Last checkedBy Team DPDP Act India
Data Localisation Rules by Sector in India: RBI, IRDAI, SEBI and CERT-In
The DPDP Act has no general localisation rule, but several sector instruments already require data or records to stay in India. This page lists them with their status and a last-checked date. We re-check and re-date it on its own.
Short answerFive of the six instruments below are in force now, and one, the SEBI cloud framework, is unclear and needs legal confirmation. Section 16(2) of the DPDP Act keeps stricter Indian laws alive, so these rules apply whatever Section 16 allows. Read the instrument for your own licence. Do not infer the rule from the DPDP Act.
- 5 in forceSPDI, RBI (two), IRDAI, CERT-In
- 1 unclearSEBI cloud framework and CSCRF
- None generalNo DPDP localisation rule
- 26 Oct 2026Last checked
Which rules might apply to you
Start with your licence. Each regulator has its own instrument, and CERT-In and the SPDI Rules cut across sectors.
Your business and the rules to read first
- Banks and NBFCsRBI outsourcing Directions
- Payment firmsRBI payment data rule
- InsurersIRDAI 2025 regulations
- Securities marketSEBI cloud framework
- All service providersCERT-In log rule
- Sensitive personal dataSPDI Rule 7
The sector instruments, with status and last-checked date
Status is as of 26 October 2026. “In force” means we found no repeal. “Unclear” means the text or the status needs legal confirmation. Each row says how we checked it.
| Instrument | What it says | Covers | Status on 26 Oct 2026 | How we checked |
|---|---|---|---|---|
| SPDI Rules 2011, Rule 7 (G.S.R. 313(E), 11 April 2011) | Sensitive personal data may go to a recipient in India or abroad that ensures the same level of protection. The transfer is allowed only if it is necessary for the lawful contract, or if the person consented. | Bodies corporate handling sensitive personal data | In force Section 43A of the IT Act is omitted on 13 May 2027 (Section 44(2)). What happens to the Rules themselves is an open point. | Gazette text read in full. High for the wording. |
| RBI, Storage of Payment System Data (6 April 2018; FAQ 26 June 2019) | All payment system data must be stored only in India. Processing abroad is allowed if the data is deleted abroad and brought back within one business day or 24 hours, whichever is earlier. The FAQ allows a copy of the domestic part of a cross-border transaction to be kept abroad if required. | Authorised payment system providers, and banks in specified respects | In force Paragraph 9(c) of the RBI Payment Aggregators Directions of 15 September 2025 requires compliance, so it is carried forward for payment aggregators. The RBI Master Directions on Authorisation to operate a Payment System (15 June 2026) do not list the 2018 circular and contain no data storage clause. We verified no general successor for all payment system operators. | Circular and FAQ as quoted from the RBI pages by Perplexity. The 15 June 2026 Master Directions read by us. Medium to high. |
| RBI Managing Risks in Outsourcing Directions, 2025 (28 November 2025), separate Directions for commercial banks and for NBFCs | IT outsourcing agreements must include “storage of data only in India (as applicable) as per extant regulatory requirements” (bank para 69(vi), NBFC para 74(vi)). For offshore financial-services outsourcing, all original records must continue to be maintained in India (bank para 47(viii), NBFC para 53(viii)). Existing IT outsourcing agreements had to comply at renewal or by 10 April 2026, whichever was earlier. | Commercial banks and NBFCs (NBFC IT chapter: middle layer and above). Other regulated entities not checked. | In force The data-in-India clause points to other rules, so it adds no blanket localisation of its own. The original-records rule for offshore outsourcing is separate and direct. The Directions repeal earlier outsourcing instructions, but which ones is not confirmed. | Both Directions read in full on 26 October 2026. The withdrawal annex was not read. High for these two. |
| IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority) Regulations, 2025 (1 January 2025) | Regulation 9(iii): records of all policies issued and all claims made in India, including electronic records, must be held in data centres located and maintained in India only. The proviso covers insurers that write only reinsurance. Regulations 12 and 13 let insurers and intermediaries keep minimum-information records at their principal place of business in India, at branches, or in data centres in India. | Insurers (regulation 9(iii)); insurers and intermediaries (regulations 12 and 13) | In force From publication in the Gazette (regulation 1(ii)). Many pages still cite the repealed 2015 text. | English text read in full. High. |
| SEBI Cloud Framework (6 March 2023) and CSCRF (20 August 2024) | Principle 3(iii) of Annexure 1: storage and processing of the entity’s data in the cloud, including primary, disaster recovery and near-DR sites and logs, must be within the legal boundaries of India at all times. For investors incorporated outside India, original data, transactions and logs must also stay accessible in India. Principle 2(i): data centres of MeitY-empanelled cloud providers with valid STQC status. Principle 7(x)(7): a contract clause on storage in India. Public, community and hybrid cloud are covered. Private cloud is treated as on-premise and sits outside. | SEBI-regulated entities such as exchanges, clearing corporations, depositories, brokers, depository participants, mutual funds and their asset management companies, registrars and share transfer agents, and KYC registration agencies | Unclear The CSCRF localisation control PR.DS.S2 was kept in abeyance by the 31 December 2024 circular. The 28 August 2025 circular still describes localisation as in abeyance. We found no circular lifting it, which is not proof that none exists. The 30 April 2025 circular says nothing on localisation. Whether the 2023 clause still binds while PR.DS.S2 is in abeyance needs legal confirmation. A June 2025 SEBI FAQ says to comply with the 2023 framework. | The 6 March 2023 circular and Annexure 1 read in full. The 31 December 2024 circular read through an NSE-hosted copy. The 28 August and 30 April 2025 circulars read by Perplexity through NSE copies. High for the 2023 wording and the abeyance wording. |
| CERT-In Directions (28 April 2022), direction (iv), and the FAQs of May 2022 | Logs of all ICT systems must be kept for a rolling 180 days within the Indian jurisdiction and provided to CERT-In on request or with an incident report. FAQ 35 says logs may also be stored outside India if they can be produced in reasonable time. FAQ 36 says a service provider offering services to users in India must keep logs and records of financial transactions in Indian jurisdiction. The FAQ says it is not a legal document. | Service providers, intermediaries, data centres, bodies corporate and government organisations | In force Effective 27 June 2022, and 25 September 2022 for micro, small and medium enterprises. Issued under Section 70B(6) of the IT Act, not Section 43A. Direction (ii) separately requires listed incidents to be reported within 6 hours. The tension between FAQ 35 and direction (iv) is open for counsel. | Directions, FAQs and the 27 June 2022 extension read in full. Later amendments not checked. |
| Repealed instruments: do not cite | IRDAI Maintenance of Insurance Records Regulations 2015, Minimum Information Required for Investigation and Inspection Regulations 2020, and Sharing of Confidential Information Regulations 2012, all repealed by regulation 18 of the 2025 Regulations. Earlier RBI outsourcing instructions, repealed by the 28 November 2025 Directions. | Insurers and intermediaries; banks and NBFCs | Repealed The specific RBI instruments repealed are not confirmed. | Regulation 18 read in full. RBI circular of 28 November 2025 read, annex not read. |
Reading the table
RBI outsourcing
Two different clauses
- The “data only in India” clause points to other regulatory requirements. It is not a blanket rule by itself.
