Data Localisation

DPDP Act 2023 — Section 16; RBI Data Localisation Circular 2018

Data localisation refers to government requirements that certain categories of data must be stored and processed within India's territorial borders. Under the DPDP Act 2023, the Central Government may restrict transfer of personal data to countries or territories outside India by notification (Section 16). RBI has separately mandated that payment system data must be stored exclusively in India (April 2018 circular). The interplay between RBI's payment data localisation mandate, DPDP's cross-border transfer restrictions, and commercial realities of cloud computing creates complex compliance challenges for banks and fintech companies operating with international data centre infrastructure.

Data localisation determines where personal and payment data may physically reside, and for financial institutions it is one of the harder compliance puzzles. Under Section 16 of the DPDP Act 2023, the Central Government may restrict transfer of personal data to specified countries by notification, while the RBI's 2018 circular separately mandates that payment system data be stored exclusively in India. The friction is operational: most banks and fintechs run on cloud and international data-centre infrastructure, so they must architect storage and processing to satisfy the RBI's strict payment-data rule and the DPDP's cross-border transfer regime at the same time, without breaking commercial systems. Counsel's role is to map data residency across vendors and geographies and to confirm that no restricted transfer occurs by default through a cloud provider's global routing. Getting it wrong — letting payment or restricted personal data leave India — is a direct regulatory contravention with both RBI and DPDP consequences. Well-advised institutions verify data residency contractually and technically.