Data Localisation
A rule that certain data must be stored or processed within India.
Data localisation is a rule that certain data must be stored or processed within India. The DPDP Act has no general rule of this kind, but some specific rules and sector regulators do.
Meaning of Data Localisation
The DPDP Act has no general localisation rule. Significant Data Fiduciaries may be told to keep specified data in India under Rule 13, and sector regulators, such as the RBI for payment data, impose their own localisation rules, which continue to apply.
Localisation is the opposite of free cross-border flow. It requires that a copy, or sometimes the only copy, of specified data is kept on servers in India. The DPDP Act, 2023 does not impose it as a general requirement: Section 16 permits transfers to any country except those the Government restricts by notification. A company that is subject only to the Act can, subject to security and contract duties, host Indian personal data abroad. The word "localisation" applies to narrower, targeted requirements found in the Rules and in other laws.
Rule 13(4) is the DPDP-specific provision. A Significant Data Fiduciary must ensure that personal data specified by the Central Government, on the basis of the recommendation of a committee, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow are not transferred outside India. Two features stand out. It applies only to Significant Data Fiduciaries, which the Government designates under Section 10 based on volume and sensitivity of data and risk, and it applies only to the categories of data the Government specifies. Nothing is localised until that specification is made.
Other laws operate independently and continue to apply under Sections 16(2) and 38. The RBI has directed payment system operators to store payment system data only in India, with processing abroad allowed only if the data is brought back within a limited period. Insurance rules require maintenance of insurance records in India. The CERT-In directions of 2022 require service providers and others to keep certain logs within Indian jurisdiction for 180 days. Government and public-sector procurement may require Indian data centres. Each regulator sets its own scope, so one company may meet several localisation rules.
Localisation should not be confused with related ideas. Data residency refers to where data is physically stored, localisation refers to a legal requirement to keep it there, and sovereignty is the broader policy aim of national control over data. A mirror copy in India with processing abroad is different from a strict ban on any transfer of the data. Also, localisation does not itself make data secure; an Indian server with poor controls still breaches Section 8(5) and Rule 6.
Examples of Data Localisation
A payment company stores payment-system data only in India because of an RBI directive, even though the DPDP Act would permit a broader flow.
A payment service provider stores payment system data only on Indian servers because of an RBI directive. Its marketing and general customer data, which the directive does not cover, remains with a global cloud vendor, subject to the DPDP Act.
A large platform expects to be notified as a Significant Data Fiduciary. It starts designing a region-specific store for Indian user profiles so that it can comply quickly if the Government specifies data under Rule 13(4).
A telemedicine firm uses a foreign analytics tool. It realises its hospital partners want in-country storage in contracts, though the DPDP Act does not require it, so it switches to an Indian region to keep those customers.
Why Data Localisation matters
Localisation drives cost and architecture. Moving data to Indian regions, setting up in-country backups, or separating Indian data from a global database can take many months and affect performance, vendor choice and pricing. A company that finds out late that a regulator expects in-country storage may have to re-engineer systems under pressure. Equally, companies that localise everything out of caution may pay more than necessary.
For global groups, the question is how to run a worldwide platform while meeting an Indian requirement. Typical solutions include region-specific databases, tokenisation that keeps identifiable fields in India while sending non-identifying data abroad, and clear access rules for foreign teams. Whichever approach is used, the group must be able to show regulators where each data type sits.
How it works in practice
- 1Make a list of the localisation rules that could apply to you: DPDP Rule 13(4) if you may become a Significant Data Fiduciary, your sector regulator's directions, CERT-In log retention and any contract terms with government or regulated customers.
- 2Classify data by type so you can say which categories are subject to which rule. Payment data, insurance records, logs and general customer data may each have different requirements.
- 3Design your architecture so that data can be pinned to an Indian region where required, using region-specific storage, in-country backups and access controls on foreign support staff.
- 4Include localisation terms in vendor contracts: where data is stored, which sub-processors are used, whether remote access from abroad is permitted and how data is returned or deleted.
- 5Test and document. Keep diagrams, configuration evidence and audit reports that show where data lives, so you can respond quickly to a regulator or an enterprise customer questionnaire.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming the DPDP Act requires all data to stay in India. It has no general localisation rule.
Assuming no rule applies because the Act is silent. Sector regulators and CERT-In directions have their own requirements.
Treating Rule 13(4) as active for everyone. It applies only to Significant Data Fiduciaries and only to data the Government specifies.
Thinking an Indian server alone means compliance. Security safeguards and processor contracts are still needed.
Compliance tips
Keep a regulator-by-regulator table of localisation requirements and review it each quarter.
Use contract clauses to restrict sub-processors and foreign access to Indian data.
Ask cloud vendors for region-lock and audit-log features before you sign.
Estimate migration cost in advance so management can decide quickly if a rule changes.
Common questions about Data Localisation
Does the DPDP Act require data localisation?
Not generally. Section 16 permits transfer abroad except to countries restricted by notification. Rule 13(4) can require specified data of Significant Data Fiduciaries to stay in India, and sector rules, such as those of the RBI, may also require it.
What is the difference between data localisation and cross-border transfer?
[Cross-border transfer](term/cross-border-transfer) is the movement of data to another country, which the Act permits by default. Localisation is a requirement that certain data stay in India. Localisation rules therefore limit transfers for particular data or sectors.
Who has to localise data under the DPDP Rules?
Only a Significant Data Fiduciary, and only for personal data and associated traffic data that the Central Government specifies on the recommendation of a committee. Other fiduciaries are not covered by Rule 13(4) unless another law applies to them.