India data localisation for AI and cloud: what must stay in the country

India has no single data localisation law. It has a patchwork: payment data must be stored only in India under a Reserve Bank circular, certain logs must be kept in Indian jurisdiction under CERT-In directions, and larger data handlers face a possible limit on transfers under the DPDP Rules. Most other personal data may move abroad.

This article sorts those rules by what each one actually says, who it covers and how firm the source is. It is a plain language guide for engineers and buyers, not legal advice. Check the current text with counsel before you design around any rule.

Key numbers at a glance

• Reserve Bank of India payment data circular: dated 6 April 2018, gave six months to comply (RBI FAQ on storage of payment system data).
• Data sent abroad for payment processing: must be deleted abroad and brought back to India within one business day or 24 hours, whichever is earlier (RBI FAQ).
• CERT-In log rule: logs of all ICT systems kept securely for a rolling 180 days, within Indian jurisdiction (CERT-In directions dated 28 April 2022).
• CERT-In incident reporting: within 6 hours of noticing an incident (CERT-In directions, 28 April 2022).
• CERT-In subscriber records for data centres, VPS, cloud and VPN providers: kept for 5 years or longer after cancellation (CERT-In directions, 28 April 2022).
• Penalty for not complying with a CERT-In direction under section 70B(7): imprisonment up to one year, a fine up to one lakh rupees, or both (CERT-In FAQs, May 2022).
• DPDP Rules, rule 13: significant data fiduciaries must ensure personal data and related logs are not transferred outside India unless allowed (SCC Online summary, 26 December 2025).
• DPDP Rules, rule 8: logs retained for at least one year from processing (SCC Online, 26 December 2025).
• DPDP Rules timing: rules 1, 2 and 17 to 21 in force on publication; rules 3, 5 to 16, 22 and 23 eighteen months after publication (SCC Online, 26 December 2025).
• RBI Master Direction on IT governance: effective 1 April 2024, issued 7 November 2023, no data localisation requirement in the published text (RBI Master Direction page).
• India's share of global data centre capacity, quoted by experts: about 3 percent, against about 20 percent of global data generated (Free Press Journal, 1 February 2026).
• Budget tax holiday for foreign cloud providers using Indian data centres: until 2047, proposed 1 February 2026 (Free Press Journal).

Three words that get mixed up

Teams often use "data residency", "data localisation" and "data sovereignty" as if they mean the same thing. They do not. Residency is where data is stored. Localisation is a legal rule that data must stay in a country. Sovereignty is about whose laws and authorities can reach the data, wherever it sits. A separate explainer on residency, sovereignty and localisation goes further.

India's rules are mostly about the second word, and they are narrow. They apply to named kinds of data or named kinds of organisations. Nothing in the rules cited here says that all personal data, or all AI training data, must stay in India. That is the first thing worth saying clearly, because it is often assumed.

The strongest rule: payment system data

The clearest localisation rule in India is the Reserve Bank of India circular of 6 April 2018 on storage of payment system data. According to the RBI's own FAQ page, payment system operators must ensure that all payment data they operate is stored only in systems located in India. The data covered is the full end to end transaction detail, including customer data, payment sensitive account details, payment credentials and transaction data. The operators were given six months to comply.

Three details make this rule practical to read.

First, it reaches vendors. The FAQ says the rules cover payment gateways and other third parties engaged by authorised operators, who remain responsible for compliance. If your product handles card or account data for an Indian payment provider, you may be in scope even though you are not a bank.

Second, processing abroad is allowed. The FAQ says there is no bar on processing payment transactions outside India. The condition is about storage. Data sent abroad for processing must be deleted abroad and brought back to India within one business day or 24 hours, whichever is earlier. Settlement abroad after processing must happen on a near real time basis, with data stored only in India.

Third, there are narrow carve outs. A copy of the domestic part of a cross border transaction may be stored abroad if required. Data may be shared with an overseas regulator where needed, with the RBI's approval. Banks that were previously allowed to store banking data abroad may continue, but domestic payment data must still be stored only in India.

For AI teams the lesson is concrete. If a model is trained on, or fed, raw payment records from an Indian payment system, the training copy is itself payment data. Whether a derived feature set or an anonymised sample counts is a question for the regulator or counsel. The FAQ text does not answer it.

