LEGAL CONSIDERATIONS FOR INVESTMENTS IN DATA CENTERS IN INDIA

The Government should prepare a data localization policy which covers aspects like development of adequate infrastructure for safe storage

With continuing focus on digitization accelerated by COVID lockdowns and rising demand for sustainability and green goals, there is an increase in activity relating to data centers for operators and investors as well as policymakers and regulators. In order to attract investment in data centers in India with a vision "to make India a global data center hub", the new Government policies intend to provide various incentives and exemptions to promote data center industry growth. In the recent past, several multinational and domestic companies have set up data centers in India. In the 2022 Budget speech, the Finance Minister announced that data centers will be considered as "infrastructure" to facilitate credit availability. In addition to this classification, two other policy initiatives announced in the Budget speech which are expected to incentivize data center investments are the 5G spectrum auction and the widening footprint of optical fiber.

CURRENT REGULATORY FRAMEWORK

India permits 100% foreign investment in data centers, subject only to the condition that investments by an entity of a country which shares land border with India (each such country, a "Restricted Country") or where the beneficial owner of an investment into India is situated in or is a citizen of any such Restricted Country will require prior Government approval.

In November 2020, the Department of Telecommunications ("DoT") issued the New Guidelines for Other Service Providers (OSPs) ("New OSP Guidelines") which specifies that no registration certificate will be required for OSP centers in India. Pursuant to the New OSP Guidelines, "Other Service Provider" has been defined as "…an Indian company, registered under the Indian Companies Act, 2013 or an LLP (Limited Liability Partnership) registered under LLP Act, 2008 or a partnership firm or an organization registered under Shops and Establishment Act or a Legal Person providing voice-based Business Process Outsourcing (BPO) services" (emphasis added). Accordingly, the scope of the New OSP Guidelines do not appear to extend to companies engaged in data-related services. Prior to the issue of the New OSP Guidelines, companies providing data center services obtained registration as an Other Service Provider from the Telecom Enforcement, Resource and Monitoring Cell of the DoT.

In November 2020, the Ministry of Electronics & Information Technology also issued a Draft Data Center Policy 2020 applicable to data center park developers, data center operators as well as the allied ecosystem of the data center sector and took feedback from all stakeholders. The detailed scheme specifying implementation guidelines and incentives (fiscal and non-fiscal) is yet to be published. The Draft Data Center Policy proposes a policy framework for various structural and regulatory interventions, investment promotion in the sector, possible incentivization mechanisms along with an institutional governance mechanism, such as publishing a list of approvals required for operationalization of data centers along with defined timelines and granting a single window clearance in a time bound manner by State Governments and Union Territories for setting up data centers/data center parks. The Draft Data Center Policy also contemplates setting up of at least four Data Center Economic Zones in India under a central scheme as well as demarcation of specific zones by the States for setting up data center parks, which will provide inter-alia pre-provisioned land, power availability at low rates and pre-approved clearances. Further, the Draft Data Center Policy provides that it seeks to encourage joint ventures between foreign investors and domestic companies in the development of data centers.

While certain states such as Karnataka are finalizing their state-specific data center policy, other states such as Maharashtra, Telangana, Tamil Nadu and Uttar Pradesh have adopted their respective state data center policies which seek to provide various concessions and incentives to operators, including real estate support and faster clearances. Maharashtra's policy 2016 provides certain fiscal incentives (such as stamp duty exemption, electricity duty exemption, VAT refund and property tax benefits) for data centers fulfilling certain eligibility criteria. Telangana's Data Centers Policy 2016 provides fiscal incentives (such as power incentives, building fee rebates and land at subsidized costs) as well as non-fiscal incentives (such as exemption from the purview of the Telangana Pollution Control Act (unless otherwise specified), exemption from statutory power cuts, exemption from inspection under specified labor legislations and permissions to file self-certificates). The Tamil Nadu Data Center Policy 2021 offers a single window facilitation portal to ensure time-bound processing of applications and coordination with various agencies and departments to get clearances from them, provides incentives (such as electricity tax subsidies on power, concessional open access charges and cross subsidies, dual power and stamp duty concessions) and permits self-certificates in relation to compliance with maintenance of statutory registers and forms under applicable labor legislations. The Uttar Pradesh Data Center Policy 2021 provides for various incentives to data center park developers as well as data center units, such as interest/capital subsidy, land subsidy, stamp duty exemptions and dual power grid network, as well exemption from inspection under specified labor legislations and permissions to file self-certificates.

