Data Localization Laws in India: RBI and DPDP Requirements for Companies

Data localization in India is no longer a policy discussion; it is a compliance reality that affects every company handling payment data, personal data, or sector-regulated information within Indian territory. The Reserve Bank of India's April 2018 circular made India one of the first major economies to mandate that all payment transaction data must be stored exclusively on domestic servers. The Digital Personal Data Protection Act, 2023 (DPDP Act) added a new layer by governing cross-border transfer of personal data, with the Central Government holding the power to restrict transfers to specific countries. For any business operating in India, whether a fintech startup processing UPI payments or a multinational IT firm serving Indian clients, understanding these two frameworks and the sector-specific rules around them is no longer optional. Here is a complete breakdown of what the law requires, who it applies to, and what compliance actually costs.

What is Data Localization?

Data localization is the legal requirement that certain types of data generated within a country must be stored, processed, or both, on servers physically located within that country's borders. It is distinct from data sovereignty (the idea that data is subject to the laws of the country where it is collected) and data residency (a company's voluntary choice to store data locally). Data localization is a government mandate backed by penalties.

India's approach to data localization is not a single, unified law. Instead, it is a patchwork of sector-specific regulations, RBI directives, and the overarching DPDP Act 2023. The RBI demands absolute localization of payment data. The DPDP Act takes a more permissive stance on personal data but reserves the government's right to block specific countries. Sector regulators like TRAI, IRDAI, and the National Health Authority add their own storage requirements for telecom, insurance, and health data. This multi-layered structure means that a single company may need to comply with three or four different localization regimes simultaneously, depending on the type of data it handles.

For businesses planning their data infrastructure, understanding which framework applies to which data category is the first step. Getting it wrong does not just mean a fine; for payment companies, it can mean losing the authorization to operate entirely.

RBI Data Localization Mandate: The April 2018 Circular

On April 6, 2018, the Reserve Bank of India issued circular RBI/2017-18/153, titled "Storage of Payment System Data." This single directive changed the data infrastructure of every payment company operating in India. The circular stated that all system providers authorized by the RBI to operate payment systems must store the entire data relating to payment systems operated by them in a system only in India. The compliance deadline was six months from the date of the circular: October 15, 2018.

The scope of "entire data" under this circular is broad. It covers the full end-to-end transaction details collected, carried, and processed as part of the message or payment instruction. This means customer credentials used for transaction authentication, transaction data (amount, date, time, merchant details), payment processing information (authorization, settlement, clearing records), and any data stored in the payment system's ecosystem. There is no de minimis threshold; even a single UPI transaction's data must reside in India.

Who Must Comply with the RBI Mandate

The circular applies to all payment system operators and participants authorized or approved by the RBI under the Payment and Settlement Systems Act, 2007. This includes banks offering digital payment services, prepaid payment instrument (PPI) issuers (digital wallets), UPI service providers, card payment networks (Visa, Mastercard, Rupay), payment aggregators and payment gateways, white label ATM operators, and cross-border money transfer operators. Both domestic and foreign entities are covered. When Mastercard and Visa were initially found non-compliant, the RBI restricted Mastercard from onboarding new Indian customers, a decision that stood for over a year and cost Mastercard significant market share.

The Foreign Processing Clarification

The RBI later clarified that the mandate does not prohibit processing of transactions outside India. If the foreign leg of an international transaction requires data to be processed on overseas servers (for example, a cross-border card payment routed through a foreign acquiring bank), the processing can occur abroad. However, the data must be deleted from the foreign server within the prescribed period, and a full copy must be stored on Indian servers. This "store here, process there if needed" approach gives some operational flexibility to companies with global payment infrastructure while maintaining the localization requirement for stored data.

DPDP Act 2023: Data Localization Provisions

The Digital Personal Data Protection Act, 2023 takes a fundamentally different approach to data localization than the RBI. Rather than mandating that all personal data must stay within India, the DPDP Act permits cross-border data transfers by default and reserves the Central Government's right to restrict transfers to specific countries through notification. This is closer to a "blacklist" model than the RBI's "whitelist only India" approach.