A rule people think exists: the RBI IT governance direction

Not every RBI document localises data, and it helps to know which. The RBI Master Direction on information technology governance, risk, controls and assurance practices was issued on 7 November 2023 and, per paragraph 1(c), took effect on 1 April 2024. It applies to commercial banks, non banking finance companies in the top, upper and middle layers, credit information companies and the all India financial institutions such as EXIM Bank, NABARD, NaBFID, NHB and SIDBI. It does not apply to local area banks or core investment companies, and foreign bank branches follow a comply or explain approach.

As published, the direction has no data localisation or residency requirement. It deals with other things. Paragraph 18(b) says the data centre and the disaster recovery site should be geographically well separated, so that one regional event does not take out both. Paragraph 10 asks regulated entities to run vendor risk assessments covering concentration risk, single points of failure and supply chain risk. Paragraph 26(f) says testing approaches may also apply to systems hosted in a cloud environment. So a bank can run AI workloads on a cloud service under this direction without a rule saying the data must stay in India, but other rules, such as the payment circular above, may still apply to specific data.

That distinction matters when a salesperson says "RBI requires everything to be in India". Ask which circular, which data and which regulated entity.

Logs: the CERT-In directions

The CERT-In directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporate and government organisations. Direction (iv) says they must enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days, and that the logs must be maintained within Indian jurisdiction. They must be provided to CERT-In when it asks or alongside an incident report.

The CERT-In FAQs, published in May 2022, soften this in a useful way. Question 35 asks whether a copy of logs must be stored in India only, and the answer says logs may also be stored outside India as long as the obligation to produce them to CERT-In is met in a reasonable time. Question 36 says any service provider offering services to users in the country needs to enable and maintain logs and records of financial transactions in Indian jurisdiction. The FAQ is described by its own text as not a legal document and not a replacement for the Act, so the directions themselves remain the primary text.

Other parts of the same directions affect how you design AI and cloud services. Entities must connect their system clocks to the time servers of the National Informatics Centre or the National Physical Laboratory, or servers traceable to them. Incidents listed in the annexure must be reported within 6 hours. Data centres, virtual private server providers, cloud providers and VPN providers must register subscriber details, including validated names, period of hire, IP addresses, purpose of hire and ownership pattern, and keep them for five years or longer after cancellation. The FAQs add that failing to comply with a direction under section 70B(7) is punishable by imprisonment of up to one year, a fine of up to one lakh rupees, or both.

For AI products, "all ICT systems" is a wide phrase. Prompt gateways, vector databases, model servers and agent runtimes are all ICT systems. Whether you must log every one for 180 days is for your counsel and the entity's own reading of the directions. For more detail, see the articles on whether the directions apply to foreign SaaS and on what to log for 180 days.

Personal data: the DPDP Rules

The Digital Personal Data Protection Rules were notified in November 2025. SCC Online's summary says they stagger the start dates. Rules 1, 2 and 17 to 21 came into force on publication in the Gazette. Rules 3, 5 to 16, 22 and 23, which include consent, retention, breach notification and the duties of significant data fiduciaries, come into force eighteen months after publication. Rule 4 on consent managers is for a later date to be notified. Eighteen months from the November 2025 publication points to around May 2027, but check the Gazette for the exact day.

On transfers, the SCC Online summary says rule 15 allows cross border transfer as long as the data fiduciary meets conditions specified by the Central Government, and that those conditions may differ by recipient country, entity or public authority. PRS Legislative Research, describing the 2023 Bill that preceded the Act, says transfers abroad are allowed except to countries the central government notifies. So the default is open, with the possibility of a restricted list. This is the opposite of a blanket localisation rule.

Rule 13 is the sharper edge. The summary says significant data fiduciaries must ensure that personal data and related logs are not transferred outside India unless allowed, and it does not explain what makes a transfer allowed. A significant data fiduciary is a larger or higher risk category of data handler that the government designates. If your customer is designated, their requirements to you may include keeping specified personal data and logs in India. The summary does not say which data is "specified", so the Gazette text should be read directly.

Rule 8 sets a retention floor of one year for logs from the date of processing, alongside a duty to delete personal data once its purpose is met unless law requires retention, with at least 48 hours' notice to the individual before deletion. Rule 6 asks for reasonable security measures such as encryption, tokenisation, access controls, logging and audits, and backup and recovery, and extends the duty to processors. The articles on DPDP cross border transfers and the DPDP rules timeline cover these in more depth.

