Mumbai, 17 September 2026 India’s data centre expansion is creating concentrated risks across power, construction, water, cyber and operations, according to new research from Howden, the global insurance broker. The findings call for an integrated approach from site selection and design through construction and operation to build resilience and secure insurance.
Howden’s analysis identifies power infrastructure as the biggest risk factor. The challenge is not just generation capacity but reliable grid connectivity, substation capacity and redundancy at each location.
Between 2016 and 2025, the power consumed by data centres built in India grew 68-fold, at a 60% CAGR as per the recent S&P data. The demand is forecast to reach 57 TWh by 2030. Increasingly, hyperscale campuses are looking to on-site, behind-the-meter generation to ensure a reliable supply. This changes the underwriting risk profile and increases the importance of location-specific power resilience assessments. Reliable, efficient supply is a commercial priority and energy accounts for about 65% of operating costs. Power resilience is especially crucial in these markets, with Maharashtra, Telangana and Karnataka accounting for approximately 70% of the capacity.
Construction at live sites raises business interruption risk
India added 7 million square feet of data centre space in 2025, with construction volumes growing at a 37% CAGR since 2016, the S&P data indicates. The average size of a new facility rose from 59,000 square feet in 2016 to 276,000 square feet in 2025, concentrating greater asset values at individual sites.
Between 2026 and 2030, planned expansion at existing data centres is equivalent to 78% of their current footprint. Construction alongside sensitive, high-value operations increases the risk of physical damage and business interruption, particularly during testing and commissioning. Construction and operational risks therefore need to be assessed within a single programme.
Redundancy does not remove outage and cyber risk
More than 90% of Indian data centres have redundancy built into their UPS, generator and cooling systems. However, outages still occur, often because of system failures that cause no physical damage and may not trigger traditional insurance. The market is developing solutions such as parametric cover, particularly for retail and wholesale providers. These providers account for 86% of India’s data centres and carry uptime commitments to multiple customers.
These facilities also face the greatest systemic cyber exposure. A single compromise can affect the systems and workloads of hundreds of thousands of tenant organisations, while interconnected tenants increase the risk of lateral movement. Cyber risk therefore needs to be considered alongside property, power and operational exposures.
Water and Environment risks need early attention
Most data centres are located in urban centres where water availability is already under pressure. Cooling a 1 MW facility can require around 25.5 million litres of water annually. Water use, renewable power sourcing, energy efficiency, power usage effectiveness (PUE) and carbon footprint should form part of early site planning and risk assessment, rather than being addressed after construction.
Amit Agarwal, CEO, Howden India, said: “India’s data centre story is not only about adding capacity. Power reliability, construction at operating sites, cyber concentration and water stress can all affect uptime. These risks need to be identified early and managed together, with insurance designed around the exposures that remain. This will help operators protect their assets and avoid gaps in cover as the sector expands.”
Alongside risk transfer, the report highlights the need to build water and environment considerations into data centre planning from the start. This includes renewable power sourcing, energy efficiency and PUE, water availability and consumption, and the carbon footprint of large campuses. It also points to gaps in existing policy and insurance frameworks: water use is not adequately addressed, non-damage outages may fall outside traditional cover, and construction, power, cyber and operational risks are often treated separately. Closing these gaps will require stronger site-level risk assessment and more integrated insurance programmes.