DPDP Act & Data Localisation

Imagine a global technology company that has always stored Indian users' personal data on servers in the US or Singapore, the way most global cloud infrastructure was originally built, suddenly facing a legal framework that lets the Indian government restrict exactly that practice for specific categories of sensitive data. India's Digital Personal Data Protection Act, 2023, fully operationalised through the DPDP Rules notified on November 14, 2025, creates exactly this possibility.

The Act's actual approach to cross-border data transfer is more nuanced than a blanket localisation mandate, it uses what's called a 'blacklist' model, permitting data transfers abroad by default unless the government explicitly restricts transfer to specific countries or for specific categories of data, giving the government real regulatory discretion to require localisation selectively rather than applying it uniformly across every kind of data.

Even this more flexible framework has been enough to meaningfully shift corporate behaviour, global companies handling Indian user data increasingly plan for at least some India-based data storage and processing capability as a hedge against future restrictions, rather than waiting to react only once the government actually exercises its blacklist authority for a specific data category or country.

This regulatory pressure is a genuine, if less headline-grabbing, demand driver sitting alongside the AI-and-cloud-computing boom covered elsewhere on this site, some of the data centre capacity being built in India exists not because of AI workload growth at all, but because compliance-conscious global companies increasingly want the option of India-based data storage available before they need it, a structural, policy-driven demand source layered on top of the technology-driven one.