By Naraway
In this article
When Shein returned to India in February 2025, five years after its app was blocked, the terms were unusual. Every piece of data collected from Indian customers would stay in India, run on Indian infrastructure, and Shein itself would have no access to it. Reliance Retail would run the business; Shein would supply the technology.
That is the far end of India's data rules. Most businesses never get near it. But nearly every app, payment flow and cloud setup serving Indian users meets at least one of the four rules below, and they do not all ask for the same thing.
Sources: RBI; CERT-In directions via Mondaq; DPDP Rules via Mondaq.
The Four Rules
Payments: RBI, 2018
All payment system data stored only in India. Data processed abroad is deleted there and brought back within one business day or 24 hours.
Security logs: CERT-In, 2022
Logs of all systems kept for 180 days within Indian jurisdiction. Specified incidents reported within six hours. In force since 27 June 2022.
Personal data: DPDP Act
Transfers allowed unless the government restricts a country or entity. Operative from May 2027. No restricted list notified yet.
Sector rules
Rules stricter than the DPDP Act, from regulators in banking, insurance, telecom and others, continue to apply.
The One That Catches Most Businesses
RBI's April 2018 circular gave payment system operators six months to bring all payment data home, and required an audit by a CERT-In-empanelled auditor to prove it. It applies to the operators, but its effect runs down the chain: any business whose product touches card or UPI data in India inherits the constraint through its payment partner.
The One Most Teams Miss
CERT-In's directions reach far wider than payments. They apply to service providers, intermediaries, data centres and body corporates, which covers almost every company running systems for Indian users. Logs must be kept for 180 days within Indian jurisdiction. Lawyers still argue over whether a copy in India is enough when the primary logs sit abroad; CERT-In's own FAQs lean that way.
The One Still Coming
The DPDP Act chose a negative list instead of blanket localisation: personal data can go anywhere the government has not restricted. The provision becomes operative in May 2027, and no country has been named yet. Section 16(2) keeps every stricter sector rule alive, which is why a bank, an insurer and a gaming company can face three different answers to the same question.
When Data Becomes the Price of Entry
Two returns show how localisation works outside the statute book. Krafton's Battlegrounds Mobile India, blocked in July 2022, was allowed back on a three-month trial in May 2023 after Krafton addressed concerns over data security and the location of its servers. Shein's return through Reliance went further, giving up both data access and operational control.
Why Businesses Accept the Terms
The terms are accepted because of what is on the other side: 1.11 billion internet subscribers, 24 billion UPI payments a month, and the fastest-growing major economy in the IMF's 2026 forecasts. Indian data centre capacity has grown to meet the demand, and the major cloud providers all run Indian regions.
Which of the four rules a product falls under, which data actually has to stay, what can be processed abroad and for how long, and how the architecture should change before May 2027 depend on what the product does with Indian users' data. The cheapest time to settle it is before the first Indian user signs up.
Part of Naraway's research series India Market Entry in 2026.
In short
India has no single data localisation law. Payment system data must be stored only in India under an RBI circular of April 2018, with data processed abroad brought back within one business day or 24 hours. CERT-In's 2022 directions require 180 days of system logs to be kept within Indian jurisdiction. The DPDP Act allows personal data to leave India unless the government restricts a country, and that rule applies from May 2027. Sector regulators and individual deals can go further: Shein's 2025 return to India required all Indian customer data to stay in India.
- Payment data: stored only in India since RBI's April 2018 circular.
- Security logs: 180 days within Indian jurisdiction, under CERT-In directions effective 27 June 2022.
- DPDP Act: transfers allowed except to restricted countries; operative from May 2027, no list notified yet.
- Sector laws stricter than DPDP continue to apply.
- Shein and BGMI returned to India only after committing to keep Indian data in India.
Sources
- Storage of Payment System Data: FAQs, Reserve Bank of India
- 6 hours to report cyber incidents to CERT-In and more compliances, Mondaq
- From localisation debates to a negative list: cross-border data transfers under India's DPDP Act, Mondaq
- Shein surrenders data, ownership control to seal India comeback, TechCrunch
- Krafton to relaunch BGMI mobile game in India, a year after ban, TechCrunch
Frequently Asked Questions
Is data localisation mandatory in India?
Not across the board. Payment system data must be stored only in India, and CERT-In requires system logs to be kept within Indian jurisdiction. Other personal data can generally be transferred abroad under the DPDP Act unless the government restricts a destination.
What does RBI's data localisation rule require?
All data relating to payment systems must be stored only in India. Where processing happens abroad, the data must be deleted there and brought back to India within one business day or 24 hours, whichever is earlier.
What do the CERT-In directions require?
Service providers, intermediaries, data centres and companies must maintain logs of their systems securely for a rolling 180 days within Indian jurisdiction, and report specified cyber incidents within six hours.
When do DPDP cross-border transfer rules apply?
Section 16 of the DPDP Act and Rule 15 of the DPDP Rules become operative in May 2027, at the end of the 18-month phase-in.
Can a sector regulator require stricter localisation than the DPDP Act?
Yes. Section 16(2) of the DPDP Act preserves stricter requirements under other Indian laws.
