Data Localization Requirements in India: RBI and DPDP Rules

India has two separate data localization frameworks that businesses often conflate: the RBI's payment data storage mandate (data related to payment systems must be stored exclusively in India) and the DPDP Act's cross-border transfer rule (personal data can generally be transferred outside India, except to countries the Central Government specifically restricts). Checking which applies to your business is essential before deciding where data is hosted.

RBI's payment data localization mandate

Since 2018, RBI requires all payment system providers (PSPs) — payment gateways, wallets, card networks, UPI apps — to store the entire data relating to payment systems only in India. If any part of a transaction is processed abroad, that data must be deleted from the foreign system and brought back to India within 24 hours.

• Applies to: payment aggregators, wallets, card schemes, UPI, and similar payment system operators
• Scope: end-to-end transaction details, not just customer PII
• Foreign leg of a transaction is allowed, but data must not be retained abroad beyond processing

DPDP Act's approach to cross-border data transfer

Unlike RBI's strict in-India mandate for payment data, the DPDP Act takes a more liberal "blacklist" approach — personal data can be transferred outside India freely, except to countries that the Central Government specifically notifies as restricted. This is a lighter-touch approach than the EU's GDPR-style adequacy requirements.

Which businesses need to plan for this

• Fintechs/payment businesses: Must comply strictly with RBI's India-only payment data storage, regardless of where the rest of the business is hosted
• SaaS/general businesses handling personal data: Must track which countries are restricted under DPDP notifications and avoid transferring data there
• Businesses using foreign cloud providers: Should confirm their provider has India-region infrastructure if payment data localization applies

Why this gets confused in practice

Many businesses assume "data localization" is one uniform India-wide rule — in reality, the strict in-India storage obligation is specific to payment system data under RBI, while general personal data under DPDP has considerably more flexibility, as long as the destination isn't government-restricted.

Handling payments or large volumes of personal data? Our compliance team maps your data flows against both frameworks.