Who Owns Your Data? What Happens When Governments Use Foreign AI Systems

Last Updated:April 27, 2026, 09:04 IST

AI systems are designed to identify patterns & predict behaviour. While this can be useful for fraud detection or public health, it can also lead to individuals being categorised

India produces 20% of the world’s data, driven by smartphone usage and UPI transactions, yet hosts only 3% of global data centre capacity.

Governments around the world are rapidly adopting artificial intelligence (AI) to improve governance, policing, healthcare, and public services, but what happens to citizens’ data when these systems are built and operated by foreign technology companies?

Platforms developed by firms such as Palantir Technologies and other global AI providers are designed to integrate and analyse vast datasets at scale. Though it promises efficiency and predictive capability for governments, it raises deeper concerns about privacy, control, and sovereignty for citizens.

What Kind Of Data Do These Systems Actually Use?

Modern AI-driven governance platforms rely on the ability to combine multiple data streams into a single, unified system, often called ‘single global data plane’ or ‘Data Lakehouse’. This includes everything from health records and financial transactions to location data, identity databases, and even behavioural patterns. Systems like Microsoft Purview or Databricks Unity Catalog provide a “single-pane-of-glass” for data lineage, security, and automated metadata labelling.

In India, where digital infrastructure has expanded rapidly, the volume of such data is enormous. With over 1.2 billion Aadhaar IDs issued and roughly 500 million users on digital payment platforms like UPI, governments have access to one of the largest pools of structured and real-time data in the world.

AI systems can take this fragmented data and turn it into detailed profiles. For instance, they can identify patterns in how individuals travel, spend, or access services. In theory, this helps improve policy-making and service delivery. In practice, it means that deeply personal information is being processed at scale by systems that are often not fully transparent.

Where Does The Data Go, And Who Can Access It?

When governments use foreign-built AI platforms, the data may remain physically stored within national borders, but the software architecture, and sometimes access protocols, are controlled by external entities.

In the case of US-based companies, laws such as the CLOUD Act allow American authorities to request data from companies headquartered in the US, even if that data is stored overseas. This creates a legal grey zone where data belonging to Indian citizens could, under certain circumstances, be accessed by foreign governments.

The extent to which this happens depends on contractual agreements, encryption standards, and how systems are deployed.

What Does The Indian Law Say About Data Protection?

India has taken steps to address these concerns through the Digital Personal Data Protection Act, 2023. The law sets out rules for how personal data can be collected, processed, and stored, and places obligations on both government and private entities.

It also introduces concepts such as consent, purpose limitation, and data minimisation. In principle, this means that citizens should have greater control over how their data is used.

However, enforcement remains a work in progress. The law allows certain exemptions for government agencies, particularly in the interest of national security and public order. This creates a situation where large-scale data processing can still take place with limited transparency.

The law applies to digital personal data that is either collected online or converted into digital form from offline sources. It also covers situations where data is processed overseas but linked to goods or services offered to individuals in India.

Entities that handle such data, referred to as data fiduciaries, are required to ensure that the information they process remains accurate, secure, and is retained only for as long as necessary. Once the purpose for which the data was collected is fulfilled, it must be deleted.

The law also strengthens individual rights. Citizens can access their personal data, request corrections or updates, seek its deletion, and raise complaints if they believe their data has been misused.

In a notable shift, the Act adopts a “blacklisting” approach to cross-border data transfers. This means data can be transferred to most countries unless they are specifically restricted by the government, marking a move away from earlier, stricter data localisation requirements.

How AI Systems Are Used In Governance

One of the most significant is the expansion of surveillance. When multiple datasets are integrated, it becomes possible to track individuals across different aspects of their lives — where they go, what they buy, how they interact with public services.

Another concern is profiling. AI systems are designed to identify patterns and predict behaviour. While this can be useful in areas like fraud detection or public health, it can also lead to individuals being categorised or flagged without their knowledge.

This raises questions about accountability. If an algorithm labels someone as high-risk, whether in financial systems, law enforcement, or welfare distribution, how can that decision be challenged? And who is responsible for errors?

There is also the broader issue of transparency. Many of these systems operate as “black boxes,” where even government officials may not fully understand how decisions are being made.

What To Make Of Data Sovereignty In Tech Ecosystem?

The idea of data sovereignty means a country should have control over data generated within its borders.

India produces 20% of the world’s data, driven by smartphone usage and UPI transactions, yet hosts only 3% of global data centre capacity. It is also positioning itself as a major player in the global digital economy, with the data centre capacity expected to surge by 30% by 2026, adding nearly 500 megawatts (MW) of capacity, according to a CBRE Group report.

However, India’s reliance on foreign technology providers, particularly for semiconductors, AI platforms and critical digital infrastructure, creates a structural dependency. Even if data is stored locally, the tools used to process and analyse it may be governed by external frameworks, standards, and legal systems.

This creates a paradox. Countries want the benefits of cutting-edge technology, but using external systems can dilute control over one of their most valuable assets, that is, data.

How Does It Affect Citizens?

Every time a person uses a digital service for paying a bill, accessing healthcare, or applying for a government scheme, they generate data. This ecosystem includes UPI payments, Ayushman Bharat health records, and e-Sanjeevani teleconsultations. As of March 2026, the Ayushman Bharat Digital Mission (ABDM) has linked over 859 million ABHA accounts with digital health records, transforming health data into a national, interoperable ecosystem.

This could determine access to services, eligibility for benefits, or even how individuals are perceived by institutions.

What Is The Bigger Question?

As AI becomes embedded in governance, the question is no longer whether data is being used, it is how, by whom, and under what conditions.

