Data Localization in India: RBI, DPDP and Where Data Must Live

Data localization in India means that certain categories of data must be stored on servers physically located within India. The rules are not uniform — they differ sharply by data type. Payment system data has a hard storage mandate under the Reserve Bank of India. Personal data under the Digital Personal Data Protection Act 2023 can leave India unless the Central Government restricts the destination country. Sector regulators like IRDAI add further layers. If your Indian company uses foreign cloud infrastructure, SaaS platforms, or offshore data centres, you are operating inside a patchwork of obligations that can trigger regulatory action if misread. This post explains each layer, maps your obligations, and gives you a practical path to compliance.

What Data Localization Actually Means

Localization is the requirement that data be stored, and in some cases processed, within a defined geographic territory. It is not the same as data sovereignty (which concerns government access rights) and not the same as data residency (a vendor's commercial promise about server location). Localization is a legal obligation with regulatory teeth.

India has taken a sector-by-sector approach rather than a single economy-wide mandate. This matters because the compliance answer for a health-tech startup differs from that of a fintech differs from that of an HRMS vendor.

The RBI Payment Data Mandate

The clearest and most enforced localization rule in India is the Reserve Bank of India's directive on storage of payment system data. Issued in April 2018, it requires that all data related to payment systems — end-to-end transaction details, payment instructions, customer identifiers — be stored only in systems located in India.

Key points from the RBI's position (see rbi.org.in for the master direction on payment systems):

1. Scope: Applies to all Payment System Operators (PSOs) — card networks, prepaid instrument issuers, payment aggregators, payment gateways, UPI apps
2. Processing: Data can be processed abroad, but the data must be deleted from foreign systems after processing and the copy stored in India
3. Audit trail: RBI must have unfettered access to data and system for supervisory purposes
4. Enforcement: The RBI conducted compliance audits beginning 2018–2019 and major networks including Mastercard, American Express, and Diners Club faced restrictions on new customer onboarding for non-compliance

The DPDP Act 2023: Cross-Border Transfer Rules

The Digital Personal Data Protection Act 2023 (DPDP Act), passed by Parliament and notified by the Ministry of Electronics and Information Technology (MeitY), takes a different and notably more permissive baseline on cross-border transfers compared to GDPR.

Under the DPDP Act, cross-border transfer of personal data is permitted by default — with one key mechanism: the Central Government may, by notification, restrict transfer to specific countries or territories. In other words, the DPDP Act does not impose a blanket localization requirement on personal data. Data can flow to the EU, the US, Singapore, or any other destination unless the Government publishes a restricted list.

What the DPDP Act does require regardless of where data is stored:

1. A valid consent or legitimate use basis for processing
2. Purpose limitation — data used only for the declared purpose
3. Data minimisation — only collect what is necessary
4. Retention limits — erase when purpose is complete
5. Security safeguards — appropriate technical and organisational measures
6. Data Principal rights — right to access, correction, erasure, grievance redressal

Sector-Specific Localization Rules

Beyond the RBI and DPDP Act, Indian sector regulators have issued their own data storage requirements.

Decision Flow: Where Must This Data Live?

graph TD
    A[Data classification required] --> B{Is it payment system data?}
    B -->|Yes| C[Store only in India
RBI Mandate 2018]
    B -->|No| D{Is it insurance / health
or SEBI market data?}
    D -->|Yes| E[Check sector regulator rule
IRDAI / ABDM / SEBI]
    E --> F{Sector rule requires
India storage?}
    F -->|Yes| G[Store in India
Sector compliance required]
    F -->|No or unclear| H[Apply DPDP Act baseline]
    D -->|No| H
    H --> I{Is destination country
on restricted list?}
    I -->|Yes - restricted| J[Block transfer
Store in India]
    I -->|No - permitted| K[Transfer allowed
with DPDP safeguards]
    K --> L[Consent + purpose
+ security controls
must still apply]
    G --> M[Document architecture
for audit readiness]
    C --> M
    J --> M

    style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style E fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style F fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style G fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style H fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style I fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style J fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style K fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style L fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style M fill:#1e3d2f,stroke:#10B981,color:#e2e8f0

Data Categories vs Localization Requirements

xychart-beta
    title "Data Category Localization Stringency"
    x-axis ["Payment Data", "Insurance Data", "Health-ABDM", "SEBI Market", "General Personal", "HR and Employee"]
    y-axis "Localization Stringency 0-10" 0 --> 10
    bar [10, 8, 9, 7, 4, 3]

Data Residency vs Data Sovereignty vs Data Localization

These three terms are frequently conflated:

Data residency is a commercial or contractual arrangement — a cloud provider's commitment that your primary data will not leave a named geography. This is enforceable via contract but has no direct legal status.

