PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
India does not have one blanket rule requiring every business to keep all data inside India. The applicable answer depends on the data category, your sector and regulatory status, the service providers involved, and any stricter law or contract that applies. The Digital Personal Data Protection (DPDP) Act, 2023 creates a framework under which the Central Government may restrict transfers to notified countries, while preserving stricter Indian requirements. RBI payment-system rules are a clear example of sector-specific localisation.
Timing is equally important. As of 13 October 2026, the DPDP Act’s main personal-data processing and transfer provisions are notified but not yet in force. Businesses deploying AI should therefore map every data location and apply currently effective sector rules without describing the DPDP regime as fully operational.
India’s rule is conditional, not a universal “store everything here” mandate
Data residency means where information is stored, processed, backed up, logged, or made accessible. Indian law does not currently impose one India-wide command covering every business dataset and every AI workload. Instead, several layers must be read together:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- The DPDP Act’s general transfer framework for personal data.
- Sector-specific localisation rules, such as the Reserve Bank of India’s payment-system direction.
- Cloud-outsourcing, security, recoverability, and governance requirements for regulated entities.
- Contractual, procurement, customer, or public-sector restrictions that may be stricter than the general statutory framework.
Section 16 of the DPDP Act, 2023 says the Central Government may restrict transfers of personal data for processing to a country or territory by notification. Section 16(2) preserves stricter Indian law, stating: Nothing contained in this section shall restrict the applicability of any law for the time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof.
That wording means a future notification could limit particular destinations, but the section itself is not a blanket localisation order. A business must first identify which rule applies to the data and activity in question.
Are the DPDP Act and Rules already in force?
Not in full, as of 13 October 2026. The commencement notification issued on 13 November 2025 uses a phased schedule rather than one start date.
| Instrument or provision | Commencement stated in the notifications | Status on 13 October 2026 |
|---|---|---|
| Selected institutional provisions of the DPDP Act | On publication of the commencement notification | In force |
| Another subset of Act provisions | One year after 13 November 2025 | Scheduled for 13 November 2026; not yet in force on the as-of date |
| Sections 3–17, including section 16 on transfers | Eighteen months after 13 November 2025 | Scheduled for 13 May 2027; not yet in force on the as-of date |
| DPDP Rules 1, 2, and 17–21 | On publication | In force |
| Rule 4 | One year after publication | Scheduled for 13 November 2026 |
| Rules 3, 5–16, 22, and 23 | Eighteen months after publication | Scheduled for 13 May 2027; not yet in force on the as-of date |
Before relying on these dates for a filing, launch, or contract, verify whether a later official amendment or commencement notification has changed them. For planning purposes, however, a company should distinguish between provisions already effective and those scheduled for later dates.
Rule 23 is a targeted power, not automatic localisation for everyone
Rule 23 concerns specified data of a Significant Data Fiduciary. It allows the Central Government to require that personal data it specifies, together with associated traffic data, not be transferred outside India. The rule does not automatically place every fiduciary or every personal-data field under an India-only requirement. It becomes relevant if the government specifies the data and the affected entity or class.
What the RBI payment-data rule requires
The clearest current localisation example is the RBI’s 6 April 2018 direction, “Storage of Payment System Data.” It applies to authorised or approved system providers and requires the entire data relating to payment systems they operate to be stored in systems located only in India.
Rank #2
Who is covered
The RBI FAQ published on 26 June 2019 explains that the obligation reaches beyond a provider’s own servers. Service providers, intermediaries, payment gateways, third-party vendors, and other entities engaged for payment services can be involved in the covered data flow. The authorised or approved system provider remains responsible for compliance, even when processing or storage is outsourced.
Foreign-leg data can have a limited overseas exception
The 2018 direction allows data relating to the foreign leg of a transaction to be stored abroad when required. For a cross-border transaction with both foreign and domestic components, the domestic component may also be stored abroad if required. These are scoped exceptions within the RBI payment regime; they are not a general permission to place Indian business data or arbitrary AI prompts overseas.
