India does not have one blanket rule requiring every workload in an Indian data center to stay in India. The correct answer depends on the data, the customer’s legal role, the service you provide, where processing occurs, and sector rules. Three regimes are especially important: the Digital Personal Data Protection (DPDP) Act and its phased Rules, CERT-In’s directions for logs and provider records, and the Reserve Bank of India (RBI) rules for payment-system data.
For an operator, “hosted in India” is therefore only one design fact. You must separately map production data, replicas, backups, disaster-recovery systems, telemetry, support access, subprocessors and regulated payment flows. CERT-In can impose direct duties on your facility or service, while a customer can impose additional obligations on you as its processor or payment-service vendor.
As an Amazon Associate I earn from qualifying purchases.
Start with the question India’s rules actually ask
Localization analysis should begin with a workload map, not with a country label. For each service, identify the customer, the categories of data, the purpose and means of processing, every processing location, and the legal instrument that creates the duty. A colocation operator, a managed-hosting provider and a cloud or VPS provider may face different direct obligations even when their servers sit in the same building.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsFour questions for every workload
- What data is involved? Separate digital personal data, payment-system data, security logs, account-registration records and ordinary business data.
- Who decides why and how personal data is processed? That distinction determines whether your customer is acting as a data fiduciary, a significant data fiduciary, or another role, and whether you are operating as a processor or service provider.
- Which sector rules apply? A regulated payment customer can create India-only storage and evidence requirements that do not apply to an unrelated customer.
- Where does each copy or access path exist? Record primary systems, replicas, backups, disaster recovery, observability platforms, support tools and subcontractors separately.
This approach avoids the most common error: treating compliance with one rule, such as keeping a primary database in India, as proof that the entire service is compliant.
#1 Best Overall
DPDP Act and Rules: broad privacy duties, not a universal storage mandate
When the DPDP framework applies
The DPDP Act covers digital personal data processed in India when it was collected digitally or digitized after collection. It also reaches certain processing outside India connected with offering goods or services to people in India. “Processing” is broad and includes storage, retrieval, use, disclosure, erasure and related operations.
Those provisions define the Act’s reach; they do not say that all covered personal data must be stored on Indian infrastructure. A data center may host a customer whose service is subject to the Act without becoming subject to a general India-only storage rule for every byte of that customer’s personal data.
What the transfer provisions mean in practice
The Rules allow the Central Government to prescribe requirements concerning personal data made available to a foreign state or entities under its control. The explanatory note discusses possible restrictions for government-identified data and related traffic data, but that note is non-binding. A deployment decision should rely on notified Rule text and an operative notification, not on a possible future restriction described in explanatory material.
Until a particular restriction is notified and applies to the relevant data, do not describe the DPDP framework as a blanket localization statute. Instead, document the transfer basis, the approved locations, customer instructions and the controls used for access from outside India.
Significant data fiduciaries and the operator’s role
A fiduciary notified as a significant data fiduciary has additional obligations, including a data-protection impact assessment and a comprehensive audit. Those duties attach to the notified fiduciary; they do not automatically attach to every data-center operator serving it.
An operator can still be central to the customer’s compliance. You may need to provide processing instructions, location information, access records, deletion evidence, incident cooperation and audit material. Your own independent duties can arise under CERT-In directions or a sector-specific rule even when the customer remains responsible for its DPDP obligations.
Phased commencement dates
The commencement notification for the Act was issued on 13 November 2025. It brings specified institutional and procedural provisions into force on publication, provisions in a one-year stage, and the principal processing provisions after eighteen months. The Rules use a similar schedule.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Instrument or group | Commencement described in the notification | Practical status on 13 October 2026 |
|---|---|---|
| Specified Act provisions | On publication of the commencement notification | In force from 13 November 2025 |
| Rules 1, 2 and 17–21 | On publication | In force from publication of the Rules |
| One-year Act provisions and Rule 4 | One year after publication | Scheduled for 13 November 2026, subject to the official notification |
| Principal Act provisions and Rules 3, 5–16, 22 and 23 | Eighteen months after publication | Scheduled for 13 May 2027; not yet at that date on 13 October 2026 |
Operators should describe the principal obligations as enacted and scheduled rather than fully operative on the October 2026 date. Before signing a deployment or transfer plan, check the latest Gazette notifications and any amendments, because commencement and transfer requirements can change.