Section 16 of the DPDP Act states that the Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to any country or territory outside India. Until such a notification is issued for a specific country, transfers to that country are permitted. As of March 2026, the Central Government has not formally restricted any country under this provision. This means that, in practice, Indian businesses can currently transfer personal data to any foreign jurisdiction under the DPDP Act, subject to the general compliance obligations of the Act (consent, purpose limitation, security safeguards, and breach notification).

How DPDP Differs from the Earlier Data Protection Bill

The earlier Personal Data Protection Bill, 2019 had proposed a much stricter approach. It introduced the concept of "critical personal data" that could only be processed within India, and "sensitive personal data" that could be transferred abroad only under specific conditions. The DPDP Act 2023 dropped both these categories entirely. There is no classification of data into sensitive, critical, or general under the current law. All digital personal data is treated under one framework, and the cross-border transfer restriction is binary: a country is either restricted or it is not.

This simplification is significant for businesses. Under the 2019 Bill, companies would have needed to classify every data field as general, sensitive, or critical and apply different storage rules to each. Under the DPDP Act, the only question is: is the destination country on the restricted list? If not, the transfer is permitted. This reduces classification complexity but places the compliance burden on monitoring government notifications for any new country restrictions.

Sectors with Data Localization Requirements

Beyond the RBI mandate and the DPDP Act, several Indian regulators impose sector-specific data localization obligations. These rules operate independently and often predate the DPDP Act. A company operating across multiple regulated sectors may need to comply with all of them simultaneously.

BFSI: The Strictest Regime

The banking, financial services, and insurance (BFSI) sector faces the most stringent data localization requirements in India. The RBI's payment data mandate is absolute: there are no exceptions based on company size, data volume, or transaction type. Every authorized payment system operator must store every piece of payment data on Indian servers. Banks that offer digital banking, net banking, mobile banking, and UPI must ensure that all transaction data from these channels is stored domestically. This requirement extends to foreign banks operating in India through subsidiaries or branches, and to global card networks like Visa, Mastercard, and American Express that process Indian transactions.

Telecom: Emerging Obligations

The Telecommunications Act, 2023 gives the Central Government the power to mandate data localization for telecom companies through rules. Section 22 authorizes the government to require that specified categories of telecommunication data be stored and processed within India. TRAI has already recommended that call detail records (CDRs) and subscriber information be maintained on servers within India. Telecom companies with operations across multiple countries must ensure that Indian subscriber data is ring-fenced and stored locally, even if their global infrastructure runs on cloud platforms with data centres outside India.

Healthcare: ABDM Framework

Under the Ayushman Bharat Digital Mission (ABDM), health information exchange platforms, health locker providers, and entities handling electronic health records must store data within India. The National Health Authority's Health Data Management Policy requires that all health data of Indian citizens be stored and processed within the territory of India. This affects hospitals, clinics, telemedicine platforms, health-tech startups, and diagnostic labs that participate in the ABDM ecosystem. Companies building health apps that integrate with the ABHA (Ayushman Bharat Health Account) system must use India-based servers for all patient data.

RBI Mandate vs DPDP Act vs Sector-Specific Rules: Comparison

The three layers of data localization in India often confuse businesses because they differ in scope, strictness, and enforcement mechanisms. The table below compares the key parameters across all three frameworks to help you identify which rules apply to your business.

The critical takeaway: if your business processes payment data, the RBI mandate overrides the DPDP Act's more permissive approach for that specific data category. Payment data must stay in India regardless of the DPDP Act's cross-border provisions. For non-payment personal data, the DPDP Act applies. For sector-regulated data, the sector-specific rule takes precedence.

Impact on Foreign Companies Operating in India

Foreign companies entering the Indian market face data localization as one of their first compliance challenges. The impact varies significantly based on the nature of business operations and the type of data involved.

Global payment networks like Visa, Mastercard, and PayPal were among the first to feel the force of the RBI mandate. When Mastercard failed to meet the compliance deadline, the RBI barred it from onboarding new domestic customers in India from July 2021. The restriction lasted until June 2022, costing Mastercard an estimated 10 to 15 percentage points of market share to competitors who had complied on time. This enforcement action sent a clear signal: the RBI treats data localization violations as seriously as it treats financial regulation violations.

