What is cloud storage?

Cloud storage is disk space you rent in a provider's data centre and reach over the internet, with the provider keeping redundant copies so a single failed drive does not lose your data. You never buy, install or replace the disks; you pay for the capacity you keep and, on many services, for the data you download.

The journey of one file is short. An app, browser or API uploads it over an encrypted connection; the provider writes it to two or more disks, often on separate machines; and any authorised device can read it back later. A phone photo backup, a shared office drive and a folder of website images are all cloud storage when the disks belong to someone else and the path to them is the internet.

Most cloud storage is public: many customers share the provider's infrastructure, each locked out of the others' data. Private cloud storage is reserved for one organisation, and hybrid storage splits data between the two.

• Personal — a single person's synced photo or document library on a public service.
• Public — shared infrastructure, priced per gigabyte, scales without limit for most buyers.
• Private — storage hardware used by one organisation only, on-premises or hosted; see private cloud hosting explained.
• Hybrid — sensitive records kept private, bulk media or archives on public storage.

Cloud storage protects well against hardware failure because of redundant copies, but it does not protect against stolen logins, ransomware or a sync that overwrites a good file with a bad one. Those risks need access control and an independent backup.

• Redundancy: multiple copies on separate disks or machines survive a drive failure.
• Encryption in transit: TLS protects the file while it travels.
• Encryption at rest: data is scrambled on the provider's disks.
• Access control: two-factor login, least-privilege sharing and expiring links decide who reads what.
• Versioning: keeps earlier copies so an overwritten or encrypted file can be rolled back.
• A second copy: one backup outside the same account, following the 3-2-1 backup rule.

Under the Digital Personal Data Protection Act, 2023, your business stays responsible for the personal data it collects, so you should know which country holds every copy before uploading customer records. The provider's region setting decides the location, not the word "cloud".

Check the region for each service, including laptop sync apps that may use a default you never chose. Sector rules — for example RBI's payment data storage directions — can be stricter than the Act. The data localisation guide and WebJi®'s DPDP compliance page set out the obligations.