- The original-records rule for offshore outsourcing is direct. Read it separately.
SEBI
Two instruments, one in abeyance
- The 2023 cloud framework has a clear India-boundary clause.
- The CSCRF control is in abeyance. Do not assume that lifts the 2023 clause.
CERT-In
A FAQ is not the rule
- Direction (iv) says logs stay within the Indian jurisdiction.
- FAQ 35 allows storage abroad, but the FAQ is not a legal document. Do not rely on it alone.
Why these apply: Section 16(2) of the DPDP Act says nothing in Section 16 restricts a law that gives higher protection or a greater restriction on transfer. Section 38(1) says the Act is in addition to other laws. How Section 16(2) sits with Section 38(2), which says the Act prevails on conflict, is an open question, so follow the stricter rule. Section 16 itself starts on 13 May 2027.
Open questions for counsel
We do not publish these as settled. Each is a point where the official text, as we read it, does not give a clean answer.
- 1
SEBI
Does the 2023 cloud framework localisation clause still bind while CSCRF control PR.DS.S2 is in abeyance?
- 2
RBI
Is there a successor to the 2018 payment data rule beyond the payment aggregator direction? What does “as applicable” pick up in the 2025 IT outsourcing clause on storing data only in India?
- 3
CERT-In
Is the FAQ 35 allowance to store logs outside India still valid, given direction (iv) and FAQ 36?
What this page does not cover
We have not checked telecom licence conditions, the Companies (Accounts) Rules backup requirement, health-sector rules or Aadhaar-related rules. We make no claim about them. We have also not checked sector regulators other than those in the table. If your regulator is not listed, read its own instruments.
Frequently asked questions
Does the DPDP Act set sector localisation rules?
No. The Act has no general localisation rule. Section 16(2) keeps stricter Indian laws, such as the instruments on this page, in force. Section 16 itself starts on 13 May 2027.
Can a bank or NBFC use a foreign cloud?
The RBI outsourcing Directions require IT outsourcing agreements to include storage of data only in India, as applicable per extant regulatory requirements, and require original records to stay in India for offshore financial-services outsourcing. Which rules apply to your data and your licence is for you and your counsel to confirm.
Can a payments company process data abroad?
Under the 2018 RBI rule, processing abroad is allowed only if the data is deleted abroad and brought back to India within one business day or 24 hours, whichever is earlier. Check that the rule applies to your authorisation.
Is SEBI data localisation in force?
The 2023 cloud framework says data must stay within India’s legal boundaries. The CSCRF localisation control is in abeyance. Whether the 2023 clause still binds is a question for counsel. Do not assume either way.
Does storing logs abroad breach the CERT-In rules?
Direction (iv) says logs must be maintained within the Indian jurisdiction. A CERT-In FAQ allows storage abroad if the logs can be produced in reasonable time, but the FAQ says it is not a legal document. Do not rely on it alone.
What we checked and when
- Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, G.S.R. 313(E). Gazette of India.
- RBI Master Directions on Managing Risks in Outsourcing for commercial banks and for NBFCs, 28 November 2025, and the RBI circular on withdrawal of circulars of the same date.
- RBI Master Directions on Authorisation to operate a Payment System, 15 June 2026.
- RBI circular on Storage of Payment System Data, 6 April 2018, and FAQs, 26 June 2019, as quoted from the RBI pages.
- IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority) Regulations, 2025. Gazette of India.
- SEBI circular on the cloud framework, 6 March 2023, with Annexure 1, and SEBI circulars of 31 December 2024, 30 April 2025 and 28 August 2025.
- CERT-In directions under Section 70B(6), 28 April 2022, the FAQs of May 2022 and the extension of 27 June 2022.
Rows say which text we read ourselves and which we saw through quotations. Statements that no later change was found come from our own searches, not from an official statement. Instruments change often, so confirm the current text before you rely on it. Last checked 26 October 2026 by Team DPDP Act India. Read our editorial policy and the cross-border transfer guide.
Regulated and sending data abroad?
Take the free readiness assessment, or get matched with an implementation partner who can map your flows against the rules that apply to your licence.
This page is general information, not legal advice. Check the official text and speak to your counsel before acting on it.