Data Localisation in India: What Must Be Stored in the Country

The Act lets personal data be transferred outside India, except to countries or territories the central government restricts by notification. It also preserves any other law that gives a higher degree of protection or restriction, so sector rules continue to apply. Under the Rules, Significant Data Fiduciaries may be required to ensure that specified personal data and related traffic data are not transferred outside India. Check for government notifications on both points.

RBI's April 2018 direction requires all payment system providers to store the entire data relating to payment systems they operate only in systems located in India. This covers end-to-end transaction details and information collected, carried or processed as part of a payment message. Processing abroad is permitted, but the data must be deleted from foreign systems and brought back to India within the period RBI specified. For a cross-border transaction, a copy of the domestic leg may also be kept abroad.

Payment data is the strictest case: stored only in India.

Other financial regulators have their own requirements.

A few requirements reach almost every company.

Treat residency as a property of each data class, decided at design time.

The usual failures are indirect: a customer support tool hosted abroad that stores transaction details, error logs with payment data shipped to a foreign monitoring service, or database backups replicated to another country by default. Review every third-party tool that receives regulated data, not only the main database.