For foreign SaaS companies, IT service providers, and e-commerce platforms, the impact is less immediate but still significant. If a foreign company stores personal data of Indian customers or employees, the DPDP Act applies to its data processing activities. While cross-border transfers are currently permitted, the company must be prepared to localize data if the country where its servers are located is added to the government's restricted list. Foreign companies that register a Private Limited Company subsidiary in India often find it operationally simpler to use Indian cloud infrastructure from the start, avoiding the risk of forced migration later.

Compliance Path for Foreign Companies

Foreign companies should take these steps to address data localization: conduct a data mapping exercise to identify which data categories are subject to Indian localization rules; separate payment data from other personal data and ensure payment data is exclusively stored on Indian servers; use Indian cloud regions (AWS Mumbai/Hyderabad, Azure Pune/Mumbai/Chennai, Google Cloud Mumbai/Delhi) for regulated data; include data localization clauses in vendor and partner contracts; and set up monitoring processes to track government notifications on country-specific transfer restrictions under the DPDP Act.

Impact on Indian Companies Serving Global Clients

Indian IT companies, BPOs, and SaaS firms that serve international clients face a dual compliance challenge. They must comply with Indian data localization rules for data they generate and collect domestically, while simultaneously meeting the data protection standards of the countries their clients operate in (GDPR for EU clients, CCPA for California-based clients, PDPA for Singapore clients, and so on).

The DPDP Act's relatively permissive cross-border transfer stance is helpful here. An Indian IT company can receive personal data from European clients, process it in India, and return the results without violating Indian law, as long as the company meets its obligations under the DPDP Act (consent, security safeguards, breach notification). The complexity arises when the same company also holds payment data under an RBI-authorized payment service, because that specific data must be localized in India while client data from abroad may need to remain accessible to the foreign client.

Indian startups building products for global markets need to design their data architecture with this duality in mind. A common approach is to use India-based cloud regions for all Indian user data and domestic payment data, while using multi-region cloud deployments for international client data. Companies registered under Startup India should factor data localization costs into their financial projections from day one, as cloud infrastructure costs in India can differ from global pricing tiers.

How to Achieve Data Localization Compliance

Data localization compliance is not a single action. It is a structured process that involves mapping your data, choosing the right infrastructure, implementing technical controls, and maintaining ongoing documentation. Here is the step-by-step approach that works for most businesses.

1. Conduct a Data Audit: Identify every category of data your business collects, processes, and stores. Classify each category by regulatory framework: payment data (RBI), personal data (DPDP Act), sector-regulated data (TRAI/IRDAI/NHA), and non-regulated data. Map the current storage location and processing flow for each category. This audit typically takes 10 to 15 working days for mid-sized companies.
2. Identify Applicable Regulations: Based on your data audit, determine which localization rules apply. A fintech company will face RBI + DPDP requirements. A health-tech company faces NHA + DPDP requirements. A general e-commerce company may only need to comply with the DPDP Act (unless it processes payments through its own system). Document the regulatory obligations for each data category.
3. Select Indian Cloud Infrastructure: Choose a cloud provider with Indian data centre regions. Ensure the provider offers data residency controls that prevent regulated data from being replicated or backed up to servers outside India. Obtain written confirmation of server locations and data residency policies from the provider.
4. Migrate Regulated Data: Transfer all data that falls under localization mandates to Indian servers. For payment data, the migration must be complete, with no copies remaining on foreign servers beyond the permitted processing window. For personal data, ensure that the migration does not disrupt ongoing services or violate the DPDP Act's data integrity obligations.
5. Update Vendor Contracts: Include data localization clauses in all agreements with third-party vendors, data processors, and cloud service providers. The contract should specify server locations, data residency commitments, audit rights, and breach notification obligations. This is particularly important for companies that use multiple SaaS tools for CRM, HR, and accounting.
6. Implement Access Controls and Encryption: Ensure that localized data is protected with encryption at rest and in transit, role-based access controls, and audit logging. The DPDP Act requires "reasonable security safeguards," and the RBI expects payment system operators to maintain security standards proportionate to the data they handle. Companies with ISO 27001 certification already have a solid foundation for these controls.
7. Document and Monitor: Maintain comprehensive records of your data localization setup, including server location certificates, data flow diagrams, migration logs, and vendor contracts. Set up ongoing monitoring to detect any data flows that might route regulated data outside India. Review compliance quarterly and after any infrastructure changes.