Capital markets: check the circular

SEBI issued a circular on 6 March 2023 titled as a framework for adoption of cloud services by SEBI regulated entities. SEBI's circular listing gives only the title, number and date, and does not state the localisation terms or the effective date. So this article makes no claim about what SEBI requires on data location. If you sell to a regulated broker, exchange or asset manager, ask them to quote the paragraph, not the headline.

How this shapes data centre demand

Why does localisation matter to infrastructure? Because rules that tie specific data to India create demand for capacity that serves Indian customers from inside the country. That demand is one of several drivers. It does not by itself explain the building boom.

Experts quoted by the Free Press Journal say India hosts only about 3 percent of global data centre capacity while generating about 20 percent of global data. The same article reports the 1 February 2026 Budget proposal of a tax holiday until 2047 for foreign companies that provide cloud services to customers worldwide from Indian data centres, provided services to Indian customers go through an Indian reseller entity. That combines two things: rules that keep some data in India, and tax incentives that pull export oriented capacity in. The article does not say which taxes are covered or how the reseller rule would work, and it is a proposal in a speech, so the enacted text matters.

For a sense of the capacity side, see the article on India's AI data centres and the IndiaAI Mission, and on the money behind it, the investment pledges decoded. Microsoft's 17.5 billion dollar plan, as reported by Bajaj Broking, includes building systems that keep sensitive data in India, which is an example of vendors responding to the demand these rules create.

A practical checklist for AI and cloud teams

Use these questions in order. They turn the rules above into design decisions.

• What kind of data is it? Payment system data, other personal data, logs, or non personal data each follow a different rule.
• Who is the customer? A bank, a payment operator, a significant data fiduciary, or an ordinary company have different duties.
• Where does each copy live? Training sets, fine tuning sets, embeddings, prompt logs, evaluation sets and backups are all copies.
• Can the vendor and its sub processors prove where data sits and when it is deleted?
• Do the logs meet both the 180 day rule and any longer retention duty, and can they be produced to CERT-In quickly?
• Is there a path to produce records to Indian authorities if asked, wherever the data is stored?

What is firm and what is uncertain

Firm, because the primary or official text states it:

• The RBI payment data circular of 6 April 2018 and its FAQ conditions.
• The CERT-In directions of 28 April 2022, including logs within Indian jurisdiction and the FAQ clarification that copies may be held abroad if records can be produced.
• The RBI IT governance direction of 7 November 2023, effective 1 April 2024, and the absence of a localisation requirement on its page.

Reported through a secondary summary:

• The DPDP Rules content and timeline, from SCC Online. This is a secondary summary, so confirm against the official Gazette text.
• The Bill stage transfer approach, from PRS.

Uncertain:

• Which data is "specified" for significant data fiduciaries under rule 13.
• Which countries, if any, the government will restrict under the DPDP framework.
• The localisation terms of SEBI's 2023 cloud circular, which were not confirmed here.
• How the cloud tax holiday will work in the enacted law.

What to watch next

• The Gazette notification of significant data fiduciaries and any list of specified data.
• Any notification of restricted countries or transfer conditions under rule 15.
• The DPDP commencement date, around May 2027.
• Any update to the CERT-In FAQs that changes how logs held abroad are treated.
• The finance law text on the 2047 tax holiday.

If your team ships software into this market, Safeguard offers SBOM and dependency scanning, and a free scan is available at https://gold.safeguard.sh/scan.

Quick check

Sources

• RBI FAQs on storage of payment system data
• RBI Master Direction on information technology governance, risk, controls and assurance practices
• CERT-In Directions under section 70B(6), 28 April 2022
• CERT-In FAQs on the Cyber Security Directions, May 2022
• Digital Personal Data Protection Rules 2025, key highlights, SCC Online, 26 December 2025
• Digital Personal Data Protection Bill 2023, PRS Legislative Research
• SEBI circular on framework for adoption of cloud services, 6 March 2023
• Union Budget 2026 tax holiday till 2047, Free Press Journal, 1 February 2026
• Microsoft announces 17.5 billion dollar investment in India for AI and cloud, Bajaj Broking

Last reviewed: 19 October 2026.