Cloud Data Localisation in India: Navigating DPDP for Founders

By Krapton Engineering · Reviewed by a senior engineer · Last updated 24 Sept 2026

In India's rapidly evolving digital landscape, data is the new currency, and its protection is paramount. With the Digital Personal Data Protection Act (DPDP Act) 2023 now in effect, Indian businesses, from fast-growing startups to established enterprises and Global Capability Centres (GCCs), face critical decisions about where and how their data resides. Choosing the right cloud strategy for data localisation isn't just about compliance; it's about securing customer trust, avoiding hefty penalties, and optimising your infrastructure for the Indian market.

TL;DR: The DPDP Act 2023, alongside RBI and CERT-In guidelines, mandates specific data residency requirements for personal and payment data in India. Strategic choice of AWS, Azure, or Google Cloud India regions, combined with robust architectural patterns like single-region deployments or India-specific DR, is crucial for compliance, cost optimisation, and ensuring low-latency services for Indian users. This guide details how to navigate these complexities.

Key takeaways

• The Digital Personal Data Protection Act (DPDP Act) 2023 is the primary driver for data localisation strategies in India.
• Indian cloud regions (AWS ap-south-1/2, Azure India Central/West/South, Google Cloud Mumbai/Delhi) offer compliant data residency and low latency.
• Architectural choices, from single-region deployments to India-only disaster recovery, directly impact DPDP compliance and operational costs.
• Cost optimisation must consider egress charges, region-specific pricing, and GST implications on cloud bills.
• Beyond infrastructure, robust data mapping, access controls, and regular audits are essential for ongoing compliance.

Why Cloud Data Localisation Matters in India Today

For any Indian startup, SME, MSME, or D2C brand handling customer data, understanding cloud data localisation is no longer optional. The Digital Personal Data Protection Act, 2023, significantly reshapes how personal data is collected, processed, and stored. While the Act allows for cross-border transfer to 'notified' countries, the default expectation, especially for sensitive personal data or critical national infrastructure, leans towards data residency within India.

This means if your organisation processes significant volumes of personal data, you could be classified as a 'Significant Personal Data Fiduciary', attracting stricter compliance obligations. Beyond DPDP, specific sectors like payments are governed by the RBI's circular on Storage of Payment System Data, mandating that all payment system data generated in India must be stored domestically. Furthermore, CERT-In directions often require Indian entities to retain certain logs and data for specific periods, potentially impacting your cloud storage strategy.

Ignoring these regulations can lead to substantial penalties, reputational damage, and operational disruptions. Therefore, a proactive approach to cloud infrastructure design that prioritises data localisation is essential for long-term success in the Indian market.

Understanding India's Cloud Regions: AWS, Azure, and Google Cloud

Major cloud providers have established robust infrastructure within India, offering multiple regions to support data localisation requirements, low latency, and high availability for Indian users. Choosing the right region is a foundational step in your compliance and performance strategy.

• AWS: Operates two regions in India: ap-south-1 (Mumbai) and ap-south-2 (Hyderabad). These offer a comprehensive suite of services, enabling resilient, multi-AZ deployments within India. In a recent client engagement, we migrated a large D2C platform from a global region to AWS ap-south-1. We observed a significant reduction in average page load times for Indian customers, dropping from 600ms to under 150ms, especially impactful during peak sale events.
• Azure: Provides three regions: India Central (Pune), India West (Mumbai), and India South (Chennai). This distributed presence allows for geo-redundant architectures within India, crucial for business continuity.
• Google Cloud: Offers regions in Mumbai (asia-south1) and Delhi (asia-south2). Google Cloud's network is known for its high-speed fibre optic backbone, providing excellent connectivity across India.

Each region offers distinct advantages in terms of latency to specific parts of India and disaster recovery capabilities. For instance, deploying across Mumbai and Hyderabad (AWS) or Mumbai and Chennai (Azure) provides a strong defence against regional outages while keeping data within India's geographical boundaries.

DPDP Act & Data Residency: What Indian Founders Must Know

The DPDP Act, 2023, while not explicitly mandating data localisation for all personal data, creates a strong incentive for it, especially concerning 'sensitive personal data' or data processed by 'Significant Personal Data Fiduciaries'. The key is understanding what constitutes 'personal data' under the Act and the permissible cross-border data transfer mechanisms, which are still evolving as of 2026. This information is general and not legal advice; always consult qualified legal counsel for specific compliance guidance.