DUE DILIGENCE CONSIDERATIONS

Set out below are certain relevant considerations in a legal due diligence exercise involving acquisitions of, or investments in, data centers:

Material Contracts

In order to maintain the customer base, agreements with customers need to be reviewed to ascertain the remaining term of the agreement, consent requirements for the proposed transaction as well as termination rights of the customers and any associated termination charges. Where a significant number of the customer contracts are due to expire soon after the proposed transaction or the proposed transaction requires consent from a material customer, the acquirer/investor could consider including renewal of such material customer contracts and obtaining such third party consent as a condition to closing in the transaction documents. In addition, the extent of any financial liabilities of the data service provider under the customer contracts as well as the circumstances under which such liability may arise should be reviewed as a part of the legal due diligence exercise.

Similarly, contracts with third party service providers (such as agreements with internet service providers, connectivity providers and security providers as well as management and maintenance agreements and power supply agreements which ensure continuous access to power) should be reviewed for their tenure, consent requirements, termination rights and liabilities of the parties to understand the potential risks involved in the business.

Real Estate

The property agreements should be reviewed for the type of property, i.e., freehold versus leasehold. In case of freehold property, independent local counsel opinions should be considered for purposes of title verification. In case of leasehold property, the term of the agreement, renewal options, rent escalation and termination rights of the parties need special attention. Further, the agreements should be reviewed for any consent requirements in case of any change of control or management of the data center provider.

Permits and Approvals

Data centers in India require a number of permits and approvals from the central and state governments for its operationalization. Such permits and approvals should be reviewed for its validity and consent requirements. Further, as a part of the legal due diligence exercise, the data center provider could be requested to confirm compliance with the terms of such permits and approvals.

Compliance with Applicable Data Protection Laws

In India, under the [Indian] Information Technology Act, 2000 and the [Indian] Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, each as amended, in the event that any body corporate possessing, dealing, or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such person will be liable to pay compensation to the person so affected. A body corporate shall be considered to have complied with reasonable security practices and procedures if they have implemented such security practices and standards and have a comprehensive documented information security program and information security policies that contain managerial, technical, operational and physical security control measures that are commensurate with the information assets being protected with the nature of business. In this regard, past breaches or any ongoing investigation or litigation involving non-compliance with applicable data protection laws should be reviewed to identify any associated risks. In addition, a separate technical due diligence may be useful to ascertain if the data service provider has adopted "reasonable security practices and procedures".

Environment, Health and Safety (EHS)

While the validity of EHS permits and any past or ongoing investigations or litigations involving non-compliances in relation to environment, health and safety laws can be identified during legal due diligence, separate EHS audits by external agencies could be considered to identify potential operational risks and to recommend remedial measures.

Employees and Employee Benefits

Employment due diligence must involve a review of the employment contracts and employment policies of the data service provider to ascertain the annual cost to company, employer-employee obligations (including confidentiality obligations) and other terms of employment.

Additionally, any implications of the proposed transaction pursuant to applicable Indian labor legislations, including the [Indian] Industrial Disputes Act, 1947, as amended, should be considered. Further, companies in India are liable to pay social security contributions under the [Indian] Employees' Provident Funds and Miscellaneous Provisions Act, 1952 and the [Indian] Employees' State Insurance Act, 1948, each as amended. The data center provider could be requested to confirm if it provides any other benefits to its employees so that all accrued amounts (including in respect of accrued but unused leave) payable to the employees until the date of transfer are paid prior to closing.

CONCLUSION

The Report of the Joint Committee on the Personal Data Protection Bill, 2019 dated December 2021 recommended that India must gradually move towards data localization and the Government should ensure that a mirror copy of all sensitive and critical personal data already stored abroad be mandatorily brought to India and as such, the Government should prepare a data localization policy which covers aspects like development of adequate infrastructure for safe storage. Given the focus on data localization, there appears to be significant potential for growth for the data centers industry. In this background, the Government's move to grant 'infrastructure' status to data centers and introduce a national data center policy are welcome measures which will promote investments in data centers in India.

Disclaimer – The views expressed in this article are the personal views of the authors and are purely informative in nature.