendors and non-compliant Indian ones. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C1 Sovereignty & Data Residency: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “Indian owned AI vendor rules”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.

Prcept AI LLP is an Indian entity and a DPIIT-recognised startup. We still ask buyers to score our architecture, not our certificate. A certificate cannot locate a log.