India as Plan B: Why Gulf Financial Institutions Are Eyeing Mumbai and Chennai After the Strikes

Within 48 hours of the AWS Bahrain strikes, data center operators in Mumbai and Chennai reported a surge in inbound inquiries from Gulf-based financial institutions. The pattern was unmistakable: banks, insurers, and payment processors that had deployed workloads in Gulf cloud regions were looking for alternatives — fast.

India's appeal as a migration destination is not accidental. The country has invested heavily in data center infrastructure over the past five years, driven by both domestic demand and a strategic ambition to become a regional digital hub. Mumbai alone now hosts over 600 MW of operational data center capacity, with Chennai adding another 400 MW. The combined ecosystem offers what Gulf financial institutions need most urgently: geographic separation from the conflict zone, modern carrier-neutral facilities, and connectivity to both European and Asian markets.

But migration is not a simple failover. The regulatory, technical, and operational complexities of moving financial workloads from the Gulf to India under crisis conditions are substantial. This analysis examines the opportunity, the obstacles, and the DORA implications.

India's Data Center Ecosystem: Ready for the Moment

India's data center market has grown at a compound annual rate of approximately 25% since 2021, driven by domestic digital transformation (UPI payments, Aadhaar-linked services) and increasing foreign investment. The major hyperscalers — AWS, Azure, Google Cloud — all operate multiple availability zones in Mumbai, with AWS also present in Hyderabad.

Chennai is particularly significant for submarine cable connectivity. The city serves as a major cable landing station for routes connecting Southeast Asia to Europe — routes that bypass the Persian Gulf entirely by transiting the Indian Ocean and connecting to Mediterranean cables via the southern tip of India and the African coast.

The Migration Challenge: Not a Simple Failover

Financial institutions migrating from Gulf cloud regions to India face several categories of complexity that make this far more than a technical lift-and-shift operation.

Data Sovereignty and Cross-Border Transfer

Gulf states — particularly the UAE, Saudi Arabia, and Bahrain — have implemented data localization requirements that restrict certain categories of data from leaving national borders. A bank operating in the UAE under CBUAE regulations may face legal constraints on migrating customer data to Indian servers, even in an emergency.

The paradox is acute: the data may be physically inaccessible in a destroyed or unreachable data center, but legally restricted from being moved to a functioning one. Financial institutions that did not establish cross-border data transfer frameworks in advance are now navigating emergency regulatory processes.

For DORA-regulated entities, this intersects with the regulation's exit strategy requirements. A viable exit strategy must account for data sovereignty constraints — the plan must specify not just where data will go, but the legal basis for moving it there.

Latency Trade-offs

The move from Gulf to India introduces latency changes that affect different applications differently:

For most banking operations, the latency increase is manageable. The challenge is that financial institutions with real-time trading operations or ultra-low-latency API integrations with Gulf-based counterparties will need to rearchitect those connections.

Capacity Availability

India's data center market, while growing rapidly, is not infinite. The sudden influx of demand from Gulf migrations is creating a capacity crunch in Mumbai, particularly for rack space with the power density and cooling requirements that enterprise financial workloads demand.

Data center operators report that premium colocation space in Mumbai's primary facilities (Airoli, Panvel, Chandivali) is effectively sold out through Q2 2026, with waitlists extending into Q3. Chennai has more availability but less connectivity diversity.

DORA Compliance Implications of Gulf-to-India Migration

For EU-regulated financial institutions with Gulf operations, the migration to India raises several DORA compliance considerations.

Register of Information Updates

DORA Article 28 requires financial entities to maintain a register of information on all ICT third-party arrangements. A migration from AWS Bahrain to AWS Mumbai changes the cloud region, the data jurisdiction, and potentially the contractual entity (AWS's legal entities differ by region). All of these changes must be reflected in the register.

Concentration Risk Reassessment

Moving workloads from one cloud provider region to another does not necessarily reduce concentration risk — it may just relocate it. If a significant number of Gulf-based institutions all migrate to Mumbai simultaneously, the concentration risk shifts from Bahrain to Mumbai. The Article 29 assessment must be updated to reflect the new geographic reality.

Third-Party Due Diligence

Indian data center operators that were not previously in a financial institution's ICT third-party register may need to undergo due diligence under DORA Article 28-30. This includes assessment of the operator's business continuity arrangements, security posture, and ability to support the institution's exit strategy.

India's Regulatory Landscape: What Financial Institutions Must Know

India's data protection framework is governed by the Digital Personal Data Protection Act (DPDPA) of 2023, which establishes data fiduciary obligations and restricts cross-border transfers to jurisdictions notified by the central government. The Reserve Bank of India (RBI) has additional requirements for financial data, including a directive that payment data be stored within India.

For Gulf financial institutions migrating to India, this creates a regulatory overlay that must be navigated carefully:

1. RBI data localization: Payment transaction data must be stored in India if the institution processes Indian payments. For Gulf banks migrating non-Indian workloads to Indian servers, this directive does not directly apply — but the infrastructure may still be subject to RBI inspection requirements.

1. DPDPA obligations: Financial institutions processing Indian personal data become data fiduciaries under DPDPA, with obligations around notice, consent, and data principal rights. Even institutions not targeting Indian customers may inadvertently process Indian personal data through correspondent banking relationships.

1. CERT-In incident reporting: India's Computer Emergency Response Team requires reporting of cyber incidents within 6 hours. This is faster than DORA's 4-hour initial notification for major incidents, creating a dual-reporting obligation.

The Long-Term Opportunity: India as Financial Infrastructure Hub

Beyond the immediate crisis response, the Gulf-to-India migration may catalyze a longer-term structural shift. India's combination of engineering talent, competitive costs, growing cable connectivity, and the world's largest real-time payment system (UPI) positions it as a natural financial technology infrastructure hub.

The EBA has been encouraging financial institutions to diversify their geographic dependencies. India offers a credible diversification option that is neither in the Gulf conflict zone nor dependent on Gulf-routed cable infrastructure.

For DORA-regulated entities, the key is to approach India not as a panic migration destination but as a strategic diversification that strengthens long-term operational resilience. This means conducting proper exit strategy planning, updating concentration risk models, and building India into the multi-region architecture rather than treating it as a temporary refuge.

The Gulf strikes have created urgency. The question is whether financial institutions will respond with strategic thinking or panic. The ones that get it right will emerge from this crisis with a more resilient, more distributed infrastructure that serves them long after the current conflict ends.

---

Voir aussi: Data Centers Are Now Military Targets | Submarine Cables Through the Strait of Hormuz | Multi-AZ Assumptions Shattered

---

Resume en francais

Suite aux frappes sur les installations AWS a Bahrein et a la fermeture du detroit d'Ormuz, les operateurs de centres de donnees a Mumbai et Chennai ont signale une hausse des demandes d'institutions financieres du Golfe. L'Inde offre une alternative credible : plus de 1 000 MW de capacite operationnelle, des installations neutres vis-a-vis des operateurs, 15+ atterrissages de cables sous-marins a Chennai contournant le Golfe, et une separation geographique de la zone de conflit. Cependant, la migration n'est pas simple : les contraintes de souverainete des donnees des Etats du Golfe, les compromis de latence (30-60ms vs 5-15ms), et la saturation des capacites a Mumbai compliquent l'execution. Pour les entites reglementees par DORA, la migration necessite une mise a jour du registre d'information (Art. 28), une reevaluation du risque de concentration (Art. 29), et une due diligence sur les operateurs indiens. L'opportunite a long terme est de positionner l'Inde non comme un refuge temporaire mais comme un element structurel d'une architecture multi-region resiliente.