Data localisation rules for Indian websites
Data localisation for an Indian website is not one law that sends every file to an Indian disk. Payment-system data follows the Reserve Bank of India. Personal data follows the Digital Personal Data Protection Act, which still allows many transfers abroad. The right host depends on which rule, contract, or tender applies.
For Indian site owners deciding where their data must sit: which regulator moves which data, and how that turns into a region choice and a written answer.
knowledge
- Read time
- 4 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What does data localisation mean for an Indian site owner?
Data localisation means a law, a contract or a tender requires a named class of your data to be stored in India — not that every website must abandon a foreign server. A brochure site with no personal data and no payments is a different hosting question from a payment system. Name the data before you name a city.
Payment records, personal data and a department's public site are three different questions with three different sources. The Reserve Bank of India speaks for payment-system storage; the Ministry of Electronics and Information Technology is the ministry behind the personal-data law; a tender document speaks for itself. If a claim on a hosting site does not name its source, treat it as marketing.
The law-and-regulation landscape behind these rules — the RBI direction, CERT-In log retention and the DPDP Act mapped to infrastructure — is a separate guide: data localisation laws in India for hosting. This page stays on the practical question: what you, the site owner, actually do.
What does the RBI payment-data mandate mean for your hosting?
The Reserve Bank of India requires payment-system data to be stored in India, and that duty sits on the payment system — not on every shop that merely redirects to a gateway. If your own systems store card or payment-system data, plan an Indian location for that data and the copies you keep. If you only send the buyer to a gateway page and store no payment data yourself, your brochure is not the payment system.
In practice the decision line reads: if [your stack touches payment-system data], then [that data and its backups belong on Indian systems], because [the regulator's direction names the storage, not the cache]. A shop on shared hosting that hands checkout to a PCI-compliant gateway lives differently from a fintech app that runs its own database of transactions. Read the Reserve Bank's own directions before you rely on any summary, including this one.
For the underlying geography trade-off — an Indian origin versus a US one — the numbers and the reasoning are set out in India versus US server hosting.
What about CERT-In log retention?
The CERT-In directions of 28 April 2022 require covered entities to retain ICT system logs securely for a rolling 180 days within India and report specified cyber incidents within six hours. Check the applicable directions and your responsibilities rather than treating the server's location alone as proof of compliance.
Ask where web-server, authentication, firewall and application logs are collected and retained. On a VPS you may configure retention yourself; on shared hosting, request the provider's log location and retention period in writing. Keep region confirmations for origins, backups and log pipelines alongside any available restore-test evidence.
How does the DPDP Act treat cross-border transfer of personal data?
The Digital Personal Data Protection Act allows personal data to leave India, except to countries the Central Government restricts by notification — it is not a blanket order to keep a local copy of everything. Notice, consent and individual rights are the Act's core work, and that work is separate compliance from choosing a server city.
A hosting region is not a substitute for that compliance, and a compliance certificate is not a data-centre address. The notice, consent and rights obligations are handled in DPDP Act compliance; the Act's text and rules sit with the Ministry of Electronics and Information Technology. This page does not restate penalty figures or section numbers.
Which situations actually force an Indian server?
Three situations move the files themselves into India: payment-system data under the RBI requirement, a government department's placement rules, and a tender or contract that names an Indian server. Ordinary personal data follows DPDP transfer rules instead, and licensed sectors follow their own regulator.
| Situation | Practical hosting question |
|---|---|
| Payment-system data | Store that data in India, as the Reserve Bank's direction requires |
| Ministry or state department site | Often placed with NIC or a state data centre, which a retail plan does not replace |
| Tender that says "server in India" | Files and backups in India, not only a cache that looks fast |
| Ordinary personal data | DPDP transfer rules apply; no automatic India-only disk |
| Healthcare or other licensed records | Follow that sector's regulator or the contract; no health statute is interpreted here |
How government sites are placed in practice — NIC, state data centres and empanelment — is covered in government website hosting in India. WebJi® claims no government or health certification.
Indian data centre or global server plus CDN?
Choose an Indian data centre when your visitors are in India or a rule requires the origin and backups to sit in India; a global server plus CDN only accelerates public files, while the HTML, the login and any regulated record still come from the origin. If the rule says India, an edge cache abroad does not satisfy it.
The WebJi® data centres page states where WebJi® places servers: India is the default for shared, WordPress and cloud plans, with other regions available. That page is a location fact, not a compliance certificate — confirm the region for your plan in writing before you pay.
How to check where your data actually sits today
You can establish your current data geography in an afternoon, with the welcome mail, one network command and a list of your processors. Do this before arguing about laws; most disputes turn out to be an unknown region, not an unlawful one.
- Read the IP in your hosting welcome mail and run a traceroute or a whois on it. The route names the carrier and the exit city.
- Ask your host where backups are kept, in writing. Backups in another country can undo an Indian-origin arrangement.
- List every third party that touches data — gateway, analytics, mail, chat — and note each one's region from its own documentation.
- Check what your CDN caches. Static assets abroad are usually harmless; form posts and login traffic are not "cached", they go to the origin.
- Write the answer on one page: origin region, backup region, processors and their regions. That page is what an auditor or a tender officer reads.
Redo the exercise at every renewal. Hosts add regions, gateways change processors, and the one-page answer decays quietly.
Frequently asked questions
Does every Indian website need hosting in India?
No. Only a named class of data pulls the storage into India: payment-system data under the RBI requirement, a department's placement rules, or a tender that names an Indian server. A brochure site with no personal data and no payments can host anywhere that serves its visitors well.
Is a CDN enough if a rule says the data must be in India?
No. A CDN caches public files at the edge; the origin server still serves every dynamic request, and regulated data still lives wherever the origin and its backups live. If the obligation names India, the origin and the backups must be in India, not only a fast copy of your images.
Do backups also have to be in India?
Where a regulator requires storage in India, the copies count too — a backup in another country is still storage. Ask your host in writing where nightly backups are kept, and treat a vague answer as a reason to confirm before the audit rather than after it.
Does using an Indian gateway like Razorpay make my whole site compliant?
It removes card data from your own stack if you redirect or use their hosted fields, which is exactly how a small shop should integrate. It does not localise your customer database or your email list; personal data follows the DPDP Act's transfer rules, which is a different obligation from payment-data storage.
Where does WebJi® place its servers?
India is the default region for shared, WordPress and cloud plans, and the published regions are listed on the WebJi® data centres page. Confirm the region for the exact plan you are buying by email before payment when a rule or tender depends on it.
Regulatory statements summarise the RBI direction and the DPDP Act as published; no section numbers are restated · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.