NITI Aayog Hands States a Data-Centre Rulebook -- Audit Claims Through MeitY, Map Who Answers Under the DPDP Act, and Pay Incentives Against Milestones With Suspension Triggers

On October 14, 2026, NITI Aayog's Frontier Tech Hub released the Data Centre Evaluation Framework, "a common set of criteria which can be used by states to evaluate proposals," as Distinguished Fellow Debjani Ghosh put it to ANI. The document is careful about its own status: it "is intended to support decision-making, not prescribe a uniform approach or create an additional layer of regulation." But its detail goes well beyond the usual single-window pitch.

From investment announcements to investment readiness

The framing is that states should "move beyond competition for investment announcements towards competition based on investment readiness, infrastructure quality and sustainable economic value." Ghosh told ANI global AI-related data-centre investment is "expected to cross USD 1 trillion" over the next few years, and that India can capture a share only if it plans power and water in advance. NITI member Abhay Karandikar said data centres could reach about 2% of India's electricity use within a decade, up from roughly 0.5% now, according to news coverage of the launch.

The governance machinery

Four requirements stand out, and none are about hardware:

• An approval matrix. States should "Publish a State-wise Data Centre Approval Matrix covering each applicable approval or NOC, issuing authority, applicability, indicative processing time, dependencies, required documents, applicable fees and escalation mechanism," linked to one digital interface.
• A central audit. The Centre should "Establish centralised Audit mechanism (with MeitY as the nodal ministry) to periodically audit / inspect the claims of the data centres establishments." As MediaNama notes, this sits oddly with MeitY's own position that "Officially, no data is maintained in MeitY regarding the capacity of Data Centres."
• A responsibility map. Each condition is assigned to a responsible entity, mapping "the facility and IT owner, workload controller, customer counterparty, Data Fiduciary or Processor, regulated entity, compute controller and incentive recipient" -- the Data Fiduciary and Processor being the Digital Personal Data Protection Act's terms for who answers for personal data.
• Incentives with brakes. States should "Compare fiscal and ecosystem benefits with total State support. Pay against controllable KPIs, with monitoring and suspension triggers," and mark "Red zone" exclusion areas where development is restricted for "hazard exposure, water stress, land-use conflicts or inadequate supporting infrastructure." A "Community Impact Assessment" covering water, traffic, emissions and local jobs is expected before construction.

What remains uncertain. The framework is advisory, and states "can apply the common assessment principles in line with their priorities." It names no state policies even though several exist, and the framework's own disclaimer says "the data used is from secondary sources." Whether states adopt the audit and responsibility-mapping provisions, or treat them as optional, is unresolved.

Analysis: The interesting move here is treating a data centre as a software-governance problem, not a real-estate one. Mapping each obligation to a named Data Fiduciary under the DPDP Act, and paying incentives against milestones that can be suspended, is an attempt to make accountability legible before a facility is built rather than after a breach. That is the right instinct for infrastructure that will hold other companies' personal data. The weakness is enforcement: a guidance document that asks MeitY to audit claims, when MeitY says it keeps no capacity data, is writing a check the current machinery cannot yet cash.