India Cloud Data
Localisation Framework
Comprehensive compliance reference for cloud data residency requirements under RBI, SEBI, DPDP, IRDAI, and MeitY frameworks. Understand what data must stay in India, cross-border transfer rules, and cloud vendor obligations.
Last updated for DPDP Act 2023 and RBI Master Direction 2021.
All payment system data generated in India must be stored only in India. Banks and payment companies are prohibited from mirroring payment data abroad.
Payment System Data — India Only
Entire data related to payment systems operated in India must be stored in India. Includes end-to-end transaction data, customer data, and payment intermediary data.
No Mirroring Abroad
Data cannot be mirrored or replicated outside India — even for backup or DR purposes. Foreign processing and storage of Indian payment data is prohibited.
Compliance Certification
System Audit Report (SAR) must be submitted to RBI within 6 months confirming data stored exclusively in India. Annual submission required thereafter.
Foreign Processing — Limited
For international transactions, data can be processed abroad but must be deleted within 24 hours of processing. A copy must be brought back to India.
AWS/Azure/GCP Regions
All cloud regions used for payment data must be India-based. Mumbai (ap-south-1), Pune, Hyderabad regions qualify. Data must not replicate to Singapore, US, or EU regions.
Core Banking Data
RBI IT Framework 2016 requires all core banking solution (CBS) data and critical systems to be hosted in India. DR sites must also be in India.
SEBI-regulated entities (stock brokers, AMCs, depositories) must store market activity and investor data in India. Cloud adoption is permitted with specific controls.
Market Activity Data — India
All trading data, investor KYC, portfolio data, and order books must be stored and processed in Indian data centres. This includes primary and backup systems.
Cloud Service Provider Requirements
CSPs used by SEBI entities must be onboarded/registered with SEBI. Data must remain within India. CSP must allow regulatory audits and inspections.
Exit Strategy
SEBI mandates documented exit strategy from cloud providers. Data portability must be ensured. Dependency on single CSP should be managed with multi-cloud or hybrid approach.
Non-Critical Data Abroad
Non-critical data (marketing analytics, non-investor personal data) can be stored abroad subject to DPDP Act provisions once notified.
Data at Rest & Transit
All investor data must be encrypted at rest (AES-256) and in transit (TLS 1.2+). Encryption keys must be held by the regulated entity, not the CSP alone.
DPDP Act passed Aug 2023. Rules and notification dates pending as of 2026. Cross-border transfer restrictions will apply once notified. Prepare now.
Personal Data Definition
Any data about an identifiable Indian person — name, email, phone, Aadhaar, financial data, health data, location, biometrics. Applies to all Data Fiduciaries processing Indian personal data.
Cross-Border Transfer Rules
Personal data can only be transferred to countries notified by Central Government (whitelist). Transfer to non-notified countries requires explicit consent and government approval.
Financial Penalties
Up to ₹250 Crore (≈$30M) for significant data breaches. Up to ₹200 Crore for failing to implement security safeguards. Up to ₹10,000 per individual for consent violations.
Consent & Purpose Limitation
Explicit informed consent required for personal data processing. Data can only be used for specified purpose. Consent must be withdrawn as easily as given.
Significant Data Fiduciary
Large processors (volumes TBD) designated as SDF face additional obligations: Data Protection Impact Assessment, Data Audits, Data Protection Officer appointment.
What Cloud Teams Must Do Now
Map all personal data flows. Identify cross-border transfers. Implement consent management. Prepare Data Processing Agreements with cloud vendors aligned to DPDP.
All insurance data including policyholder data, claims data, and actuarial data must be stored in India. Cloud-first approach is supported with local storage requirement.
Policyholder Data — India
Complete policyholder records, claims history, nominee details, premium data, and medical underwriting data must be stored in IRDAI-compliant Indian data centres.
Cloud Vendor Approval
Cloud service providers must be approved by IRDAI. Unapproved CSPs cannot be used for insurance data. Vendors must meet IRDAI IT security standards.
Right to Inspect
IRDAI has right to inspect physical infrastructure hosting insurance data. CSPs must agree to regulatory audit access. Third-party audits required annually.
Breach Notification
Any data breach affecting policyholder data must be reported to IRDAI within 6 hours. Detailed incident report within 72 hours. RCA within 30 days.
Analytics Workloads
Anonymised or pseudonymised data can be processed abroad for analytics, AI/ML model training, and actuarial modelling — subject to re-identification controls.
Ministry of Electronics and IT mandates government and critical sector cloud workloads use MeitY-empanelled cloud service providers. Covers G-Cloud, data embassies, and sovereign cloud.
MeitY Empanelled CSPs Only
All government workloads must use MeitY empanelled CSPs. Currently empanelled: AWS, Azure, Google Cloud, NIC (NIC Cloud), Meghraj, Oracle, IBM.
Government Data Classification
Government data classified as: Top Secret, Secret, Confidential, and Open. Top Secret/Secret data cannot go to public cloud — must use on-premise or NIC Cloud.
CERT-In Compliance
Cloud infrastructure used for Critical Information Infrastructure (CII) must comply with CERT-In directives including mandatory incident reporting within 6 hours.
AI Compute & Data Sovereignty
IndiaAI Mission requires AI training data for government use cases to reside in India. Sovereign AI compute policy requires India-based GPU/TPU infrastructure for sensitive AI workloads.
Public/Open Data — No Restriction
Non-personal, non-sensitive public government data can be hosted anywhere. Open Government Data Portal data has no localisation restrictions.
🔍 India Data Localisation — Gap Assessment Tool
Select your organisation type and data categories to generate a tailored compliance checklist covering applicable Indian data residency regulations.
India Regions
ap-south-1 — Asia Pacific (Mumbai)
ap-south-2 — Asia Pacific (Hyderabad)
Both qualify for RBI, SEBI, IRDAI data localisation compliance.
India Regions
Central India — Pune
South India — Chennai
West India — Mumbai (paired with South India)
India Regions
asia-south1 — Mumbai
asia-south2 — Delhi
Both qualify for regulatory compliance. VPC Service Controls can enforce perimeter.
Technical Controls
Use cloud-native guardrails to enforce localisation: AWS SCPs, Azure Policy, GCP Org Policy. Backup and replication rules must explicitly deny cross-region to non-India zones.