CERT-In: direct duties for covered operators
CERT-In’s directions of 28 April 2022 apply to service providers, intermediaries, data centers, body corporates and government organizations. They are not merely customer instructions: a covered operator can have direct duties even when its customer is in an unregulated industry.
ICT logs must remain available in India for 180 days
The direction states: “All service providers, intermediaries, data centres, body corporate and Government organisations shall mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days and the same shall be maintained within the Indian jurisdiction.”
Operationally, enable logging across covered ICT systems, synchronize time sources, protect logs against alteration, control access, and test retrieval. The retention period is rolling, not a one-time archive. Logs must be capable of being provided to CERT-In with incident reporting or when CERT-In orders or directs their production.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Map the systems that generate logs rather than assuming that an application log alone is sufficient. Network, identity, administrative, security and platform events may be produced by different tools and may otherwise be exported to an overseas observability service. If such a service is used, keep the required copy within Indian jurisdiction and document the retrieval path.
Provider records can require five years or more
The directions require data centers, VPS providers, cloud-service providers and VPN-service providers to register and maintain specified accurate customer and service information. The listed information includes validated customer identity and contact details, the hire period, IP information, registration email, registration IP and timestamp, service purpose, and ownership pattern.
These records must be retained for five years after cancellation or withdrawal of registration, or longer when another law requires a longer period. Build the retention rule into the account lifecycle: cancellation should stop service access where appropriate, but it should not automatically erase the compliance record. Restrict access to the retained material, preserve its integrity, and be able to produce it in a usable form.
Other CERT-In controls
The directions also contain incident-reporting obligations and require a designated point of contact. The exact scope and timing depend on the direction and current CERT-In guidance, so maintain an incident workflow that covers detection, escalation, reporting, evidence preservation and customer coordination. Do not wait for a customer to tell you that a report is required if your own covered activity triggers the direction.
Free tools Windows power users keep installed
One-click scans. No signup required.
RBI payment-system data: a sector rule that can reach your supply chain
The core India-storage requirement
RBI’s 6 April 2018 circular, “Storage of Payment System Data,” directs payment-system providers to store the entire data relating to payment systems they operate only in India. The scope includes full end-to-end transaction details and information collected, carried or processed as part of a payment instruction.
RBI’s wording is direct: “All system providers shall ensure that the entire data relating to payment systems operated by them are stored in a system only in India.” For an affected workload, examine every system that receives, carries, transforms or stores payment instructions, not just the final transaction database.
Why a data-center vendor can be involved
RBI’s FAQ explains that the direction applies to RBI-authorized or approved payment-system providers and extends to transactions through system participants, service providers, intermediaries, payment gateways, third-party vendors and other entities retained or engaged for payment services. The authorized or approved system provider remains responsible for ensuring compliance.
That responsibility commonly flows down through contracts and architecture. A hosting, managed-services or infrastructure vendor should obtain the customer’s scope statement, permitted locations, evidence requirements and approval process for subcontractors. The contract should let the regulated provider verify storage, access, deletion and incident controls.
Foreign processing and the foreign leg
For the foreign leg of a transaction, the circular allows data to be stored abroad when required. The FAQ addresses processing abroad and expectations for returning or deleting data, but the permitted circumstances are nuanced. Do not infer a broad offshore-processing exception from the existence of a foreign leg. Review the FAQ and the customer’s RBI interpretation before placing any payment-related copy, support dataset or analytics feed outside India.
Compare the three regimes before choosing an architecture
| Regime | Primary coverage | Location or retention rule | What an operator should do |
|---|---|---|---|
| DPDP Act and Rules | Digital personal data and its processing; principal duties attach to data fiduciaries and other named roles | No blanket India-only storage rule shown; conditional government transfer restrictions and phased obligations | Identify the customer’s role, data scope, processing instructions and any operative transfer notification |
| CERT-In directions | Listed entities, expressly including data centers and certain service providers | Covered ICT logs: rolling 180 days within Indian jurisdiction; specified provider records: five years or longer where another law requires | Operate India-based log retention, account-record retention, incident reporting and point-of-contact processes |
| RBI payment-data direction | Payment-system providers and their ecosystem, including retained service providers and vendors | Payment-system data stored in India, subject to limited, fact-specific treatment of a foreign transaction leg | Design for the regulated customer’s India storage, evidence and approval requirements |
A practical workload-mapping procedure
- Create a service inventory. List colocation, managed hosting, cloud, VPS, backup, disaster recovery, support and security services separately. Record the customer and the systems used for each.