Overseas processing is different from overseas storage
The RBI FAQ permits payment processing to occur abroad, but imposes a return-and-deletion condition: the data must be deleted abroad and returned to India no later than one business day or 24 hours from the time the processing is completed, whichever is earlier. A workflow that merely sends payment data to a foreign model and leaves prompts, logs, backups, or provider copies there would not satisfy that condition simply because the primary transaction record is later copied back.
Before routing a payment-system dataset through an AI service, document where inference runs, where temporary files and logs are written, how deletion is evidenced, and how the Indian copy is restored if the overseas service fails. Do not transfer this RBI exception to healthcare, education, ordinary customer analytics, or another sector without a separate legal basis.
Cloud and AI workloads at RBI-regulated entities
RBI’s 2023 Directions on Outsourcing of Information Technology Services require regulated entities to govern the complete cloud data lifecycle: generation and entry into the cloud, use and movement, retention, recovery, and permanent deletion. The directions call for controls addressing:
Rank #3
- Multi-tenancy and the possibility of storage or processing in more than one location.
- Regulatory compliance, including sovereignty and storage obligations.
- Recoverability and the ability to retrieve data when a provider or region is unavailable.
- Data classification and controls proportionate to sensitivity.
- A documented cloud-adoption policy.
- The shared-responsibility split between the regulated entity and its cloud provider.
These controls matter when an RBI-regulated bank, non-bank, payment firm, or other covered entity uses hosted models, retrieval systems, vector databases, managed inference, or AI monitoring. They do not establish a universal India-only cloud rule for every Indian company. A cloud region selected in India is useful evidence about one storage location, but it is not a compliance conclusion if logs, support access, backups, subprocessors, or disaster-recovery copies remain elsewhere.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can a business use an overseas AI model with Indian customer data?
There is no single yes-or-no answer. The decision turns on the data, the entity, the workflow, and the rule that governs the transfer.
Ordinary personal data under the general DPDP framework
For ordinary personal data, assess the DPDP transfer framework and its commencement status. Section 16 permits the Central Government to restrict transfers to notified destinations and preserves stricter Indian law. Until the eighteen-month provisions commence, do not describe section 16 as an already-operational blanket ban or permission. Contractual commitments, customer instructions, and other applicable laws can still impose tighter controls now.
Payment-system data
If the data relates to a covered payment system, begin with the RBI direction and FAQ. A foreign model may be involved in processing only if the complete storage, return, deletion, and responsibility requirements are met. The fact that a provider advertises an Indian region, encryption, or “no training” does not by itself demonstrate compliance.
Other regulated or contractual datasets
Public-sector contracts, telecommunications obligations, financial-sector rules, procurement clauses, and customer agreements may add location or access restrictions. The cited RBI landscape report describes localisation measures as concentrated in financial, banking, and payments contexts, with additional public-sector and telecommunications activity; it is not an exhaustive inventory of every current Indian restriction.
Map every place AI data can go
AI architecture often has more locations than the visible prompt. Create a data-flow map before approving a model or managed service.
- Classify the input. Mark personal data, payment-system data, confidential business information, regulated records, and de-identified or synthetic data separately. De-identification should be documented rather than assumed because names were removed.
- Record prompt and retrieval paths. Include chat prompts, uploaded files, retrieval-augmented-generation indexes, embeddings, vector stores, and cached context.
- Locate inference and training. Identify where real-time inference, fine-tuning, evaluation, safety review, and batch jobs execute. “Hosted in India” may describe storage while computation occurs elsewhere.
- Inventory secondary copies. Check application logs, model-debug records, abuse-monitoring data, telemetry, analytics exports, snapshots, backups, and disaster-recovery replicas.
- Identify human and vendor access. Document support personnel, subprocessors, administrators, cross-border remote access, and emergency-access procedures.
- Check provider use and deletion. Obtain contract language and technical settings covering training on submitted content, retention periods, deletion requests, legal holds, and evidence of deletion.
