From stringent age verification to strategic computing infrastructure, nations are asserting unprecedented control over their digital domains, forcing Indian tech companies to recalibrate their global ambitions and domestic strategies.
The digital world, once envisioned as a borderless expanse, is increasingly being carved into distinct national territories. This isn’t just about data localisation mandates anymore; it’s about governments actively reshaping the very architecture and user access of online services within their borders. Two recent, yet fundamentally connected, developments underscore this profound shift: Malaysia’s strict new online safety rules for minors and India’s calculated move to diversify its high-performance AI computing infrastructure with a UAE partnership. For Indian startups and tech companies, these aren’t isolated policy footnotes; they are critical signposts for how and where they can innovate, scale, and even operate.
Malaysia’s Digital Fortress for Minors: A Bellwether for Child Protection
Effective June 1, 2026, Malaysia has implemented a sweeping set of online safety regulations under its Online Safety Act 2025 (ONSA) and Child Protection Code (CPC). The headline measure is stark: children under the age of 16 are now legally barred from registering social media accounts. This isn’t a mere suggestion; it’s a hard line enforced by law. Platforms will be required to verify users’ ages, often by linking to government records, and carry significant legal obligations for child protection and content moderation. These measures apply to licensed social media services boasting at least 8 million users within Malaysia, a threshold that captures global giants like Facebook, Instagram, TikTok, and YouTube.
This move goes significantly beyond the parental consent requirements found in many data protection laws, including India’s own Digital Personal Data Protection Act (DPDP Act). Malaysia is moving towards an outright exclusion principle for a significant demographic, placing the onus squarely on platforms to prevent access.
What does this mean for Indian startups and tech companies eyeing Southeast Asia, or even those operating domestically?
1.
Re-evaluate Global Expansion Strategies:
Any Indian social media, gaming, ed-tech, or even content platform considering entry into Malaysia, or indeed the broader ASEAN region, must now bake in extremely robust age-gating and verification mechanisms from day one. This isn’t just about a pop-up asking for a birthdate; it implies integration with national identity systems, a complex and costly undertaking. Startups need to assess if their target demographic in such markets is viable under these new rules.
2.
Product Design and Compliance Overhaul:
For products that could potentially appeal to users under 16, even if not explicitly designed for them, the compliance burden becomes substantial. Indian companies must invest in sophisticated age verification technologies, parental consent workflows (for those just above the exclusion age, if allowed), and enhanced content moderation specific to child safety. This will undoubtedly increase development costs and time-to-market.
3.
A Precedent for India and Beyond:
While India’s current DPDP Act focuses on parental consent for processing children’s data, Malaysia’s outright ban on registration for under-16s could influence future regulatory discussions in Delhi. MeitY and DPIIT have consistently prioritised online safety. Indian policymakers will certainly be observing the effectiveness and challenges of Malaysia’s approach. This signals a global trend where governments are less willing to leave child protection to platform self-regulation, pushing for prescriptive, enforceable measures.
This shift underscores a broader trend: the era of “move fast and break things” is well and truly over, especially when it comes to user demographics deemed vulnerable. Compliance is no longer an afterthought; it’s a foundational pillar of international market entry.
India’s Sovereign AI Gambit: Reshaping the Computing Landscape
While Malaysia focuses on the end-user, India is making strategic moves at the very foundation of the digital economy: artificial intelligence infrastructure. In a significant development on May 15, India forged a partnership with the United Arab Emirates (UAE) to deploy advanced AI supercomputing capabilities on Indian soil. This collaboration involves G42, an AI firm backed by Abu Dhabi’s sovereign wealth fund Mubadala, which will install 64 supercomputers from US chipmaker Cerebras in India. A G42 unit will manage their operation and maintenance, with Cerebras providing technical support.
This initiative is a direct response to the prevailing model where governments and enterprises typically rent AI computing power from a handful of dominant US cloud providers – Amazon, Microsoft, and Google. India, despite already having substantial commitments from these hyperscalers (reportedly $45 billion), and its national AI program running on Nvidia processors, is clearly seeking to diversify and assert greater control over its AI future. The G42 deal introduces a critical second path: owning the machines, having them on Indian territory, and operating them with a non-US partner.
The implications for Indian startups, particularly those at the cutting edge of AI, are profound:
1.
Enhanced Data Security and Sovereignty:
For startups dealing with sensitive data – think fintech, health-tech, defense applications, or those building large language models on proprietary Indian datasets – the prospect of running workloads on domestically owned and operated hardware, managed by a non-US entity, offers a significant boost in data sovereignty and security assurances. This could potentially pave the way for stricter data localisation requirements for AI model training and inference in the future, creating a strategic advantage for those leveraging this new infrastructure.
2.
Access to High-End Compute and Reduced Reliance:
The current reliance on foreign cloud giants, while providing scalability, also comes with geopolitical dependencies and pricing structures dictated by global players. This new infrastructure could provide more tailored, potentially more cost-effective, and certainly more accessible high-performance computing resources for Indian researchers and startups. It fosters a domestic AI ecosystem where advanced capabilities are not solely reliant on external providers, encouraging more ambitious AI R&D within India.
3.
Diversification of AI Supply Chains:
This deal is a clear signal of India’s pragmatic foreign policy and its intent to de-risk its technology supply chains. By partnering with the UAE, India is demonstrating a willingness to forge alliances that support its strategic autonomy in critical technologies. Startups should note this broader geopolitical context: diversifying partnerships can lead to more stable and resilient access to essential tech resources, even amidst global trade tensions.
This strategic pivot by India isn’t just about adding more computing power; it’s about fundamentally altering the power dynamics of AI development. It positions India as a significant player in the global AI landscape, not just as a consumer, but as an owner and operator of critical infrastructure.
The Era of Fragmented Digital Sovereignty: What Startups Must Do
These two seemingly disparate policy moves – one focused on user protection, the other on infrastructure control – are two sides of the same coin: national digital sovereignty. Governments worldwide are moving aggressively to define and control their digital spaces, driven by concerns over national security, economic competitiveness, and citizen welfare.
For Indian startups, the message is clear: the global digital commons are fragmenting, and navigating this new reality requires foresight, agility, and a deep understanding of local regulatory nuances.
Here are three immediate takeaways for Indian startups:
1.
“Global First, Local Always” Product Strategy:
When designing products or expanding into new markets, assume stringent local regulations, especially concerning user data, age restrictions, and content. Build flexibility into your product architecture to adapt to diverse compliance requirements from day one, rather than patching them on later. This will save significant rework and potential penalties.
2.
Diversify Your Infrastructure & Data Strategy:
For AI and data-intensive startups, explore the emerging domestic compute options, including those offered by the new India-UAE partnership. Understand the benefits of sovereign cloud and local data centres, not just for compliance, but for potential performance gains and reduced geopolitical risk. Don’t put all your eggs in one hyperscaler basket, especially for core intellectual property or sensitive customer data.
3.
Engage with Policy Discussions:
The regulatory landscape is evolving rapidly. Indian startups, through industry associations like NASSCOM, IAMAI, or directly with DPIIT and MeitY, must actively participate in policy consultations. Your insights on the practical implications of proposed regulations are invaluable and can help shape frameworks that are both effective and conducive to innovation.
The digital world is no longer a free-for-all. It is an arena where national interests are increasingly dictating terms. Indian tech companies that understand this fundamental shift, and proactively adapt their strategies, will be the ones that thrive in this new, complex global landscape. The days of simply building a great product and hoping it fits everywhere are over. Now, it’s about building a great product that can thoughtfully, and compliantly, navigate the emerging digital borders.