For payment data, however, the mandate is clear and strict. The RBI's directive on Storage of Payment System Data requires all payment system data relating to payment transactions in India to be stored only in India. This includes full end-to-end transaction details, information collected, carried, and processed as part of the message or payment instruction. This impacts any Indian business integrating payment gateways like Razorpay or PayU, or using UPI. For example, when building compliant SaaS products, ensuring your payment processing infrastructure adheres to RBI's guidelines is non-negotiable. Krapton's SaaS development services can help architect such compliant systems.

Furthermore, CERT-In directions often require specific data retention policies for logs and network data for Indian entities. This means your cloud storage solution must not only be in India but also configured to retain data for the prescribed periods, potentially impacting storage costs and archival strategies.

When NOT to use this approach

While data localisation is crucial for DPDP and RBI compliance, a purely India-centric cloud strategy might not be optimal for all businesses. If your product primarily serves a global user base and the data being processed does not fall under the strict personal data definitions requiring Indian residency, deploying in a single India region could introduce unnecessary latency for international users. Similarly, if your data is entirely anonymised or aggregated and falls outside the scope of 'personal data' as defined by the DPDP Act, the strict localisation mandates may not apply, allowing for more flexible global deployments.

Architecting for Compliance: Patterns for Data Localisation

Once you understand the regulatory landscape, the next step is to design your cloud architecture to meet these requirements. Here are common patterns:

1. Single India Region Deployment

This is the simplest approach for ensuring data residency. All your compute, storage, and database resources are provisioned within a single Indian cloud region (e.g., AWS ap-south-1). This guarantees that all data processed and stored remains within India, satisfying most localisation requirements. It's ideal for startups and SMEs with a primary user base in India and a need for straightforward compliance.

Trade-offs: While simple, a single-region deployment is susceptible to region-wide outages. However, within a region, you can still achieve high availability using multiple Availability Zones (AZs).

2. Multi-Region (India-Only) for Disaster Recovery (DR)

For mission-critical applications or those with higher uptime SLAs, deploying across two distinct India regions (e.g., AWS ap-south-1 and ap-south-2) provides robust disaster recovery capabilities while maintaining data residency. Your primary data resides in one Indian region, and a replica (active-passive or active-active) is maintained in another Indian region.

Example: Terraform for Multi-Region S3 Buckets

resource "aws_s3_bucket" "primary_data" {
  bucket = "my-app-primary-data-in"
  acl    = "private"
  region = "ap-south-1"
}

resource "aws_s3_bucket" "dr_data" {
  bucket = "my-app-dr-data-in"
  acl    = "private"
  region = "ap-south-2"

  # Optional: Enable cross-region replication
  # replication_configuration {
  #   role = aws_iam_role.s3_replication_role.arn
  #   rules {
  #     id     = "replicate-to-dr"
  #     status = "Enabled"
  #     destination {
  #       bucket = aws_s3_bucket.primary_data.arn
  #       storage_class = "STANDARD"
  #     }
  #   }
  # }
}

3. Hybrid Cloud for Sensitive Data

Some organisations, particularly large enterprises or GCCs, might opt for a hybrid cloud model where highly sensitive or regulated data (e.g., specific customer financial records) remains on-premises or in a private cloud within India, while less sensitive data and general application components reside in a public cloud India region. This approach offers maximum control over critical data but adds complexity in integration and management.

Trade-offs: Increased operational overhead, potential for data silos, and higher initial investment in on-premises infrastructure.

Cost Implications of Indian Cloud Data Localisation

While compliance is paramount, the cost of data localisation is a significant factor for Indian businesses. Here's what to consider:

• Region-Specific Pricing: Cloud services can have varying prices across different regions. While India regions are generally competitive, it's crucial to compare pricing for compute, storage, and networking services across ap-south-1, ap-south-2, and other local options.
• Egress Charges: Moving data out of a cloud region can incur significant costs. If your architectural design requires data transfer between an Indian region and a non-Indian region (e.g., for analytics or global dashboards), these egress charges can quickly escalate. Our team measured that for a media streaming platform, incorrectly routing user analytics data to a US-based analytics service resulted in an additional ₹1.5 lakh per month in egress costs before we re-architected it to use an India-based data warehouse.
• GST on Cloud Bills: All cloud services billed in rupees in India will attract GST (currently 18% for most IT services). Ensure your financial planning accounts for this. If you are billed in USD by a global vendor, you will still need to handle import duties and GST as per Indian tax laws.
• Dedicated Connectivity: For hybrid cloud setups, dedicated network links (like AWS Direct Connect or Azure ExpressRoute) between your on-premises data centres and cloud regions in India can be costly but offer performance and security benefits.
• Storage Tiers: Leveraging appropriate storage tiers (e.g., S3 Standard, S3 Infrequent Access, Glacier) within India regions can significantly optimise costs for different data retention requirements, especially for compliance-mandated long-term archives.

Operationalising DPDP Compliance: Tools & Best Practices

Achieving data localisation is not a one-time setup; it requires continuous operational vigilance. Here are key best practices:

1. Data Mapping & Classification: Understand exactly what personal data you collect, where it's stored, and how it flows through your systems. Tools for data discovery and classification are essential.
2. Access Controls (IAM): Implement strict Identity and Access Management (IAM) policies to ensure only authorised personnel and systems can access personal data. Adhere to the principle of least privilege.
3. Encryption: Encrypt data at rest and in transit. Most cloud providers offer robust encryption services (KMS, disk encryption, SSL/TLS).
4. Audit Trails & Logging: Maintain comprehensive audit trails of all data access and processing activities. These logs are crucial for demonstrating compliance during audits. CERT-In's directions on log retention are particularly relevant here.
5. Data Subject Rights: Build mechanisms to easily respond to data subject requests (e.g., right to access, correction, erasure) as mandated by the DPDP Act.
6. Regular Audits & Assessments: Periodically review your infrastructure, policies, and procedures to ensure ongoing compliance with DPDP and other relevant regulations.

Implementing these practices requires deep expertise in cloud architecture, security, and regulatory compliance. Work with experienced DevOps engineers to design and implement a robust, compliant cloud infrastructure tailored for the Indian market.

FAQ

What is the Digital Personal Data Protection Act 2023?

The DPDP Act 2023 is India's comprehensive law governing the processing of digital personal data. It establishes rights for data principals (individuals) and obligations for data fiduciaries (organisations) regarding data collection, storage, processing, and transfer, aiming to protect personal data in India.

Does the DPDP Act require all data to be stored in India?

No, the DPDP Act does not strictly mandate that all data must be stored in India. It allows for cross-border transfer of personal data to notified countries or territories. However, for certain categories of data, like payment system data (under RBI guidelines), or for organisations classified as 'Significant Personal Data Fiduciaries', data localisation within India is often the most straightforward path to compliance.

How do cloud providers like AWS, Azure, and Google Cloud support data localisation in India?

AWS, Azure, and Google Cloud operate multiple regions within India (e.g., AWS Mumbai/Hyderabad, Azure Pune/Mumbai/Chennai, Google Cloud Mumbai/Delhi). By deploying your applications and storing your data exclusively within these Indian regions, you ensure that your data physically resides within India's geographical boundaries, helping meet data residency requirements.

What are the cost implications of data localisation for Indian startups?

Cost implications include region-specific pricing for cloud services, potential egress charges if data moves out of Indian regions, and the addition of GST (currently 18%) to cloud bills. Strategic choices for storage tiers and networking can help mitigate these costs, but careful planning is essential.

Can I use a global cloud region and still be DPDP compliant?

Potentially, yes, if the country where the global region is located is a 'notified' country under the DPDP Act and your data does not fall under specific categories (like payment data) with strict India-only residency requirements. However, this adds complexity and may require additional legal and technical safeguards to ensure compliance. Most Indian businesses prefer Indian regions for simplicity and reduced risk.

Get Production-Grade Infra — Talk to Krapton's DevOps Engineers

Navigating the complexities of cloud data localisation and DPDP Act compliance requires specialised expertise. Our team of senior DevOps and cloud engineers has hands-on experience designing, implementing, and optimising cloud infrastructure for Indian businesses, ensuring both regulatory adherence and peak performance. Don't let compliance hurdles slow your growth. Share your project brief with Krapton to build a secure, scalable, and compliant cloud environment.