Cloud Infrastructure for Data Localization in India

Choosing the right cloud infrastructure is the technical foundation of data localization compliance. The good news is that all major global cloud providers now operate data centre regions within India, giving businesses the flexibility to localize data without abandoning the cloud for expensive on-premise hardware.

Key Configuration Steps for Cloud Localization

Regardless of the cloud provider, you need to configure data residency at multiple levels. At the storage level, ensure databases, object stores, and file systems are deployed exclusively in Indian regions. At the compute level, ensure processing workloads that access regulated data run in Indian regions. At the backup and DR level, configure disaster recovery replication to stay within Indian regions (for RBI data) or within permitted regions (for DPDP data). At the analytics level, ensure that data warehouses, log storage, and analytics pipelines do not replicate regulated data outside India.

For RBI-regulated entities, the cloud provider should supply a System Audit Report confirming that payment data never leaves Indian server infrastructure. AWS, Azure, and Google Cloud all provide compliance documentation tailored to the Indian financial sector. Request these reports as part of your vendor evaluation process.

Cost of Data Localization Compliance

The cost of compliance depends on three factors: the volume of data you handle, the number of regulatory frameworks that apply to your business, and the state of your current infrastructure. A company already running on AWS Mumbai with well-organized data flows will spend far less than one migrating terabytes of data from overseas servers.

Hidden Costs to Account For

Beyond the obvious infrastructure and advisory costs, businesses often underestimate these expenses: cloud egress charges when migrating data to Indian regions, higher storage costs in Indian cloud regions compared to US/EU regions (typically 10% to 20% premium), dedicated compliance officer time for ongoing monitoring, periodic third-party audits (₹2 lakh to ₹5 lakh per audit), legal review of vendor contracts for data localization clauses (₹1 lakh to ₹3 lakh), and employee training on data handling procedures compliant with localization rules.

The total cost of getting it wrong, however, dwarfs the compliance investment. A ₹250 crore penalty under the DPDP Act, or the loss of RBI authorization for a payment company, represents an existential threat. Framing data localization compliance as a cost of doing business in India, rather than an optional expense, is the right approach for financial planning.

Penalties for Non-Compliance

India's penalty framework for data localization violations is severe and multi-layered. The penalty you face depends on which regulation you violate, not a single universal fine structure. Here is the complete breakdown across all applicable frameworks.

The RBI's approach deserves special attention because it combines monetary penalties with operational restrictions. When Mastercard was found non-compliant in 2021, the RBI did not simply impose a fine. It barred Mastercard from adding new Indian customers to its network, a far more damaging consequence than any monetary penalty. For payment companies, the loss of authorization to operate is effectively a death sentence for their Indian business. This makes RBI data localization compliance not just a legal obligation but a business survival requirement.

Data Localization Compliance Checklist for Businesses

Use this checklist to evaluate your current data localization status. Every "No" answer represents a compliance gap that needs to be addressed.

Summary

Data localization in India operates on three levels: the RBI's absolute mandate for payment data (all payment data must reside on Indian servers), the DPDP Act's conditional framework for personal data (transfers permitted unless a country is specifically restricted), and sector-specific rules for telecom, healthcare, insurance, and government data. The compliance cost ranges from ₹5 lakh for small businesses to ₹50 lakh for multi-sector enterprises, but the penalty for non-compliance, up to ₹250 crore under the DPDP Act or authorization revocation under RBI rules, makes the investment worthwhile. The practical first step is a data audit: identify what data you collect, where it is stored, and which regulatory framework applies to each category. From there, the path to compliance is structured, measurable, and achievable within 30 to 90 working days for most businesses.