Payments: RBI
Since 2018, RBI has required payment system operators to store the full data on payments they handle only in India. Processing can happen abroad, but the data must come back to India within a set time. Fintechs and merchants who handle payment data for operators usually follow the same rule through their contracts.
Logs: CERT-In
CERT-In's 2022 directions require service providers, intermediaries, data centres and companies to keep logs of their ICT systems for 180 days within Indian jurisdiction, synchronise clocks with Indian time servers, and report certain cyber incidents within six hours. Data centres and VPS providers must also keep customer KYC records for five years.
Personal data: DPDP Act
The Digital Personal Data Protection Act, 2023 covers personal data of people in India. It does not ban storing data abroad, but allows the government to restrict transfers to specific countries. It also requires security safeguards, breach notification and clear consent. Many companies keep personal data in India anyway, because it is the simplest way to stay compliant as the rules develop.
Sector rules
- SEBI-regulated entities follow SEBI's framework for cloud services, which expects data to be stored in India.
- Insurers follow IRDAI's data and outsourcing rules.
- Healthcare providers handle sensitive personal data and usually keep it in India.
- Government work often requires empanelled cloud providers.
What this means for hosting
- Choose an Indian data centre for payment, health and financial data.
- Keep backups in the same country as the server.
- Keep 180 days of logs and synchronise server clocks.
- Get your host's written commitment that servers will not be moved without approval.
This guide is general information, not legal advice. Your compliance team or lawyer should confirm what applies to you.