Lok Sabha Question No. 2431 (UNSTARRED), answered on 2022-12-21
Subject: Global Cloud Platform
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Mahua Moitra

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 2431

TO BE ANSWERED ON: 21.12.2022

## GLOBAL CLOUD PLATFORM

## 2431.  SHRIMATI MAHUA MOITRA:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether it is a fact that there is a widespread use of global cloud platforms like AWS, Azure and Google Cloud and if so, the details thereof;
- (b) whether  the  Government  is  aware  that  these  cloud  providers  are  liable  to  hand  over information to the US Governmental authorities under the Clarifying Lawful Overseas Use of Data Act (or CLOUD Act) and if so, the details thereof ;
- (c) whether the Government is creating a plan and laying down guidelines as to the data that Governmental  agencies  can  store  on  these  international  cloud  providers  and  if  so,  the details thereof; and
- (d) whether this remain compliant with the Fundamental Right to Privacy of Indian citizens as held by Supreme Court in the Puttaswamy judgement and if so, the details thereof?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAJEEV CHANDRASEKHAR)

(a) to (d): The policies of the Government are aimed at ensuring an Open, Safe and Trusted and Accountable Internet for its users. With the expansion of the Internet, more and more Indian coming online and increase in the volume of data generated, stored and processed, the need to secure such data has been increasingly in focus.

Government, in exercise of its powers under the Information Technology Act, 2000 ('IT Act') has made the Information Technology (Reasonable security practices and procedures and  sensitive  personal  data  or  information)  Rules,  2011,  which  provide  safeguards  for sensitive  personal  data  or  information  collected  by  a  body  corporate  or  any  person  who receives, possesses, stores, deals or handles information on behalf of such body corporate. The rules specifically provide that the disclosure of sensitive personal data or information by the body corporate to any third party requires prior permission from the provider of the information,  unless  such  disclosure  has  been  agreed  to  in  the  contract  between  the  body corporate  and  the  provider  of  information  or  where  the  disclosure  is  necessary  for compliance of legal obligations.

Further, the Ministry of Electronics and Information Technology has prepared a draft Bill, titled  the  Digital  Personal  Data  Protection  Bill,  2022  and  has  invited  feedback  from  the public as part of its public consultation exercise.

With regard to storage of data by government agencies, it is informed that the Ministry of Electronics  and  Information  Technology  has  empanelled  cloud  service  offerings  of  both domestic and global cloud service providers, after audit by the Standardisation Testing and Quality Certification Directorate with reference to the international security standards (ISO 27001,  ISO  27017,  ISO  27018  and  ISO  20000.  Further,  the  terms  and  conditions  of empanelment  require  submission  of  a  legal  undertaking  guaranteeing  that  the  data  shall reside in India and that there shall not be any legal framework outside Indian law that will be applicable to the operation of the cloud services.

*******