Data Localization Requirements for India

What Is Data Localization?

Data localization requires certain types of personal data to be stored and processed within India. The DPDP Act 2023 empowers the government to restrict cross-border data transfers.

Current Requirements

• Personal data of Indian citizens should be stored in India (recommended)
• Critical personal data may be restricted to India only (government notification pending)
• Cross-border transfers allowed only to countries approved by the government

How to Comply

• Choose cloud providers with Indian data centres (AWS Mumbai, Azure Pune, GCP Mumbai)
• Verify where your SaaS vendors store data
• Include data residency requirements in vendor contracts
• Document data flow maps showing where personal data is stored and processed