Source: Economic Times (economictimes.indiatimes.com). Original reporting dated August 28, 2017.
Background: India’s Government Data Security Order
India’s Ministry of Electronics and Information Technology (MeitY) issued a directive to approximately 30 smartphone manufacturers — the majority of them Chinese brands — requiring them to submit detailed information about their customer data security protocols by August 28, 2017. The order covered major players including Apple, Samsung, Xiaomi, Lenovo, Micromax, Oppo, and Vivo, reflecting growing government concern about how user data collected on mobile devices is stored, processed, and protected.
Oppo and Vivo Consider Relocating Cloud Infrastructure to India
According to senior industry executives cited by the Economic Times, Chinese smartphone brands Oppo and Vivo — ranked third and fourth in India by market share at the time — had been storing cloud data outside India, typically through enterprise cloud providers such as Amazon Web Services (AWS). Following the government directive, both companies reportedly began discussions with their cloud service providers about relocating data storage to servers physically situated within Indian territory.
“Oppo and Vivo have their cloud outside India, which is usually outsourced to enterprise cloud service and data server providers like Amazon. They are now asking them to change the location of these clouds to Indian territory.”
— Senior industry executive (unnamed), as reported by the Economic Times
AWS and Microsoft Azure were identified as the leading cloud and server providers with an established presence in India at the time. Neither company publicly responded to queries about whether handset manufacturers had approached them regarding data residency changes.
Impact on Pre-Loaded App Agreements
At least one unnamed Chinese brand that had recently risen quickly in India’s handset rankings reportedly halted negotiations with third-party app developers over pre-loading arrangements. Pre-loading apps on devices is a significant revenue stream for handset makers; however, the company’s CEO indicated they wanted to ensure full compliance with any upcoming government rules before formalising such agreements — particularly given that pre-loaded apps would give those developers access to device users’ data.
Domestic Indian handset brands were similarly affected. At least one leading Indian manufacturer with servers already located in India asked developers of apps slated for pre-bundling on its devices to formally share their user data protection protocols — primarily so the brand could satisfy government information requests.
Technical and Cost Considerations of Moving Cloud Data to India
Industry advisers noted that physically relocating cloud storage to India is achievable but raises several technical and operational questions:
- Timeline and cost: Switching a cloud region or data centre location was estimated to take one to two weeks and was not considered prohibitively expensive — provided the existing cloud provider already operated an India-based region.
- Provider compatibility: If a brand’s current cloud provider lacked an India-ready deployment, migrating to a provider that does could become significantly more effort-intensive and costly, according to Atul Gupta, Partner, IT Advisory, KPMG India.
- Data processing residency: Cybersecurity experts emphasised that moving storage location is only the first layer of compliance. The more complex question is whether data leaves India at any point for processing, analytics, or other operations.
“If companies are moving their cloud-based data to India, it’s fine as that is the first level where data is stored and it can be easily accomplished. But the more important aspect to address is whether data would leave India at any point for processing, analytics, etc. The regulations need to be clearer in defining this.”
— Amit Jaju, Partner, Cyber Forensics and Data Analytics, EY India
Broader Context: Global Data Localisation Trends
The Indian government’s move was part of a broader global trend toward data localisation and stronger user privacy frameworks. EY’s Amit Jaju noted that large mobile companies — including Chinese manufacturers — would increasingly be required to store data within the jurisdictions where they operate, as privacy regulations tighten worldwide.
The article drew a parallel with the European Union’s General Data Protection Regulation (GDPR), which was scheduled to come into force in May 2018. Under GDPR, personal data of EU residents must remain within the EU, and violations — including security breaches — can attract fines of up to €20 million or 4% of a company’s global annual revenue, whichever is greater.
Responses from Device Manufacturers
Vivo and Oppo declined to comment on the reports. Samsung issued a statement confirming compliance: “We comply with all regulations of the Indian government.” Indian manufacturers including Micromax made similar public statements affirming regulatory compliance.
Key Takeaways for DevOps and Cloud Engineers
While this story originated in the consumer hardware space, it highlights several considerations directly relevant to DevOps and cloud architects supporting multi-region or multi-jurisdiction deployments:
- Data residency planning: Cloud deployments should account for regulatory data residency requirements from the outset, not as a retrofit. Both AWS and Azure offer India-based regions; evaluate these early in architecture design.
- Processing vs. storage distinction: Regulators increasingly distinguish between where data is stored and where it is processed. Ensure your data pipeline — including analytics, ML inference, and logging — respects jurisdictional boundaries.
- Third-party and SDK compliance: Pre-loaded apps and third-party SDKs embedded in products can introduce data flows outside your control. Audit these integrations explicitly as part of compliance reviews.
- Migration lead time: Switching to an in-country cloud region is generally achievable within days to weeks if your provider supports it, but switching providers entirely requires careful migration planning.
- Regulatory monitoring: Data protection rules are evolving rapidly across jurisdictions. Build a compliance review cadence into your engineering roadmap.