Digital Sovereignty and Constitutional Autonomy: Reconsidering State Power in the Age of Transnational Internet Governance

The global nature of the internet hasn't erased state sovereignty, but it has fundamentally changed how it works. States are still responsible for protecting rights, securing critical infrastructure, and regulating activities within their borders. However, data, infrastructure, and corporate influence constantly cross borders, even as citizens become increasingly dependent on digital tools for work, education, finance, and public services. The solution isn't as simple as declaring that all data must stay within national borders. While physical location matters, it alone cannot guarantee legal access, operational independence, privacy, or resilience. India’s constitutional framework provides vital checks on digital power. The Puttaswamy ruling establishes privacy as a fundamental right; Anuradha Bhasin ensures that internet restrictions are legally grounded and proportionate; and Shreya Singhal guards against vague curbs on online expression.74 These principles must hold even when the state is pursuing legitimate goals like cybersecurity or public order. They mandate that the state explain its actions and provide avenues for appeal. The Constitution is not separate from digital sovereignty; rather, it defines the boundaries within which sovereign power can be exercised legitimately. Looking at the European Union and the United States shows that data location, legal jurisdiction, and provider control are different issues. International data transfers can be managed through safeguards, and legal access requests can reach far beyond where data is physically stored. The EU model emphasizes the need for strong protections during cross-border data movement and the ability to switch cloud providers easily.75 Meanwhile, the US experience shows why provider obligations and lawful-access procedures can often be more important than where a server is located.76 Neither model is a perfect template for India, but both demonstrate that digital governance requires rules that work across borders.

The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (Act 18 of 2016). The Competition Act, 2002 (Act 12 of 2003). The Constitution of India, 1950. The Digital Personal Data Protection Act, 2023 (Act 22 of 2023). The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), dated Nov. 13, 2025. The Information Technology Act, 2000 (Act 21 of 2000). The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, G.S.R. 139(E), dated Feb. 25, 2021. The Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009, G.S.R. 781(E), dated Oct. 27, 2009. The Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, G.S.R. 780(E), dated Oct. 27, 2009. The Payment and Settlement Systems Act, 2007 (Act 51 of 2007). The Telecommunications Act, 2023 (Act 44 of 2023).