- Classify the data. Mark digital personal data, payment-system data, provider-registration records, security logs and non-sensitive operational data. Record whether data is collected digitally or digitized later.
- Assign legal roles. Ask who determines the purpose and means of personal-data processing. Record whether the customer is a data fiduciary or has been notified as a significant data fiduciary, and whether you act on documented instructions.
- Screen for sector rules. Ask whether the customer is an RBI-authorized payment-system provider, participant or supplier in its payment ecosystem. Obtain the customer’s written scope and flow-down controls.
- Map every location. For each data class, record the country and region for primary storage, replicas, backup, disaster recovery, telemetry, support access, remote administration and subprocessors.
- Test CERT-In coverage. Confirm that the entity and service fall within the directions, then verify 180-day Indian log retention, secure storage, retrieval and incident-reporting procedures. For covered offerings, verify the customer-record fields and five-year-or-longer retention.
- Document transfer decisions. For any access or copy outside India, identify the operative legal basis, customer instruction, security control and deletion or return condition. Do not rely solely on a statement that the primary database is in India.
- Recheck before go-live. Review current MeitY notifications, CERT-In updates, RBI directions and the customer contract immediately before deployment and after material architecture changes.
Architecture and contract controls that make the map usable
Separate production, resilience and observability
Use an explicit location register for production databases, object storage, snapshots, replicas, disaster-recovery sites and test environments. Treat telemetry as its own data flow: logs can contain identifiers, IP addresses, tokens or transaction context. Support tooling can create another copy when an engineer exports a ticket or diagnostic bundle.
Make Indian log retention resilient
Use redundant storage within Indian jurisdiction, access controls and tamper-evident mechanisms. Test a request for a specific time window and system. A policy that says “180 days” is not enough if an operator cannot retrieve complete records or establish that the clock is rolling continuously.
Control people and subcontractors
Limit administrative access by role, record privileged actions and define when overseas support is permitted. Maintain a current list of subprocessors and their locations. For payment workloads, require prior approval for a new subprocessor or location where the regulated customer’s instructions demand it.
Recommended Free Tools
Write evidence obligations into the contract
Useful clauses address permitted locations, subcontracting, access, incident notification and cooperation, audit evidence, deletion or return, retention, customer instructions and legal holds. They should distinguish your independent CERT-In duties from services performed as the customer’s processor or vendor. The legal instruments do not prescribe one standard data-center contract or universal architecture, so the clauses should match the actual service and data flows.
Common deployment mistakes and how to correct them
- Mistake: “India hosting means everything is localized.” Fix: inventory backups, logs, support access, analytics and subprocessors; each can be in a different location.
- Mistake: treating DPDP as an immediate blanket ban on overseas storage. Fix: check the current commencement stage and any operative government notification, then document the customer’s transfer decision.
- Mistake: retaining logs in an overseas security platform only. Fix: keep the required rolling 180-day copy within Indian jurisdiction and test production of the records.
- Mistake: deleting account records when a VPS or cloud customer cancels. Fix: preserve the specified identity, registration and service records for five years after cancellation or longer where another law applies, with restricted access.
- Mistake: assuming RBI duties stop with the payment provider. Fix: obtain the provider’s written requirements and build vendor, subprocessor and audit controls into the service.
- Mistake: relying on a future rule or an explanatory note. Fix: base decisions on notified legal text and current official guidance, and set a review trigger for amendments.
Governance for changing commencement and sector rules
Assign an owner for regulatory monitoring and keep a dated register of the Act, Rules, commencement notifications, CERT-In directions and RBI materials used for each service. Link each control to a workload and an evidence artifact, such as a location report, retention test, access record, incident drill or customer approval.
Review the register when a customer adds payment functionality, when a new region or support provider is introduced, when a backup platform changes, and before a cross-border transfer. The status on 13 October 2026 is not a permanent safe harbor: the one-year DPDP stage is scheduled for 13 November 2026 and the eighteen-month stage for 13 May 2027, subject to the official notifications in force at those times.
The defensible operating position is workload-specific: keep CERT-In logs and required provider records in the Indian jurisdiction, design payment workloads to meet the regulated provider’s India-storage duty, and treat DPDP location questions as a role-and-transfer analysis rather than an automatic India-only rule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
