Taxed Out: How and why data centres are becoming a global tax flashpoint

Colin:

Welcome to Ashurst’s Legal Outlook and to the third episode in our Taxed Out series. I’m Colin Little, a partner in Ashurst’s Tax Controversy practice and I’m joined by my colleague, Vanja Podinic.

Today we’re looking at how revenue authorities around the world are approaching data centres, and why these arrangements are drawing more coordinated scrutiny.

We’ll touch on the key pressure points and also outline the practical steps taxpayers can take to manage risk early and build a coherent, evidence-based position across jurisdictions.

Let’s jump into the conversation.

We are observing that Tax authorities are increasingly adopting a “whole of code” approach to data centre arrangements coordinating PE assertions, transfer pricing adjustments, IP and DEMPE analysis, often layered with an anti avoidance lens to test whether substance of how those centres are owned and operated aligns with legal form. It’s integrated and increasingly data driven.

Vanja:

Exactly. And to set the broader context, we’re operating in a digitalised economy where global initiatives like BEPS have reshaped expectations. Tax authorities are still catching up with rapid digitalisation, often testing traditional concepts against business models that don’t map neatly to the tax concepts. Take the permanent establishment concept, authorities are trying to apply the fixed place of business concept, a bricks-and-mortar type approach, to companies operating in jurisdictions solely in the Cloud. The commercial footprint and the tax footprint don’t always align, and that’s where the friction starts.

Colin:

The increasing focus on data centres is a natural extension of that shift. Data centres sit at the crossroads of high value infrastructure, complex supply chains, and the evolving tax landscape. That combination attracts scrutiny from authorities.

Vanja:

The best defence is a holistic self risk review that maps the operational reality against these rules. Identifying evidence gaps early, documenting who does what and where, and maintaining a contemporaneous file that supports both the characterisation and pricing is what allows taxpayers to engage proactively and credibly before issues crystallise into audits and disputes. And in the data centre context the tax narrative is as critical as the commercial architecture.

Colin:

With that framing, let’s start with the risk of creating a permanent establishment. The core question is whether having an interest in a data centre, or even rights to use racks or servers, creates a fixed place of business. A server is tangible, fixed, and can look a lot like a physical business presence. If the equipment is also at the company’s disposal, if you control where the server sits, how it’s configured, and what functions it performs, that points to disposal and therefore potential PE exposure under the OECD model.

Vanja:

But there is potential to carve out activities – even where you have a fixed place of business, the preparatory or auxiliary carve out may exclude certain activities. The test is whether the server’s functions are essential and significant to the overall business so if you’re simply caching content, or backing up data the PE risk is minimised. But if the activities extend to delivering digital services, processing transactions, or running the core application stack through those servers, that’s unlikely to be preparatory or auxiliary.

Colin:

And don’t forget that the PE concept is broadened under certain jurisdictions. Italy is a good example where authorities have pursued hidden PE positions based on the technological network, and Netflix settled a matter with the Italian tax authorities without offices or personnel on the ground, showing us how assertive the analysis can get.

Vanja:

Moving onto transfer pricing. The classic position treats intra group computing power like servers, storage, network capacity as a routine support service. It's important to the business but not the centre of value creation, so its priced on a cost base with a modest mark up for routine functions and limited risk - like electricity or office space.

Colin:

That's where the controversy starts. Some authorities, Germany for example, argue that an in country data centre confers a strategic, non easily replaceable advantage that contributes materially to market success. On that view, cost plus doesn’t reflect scalability and strategic significance. The push is toward upside linked models, particularly where the data centre enables growth in revenues.

Vanja:

The real challenge there is evidence. We look for comparables, but with data centres, genuine third party benchmarks are thin. Intra group providers typically don’t bear market risk because their capacity is consumed within the group. Third party providers, by contrast, do bear market risk and price accordingly, but reliable pricing data isn’t public, so both sides face an evidentiary gap. Which means both cost plus and revenue linked arguments can be hard to substantiate. The response is careful functional analysis, clear documentation, and pragmatic judgment about what the facts actually support.

Colin:

And then data centres that licence intangible assets like software, can attract scrutiny where DEMPE functions, that is, the development, enhancement, maintenance, protection and exploitation functions, are actually performed and controlled. Where companies have arrangements licensing or granting rights to intangible assets to international related parties, the revenue authorities can look to determine whether the DEMPE functions are being exercised by the legal owner or some other entity. This is particularly pertinent in IP migration scenarios, for example where a restructure has resulted in moving legal ownership of the IP to an offshore entity.

Vanja:

We have seen situations where this occurs but the revenue authority has concerns that the original owner still carries out some of these functions, and therefore that there is a risk of mischaracterisation or lack of recognition of activities connected with the intangible assets. To the extent there is a mischaracterisation, tax authorities may seek to make a transfer pricing adjustment, or apply anti-avoidance rules. The focus is on substance over form and who actually exercises control over risk and performs the key contributions.

Colin:

Another area of scrutiny is embedded royalties resulting in failure to pay withholding risk. Authorities are concerned that domestic payments to offshore affiliates may not reflect the use of IP, triggering royalty characterisation and withholding tax. In the data centre context that might come about through bundled technology payments with overall service fees including proprietary software such as cooling optimisation as an example. On the other hand we may have payments linked to embedded IP in hardware, so equipment leased for a data centre compensating the owner of IP beyond merely physically using the equipment. These are fact heavy inquiries and require testing substance against form.

Vanja:

The practical difficulty is that identifying embedded elements takes more than a contract review. Authorities can dissect consideration and apportion part of it to a royalty where the right to use IP is truly being granted. And remember in some jurisdictions there is no statute of limitations with respect to the revenue authority's ability to raise adjustments under withholding tax provisions, so the total liability for failure to pay the withholding tax can quickly add up where historical arrangements have been in place for some time. The Australian High Court’s decision in PepsiCo shows that embedded royalty theories can be contested successfully on the facts, but it’s not a blanket shield, expect continued activity in this space.

Colin:

Stepping back, we’re also seeing different strategies by different authorities. Some adopt the full “whole of code” playbook we described at the start, others target particular elements, for example focusing narrowly on PE creation in server based models. The practical takeaway is that taxpayers need a global approach: one coherent, evidence based policy for data centres that is robust across the different jurisdictions in which they operate, and resilient to tax authorities taking either the integrated or element specific approach. Conduct an integrated risk assessment that maps operational facts to PE, TP, DEMPE, and withholding rules; document who does what and where; surface and close evidence gaps early; and maintain a contemporaneous file that supports your characterisation and pricing. That’s what allows taxpayers to engage proactively and credibly.

Colin:

Thank you for listening to this episode of Legal Outlook. I hope you found this episode insightful.
To subscribe to future episodes of Taxed Out and to hear previous episodes, click on the link in the show notes or search Legal Outlook on Apple Podcasts, Spotify, or wherever you get your podcasts. And while you're there, please feel free to leave a rating or a review. And finally, to learn more about all Ashurst podcasts, visit ashurst.com/podcasts. In the meantime, thanks again for listening, and goodbye for now.