- Test recovery. Confirm that the business can retrieve, restore, and permanently delete data across all regions and provider layers, not just from the primary database.
- Match each transfer to a rule. For payment data, test the RBI storage and return requirements. For other data, test the DPDP framework, sector rules, contracts, and the entity’s regulator-specific controls.
This checklist is an operational interpretation of the transfer, payment, and cloud-governance requirements. It is not a claim that every listed location has a standalone AI-localisation mandate.
How to compare AI or cloud architectures
When two deployment options are under consideration, use the same questions for both rather than treating a “sovereign” label as proof.
| Decision area | Questions to document |
|---|---|
| Data location | Where are primary storage, inference, backups, logs, telemetry, disaster recovery, and support access located? |
| Data category | Is the dataset ordinary personal data, payment-system data, or another regulated or contractually restricted category? |
| Processing versus storage | Is overseas processing allowed for this category, and are return or deletion deadlines triggered? |
| Provider controls | Can the provider disable training use, restrict retention, identify subprocessors, support audits, and provide incident evidence? |
| Governance and resilience | Are classification, access control, recovery, permanent deletion, and shared responsibilities documented and tested? |
| Entity and contract scope | What licence, regulator, customer contract, public-sector clause, or service role applies to the business? |
No architecture or provider configuration guarantees compliance by itself. The accountable business must connect the technical design to the rule that applies to its data and activity.
Common mistakes and how to correct them
Mistake: “India requires all personal data to stay in India.”
Correction: Separate the DPDP transfer framework from stricter sector rules. Section 16 is a power to restrict notified transfers and preserves higher protections; it is not a universal storage command.
Mistake: “The DPDP Act is fully live because the Rules were notified.”
Correction: Use the phased dates. As of 13 October 2026, sections 3–17, including section 16, are scheduled for May 2027, while some institutional provisions and Rules are already effective.
Mistake: “RBI allows any Indian data to be processed abroad.”
Correction: The overseas-processing clarification is for covered payment-system data and includes deletion and return within the specified deadline. It does not generalise to other sectors.
Mistake: “An India data-centre region solves residency.”
Correction: Trace logs, backups, support access, subprocessors, recovery copies, and deletion. For regulated entities, apply the cloud lifecycle and shared-responsibility controls in RBI’s 2023 directions.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A practical approval record for an AI deployment
Before production use, retain a short decision record containing:
- The business entity, sector, licence, and regulator.
- The exact datasets and classifications entering the AI workflow.
- A diagram or table of storage, processing, logging, backup, support, and recovery locations.
- The legal or contractual rule tested for each transfer and location.
- Provider terms on retention, training use, subprocessors, deletion, audit, and incidents.
- For payment data, evidence that any overseas processing is followed by deletion abroad and return to India within the RBI deadline.
- Owner names, review dates, and a change trigger for model, provider, region, or contract changes.
That record does not replace legal advice or regulator engagement, but it makes the key residency decision reviewable and exposes gaps before sensitive data reaches a model.
What businesses should do now
- Do not wait for 2027 to map flows. The DPDP commencement schedule is future-dated, while sector rules and contracts may already apply.
- Identify payment-system exposure first. The RBI rule has concrete India-storage and overseas-processing conditions.
- Ask vendors about every copy. Require answers for prompts, retrieval indexes, logs, telemetry, backups, support access, and subprocessors.
- Align cloud governance with the entity’s regulator. RBI-regulated entities should update cloud-adoption, classification, recovery, and shared-responsibility documentation.
- Recheck the design when anything changes. A new model endpoint, support arrangement, logging feature, or disaster-recovery region can create a new transfer.
The Bottom Line
Indian data residency for AI is a data-and-sector question, not a single India-wide storage command. As of 13 October 2026, the DPDP Act’s main transfer provisions are scheduled but not yet in force; RBI payment-system localisation and cloud-governance requirements remain the clearest operational constraints for covered entities. Map every prompt, model call, log, backup, and support path, then test each against the rule, contract, and regulator that actually applies.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