When governments rely on foreign-built systems, the issue extends beyond technology into questions of sovereignty, security, and citizen rights.

With India, being one of the largest digital populations in the world, the decisions made today about data governance will shape not just policy outcomes, but the relationship between the state and its citizens in the years to come.

Platforms developed by firms such as Palantir Technologies and other global AI providers are designed to integrate and analyse vast datasets at scale. Though it promises efficiency and predictive capability for governments, it raises deeper concerns about privacy, control, and sovereignty for citizens.

What Kind Of Data Do These Systems Actually Use?

Modern AI-driven governance platforms rely on the ability to combine multiple data streams into a single, unified system, often called ‘single global data plane’ or ‘Data Lakehouse’. This includes everything from health records and financial transactions to location data, identity databases, and even behavioural patterns. Systems like Microsoft Purview or Databricks Unity Catalog provide a “single-pane-of-glass” for data lineage, security, and automated metadata labelling.

In India, where digital infrastructure has expanded rapidly, the volume of such data is enormous. With over 1.2 billion Aadhaar IDs issued and roughly 500 million users on digital payment platforms like UPI, governments have access to one of the largest pools of structured and real-time data in the world.

AI systems can take this fragmented data and turn it into detailed profiles. For instance, they can identify patterns in how individuals travel, spend, or access services. In theory, this helps improve policy-making and service delivery. In practice, it means that deeply personal information is being processed at scale by systems that are often not fully transparent.

Where Does The Data Go, And Who Can Access It?

When governments use foreign-built AI platforms, the data may remain physically stored within national borders, but the software architecture, and sometimes access protocols, are controlled by external entities.

In the case of US-based companies, laws such as the CLOUD Act allow American authorities to request data from companies headquartered in the US, even if that data is stored overseas. This creates a legal grey zone where data belonging to Indian citizens could, under certain circumstances, be accessed by foreign governments.

The extent to which this happens depends on contractual agreements, encryption standards, and how systems are deployed.

What Does The Indian Law Say About Data Protection?

India has taken steps to address these concerns through the Digital Personal Data Protection Act, 2023. The law sets out rules for how personal data can be collected, processed, and stored, and places obligations on both government and private entities.

It also introduces concepts such as consent, purpose limitation, and data minimisation. In principle, this means that citizens should have greater control over how their data is used.

However, enforcement remains a work in progress. The law allows certain exemptions for government agencies, particularly in the interest of national security and public order. This creates a situation where large-scale data processing can still take place with limited transparency.

The law applies to digital personal data that is either collected online or converted into digital form from offline sources. It also covers situations where data is processed overseas but linked to goods or services offered to individuals in India.

Entities that handle such data, referred to as data fiduciaries, are required to ensure that the information they process remains accurate, secure, and is retained only for as long as necessary. Once the purpose for which the data was collected is fulfilled, it must be deleted.

The law also strengthens individual rights. Citizens can access their personal data, request corrections or updates, seek its deletion, and raise complaints if they believe their data has been misused.

In a notable shift, the Act adopts a “blacklisting” approach to cross-border data transfers. This means data can be transferred to most countries unless they are specifically restricted by the government, marking a move away from earlier, stricter data localisation requirements.

How AI Systems Are Used In Governance

One of the most significant is the expansion of surveillance. When multiple datasets are integrated, it becomes possible to track individuals across different aspects of their lives — where they go, what they buy, how they interact with public services.

Another concern is profiling. AI systems are designed to identify patterns and predict behaviour. While this can be useful in areas like fraud detection or public health, it can also lead to individuals being categorised or flagged without their knowledge.

This raises questions about accountability. If an algorithm labels someone as high-risk, whether in financial systems, law enforcement, or welfare distribution, how can that decision be challenged? And who is responsible for errors?

There is also the broader issue of transparency. Many of these systems operate as “black boxes,” where even government officials may not fully understand how decisions are being made.

What To Make Of Data Sovereignty In Tech Ecosystem?

The idea of data sovereignty means a country should have control over data generated within its borders.

India produces 20% of the world’s data, driven by smartphone usage and UPI transactions, yet hosts only 3% of global data centre capacity. It is also positioning itself as a major player in the global digital economy, with the data centre capacity expected to surge by 30% by 2026, adding nearly 500 megawatts (MW) of capacity, according to a CBRE Group report.

However, India’s reliance on foreign technology providers, particularly for semiconductors, AI platforms and critical digital infrastructure, creates a structural dependency. Even if data is stored locally, the tools used to process and analyse it may be governed by external frameworks, standards, and legal systems.

This creates a paradox. Countries want the benefits of cutting-edge technology, but using external systems can dilute control over one of their most valuable assets, that is, data.

How Does It Affect Citizens?

Every time a person uses a digital service for paying a bill, accessing healthcare, or applying for a government scheme, they generate data. This ecosystem includes UPI payments, Ayushman Bharat health records, and e-Sanjeevani teleconsultations. As of March 2026, the Ayushman Bharat Digital Mission (ABDM) has linked over 859 million ABHA accounts with digital health records, transforming health data into a national, interoperable ecosystem.

This could determine access to services, eligibility for benefits, or even how individuals are perceived by institutions.

What Is The Bigger Question?

As AI becomes embedded in governance, the question is no longer whether data is being used, it is how, by whom, and under what conditions.

When governments rely on foreign-built systems, the issue extends beyond technology into questions of sovereignty, security, and citizen rights.

With India, being one of the largest digital populations in the world, the decisions made today about data governance will shape not just policy outcomes, but the relationship between the state and its citizens in the years to come.

Stay Ahead, Read Faster

Scan the QR code to download the News18 app and enjoy a seamless news experience anytime, anywhere.

login