Data localization is a statutory or regulatory requirement mandating that specific data types be stored within national borders. Violation triggers regulatory penalties, not just breach of contract.

Data sovereignty is broader — it concerns which government has legal authority to compel disclosure, access, or interception of data. The US CLOUD Act, for example, allows US authorities to compel US-headquartered cloud providers to hand over data regardless of where it is physically stored. An India-region bucket with AWS is locally resident but not fully sovereign from US jurisdiction.

For most Indian compliance purposes, localization (the storage requirement) is the operative concept. Sovereignty becomes relevant when you are handling data for government contracts, defence-adjacent sectors, or critical national infrastructure.

What This Means for Indian Companies Using Foreign SaaS

Foreign SaaS is a large source of unrecognised localization exposure for Indian companies. Common blind spots:

CRM and Sales tools — tools like Salesforce, HubSpot, Zoho (India-hosted) store customer PII. If your customers are Indian data principals, you need to verify the data processing addendum (DPA) and storage region.

HR and Payroll SaaS — employee data (which is personal data under DPDP) flowing to servers in Ireland, the US, or Singapore is permissible under the current DPDP baseline (no restricted country list yet), but that can change by notification.

Payment processing — this is the clearest risk. If your payment gateway, aggregator, or UPI service provider routes transaction data through foreign infrastructure even briefly (and does not delete it after processing), you are exposed to RBI enforcement.

Cloud-based analytics and AI — sending Indian customer data to foreign AI APIs for training or inference may not violate localization law today, but it is worth documenting as a data flow and revisiting once DPDP Rules and Significant Data Fiduciary criteria are notified.

Backup and DR — organisations that use local primary storage but replicate backups offshore create a localization gap that regulators have specifically called out.

Practical Compliance Approach

A structured data localization compliance programme for an Indian SMB or mid-market company should cover these steps:

Step 1: Data Flow Mapping Map every data category you collect, where it is stored, and which vendor handles it. Identify payment data, personal data, and sector-specific data categories explicitly.

Step 2: Classify Against Regulatory Buckets Apply the decision flow above. Payment data gets the strictest treatment. Sector data gets its regulator's rule. General personal data gets the DPDP baseline.

Step 3: Architecture Review Confirm that your cloud configuration matches the classification output. Check primary storage regions, backup destinations, replication rules, and third-party processor agreements.

Step 4: Vendor Due Diligence For every SaaS vendor handling regulated data, obtain a written DPA that confirms Indian-region storage for applicable categories. Reject or remediate vendors that cannot confirm this.

Step 5: Document and Audit Maintain records of your data flows, storage architecture, and DPAs. The DPDP Act's accountability principle and the RBI's audit access requirement both depend on documentation.

Step 6: Security Controls Localization without security is incomplete compliance. Run vulnerability assessments on your India-hosted infrastructure. Bachao.AI, built by Dhisattva AI Pvt Ltd, automates the VAPT process so you can identify security gaps alongside your localization review — start with a free VAPT scan.

The Evolving Regulatory Landscape

India's data localization framework is not static. Key developments to watch:

1. DPDP Rules: MeitY is expected to notify the DPDP Rules that will define Significant Data Fiduciaries, specify additional obligations, and potentially publish the restricted-country list for cross-border transfers. Monitor meity.gov.in for updates.
2. RBI's Digital Payments Guidelines: The RBI continues to issue updates to its master directions on payment systems. Any company in the payments ecosystem should treat rbi.org.in as a primary compliance source.
3. Telecom Act 2023: The Telecom Act introduces new data handling provisions for telecom infrastructure; sector rules are being developed.
4. CERT-In Directions: CERT-In's 2022 directions on cybersecurity incident reporting include logging and system-access requirements that interact with localization architecture — logs stored offshore raise compliance questions.