# Data Localisation Rules for Indian Fintechs Explained

Where your data physically lives has become a board-level question for Indian fintechs. Between the RBI's payment data rules, the Digital Personal Data Protection Act, and sector-specific circulars, the compliance map is patchy — stricter than most jurisdictions in some areas, more flexible than assumed in others. Here's what actually applies.

The RBI Payment Data Localisation Mandate

What it says

In April 2018, the RBI issued its circular on Storage of Payment System Data, with compliance required from 2022 after an extension. The core requirements:

  • End-to-end payment data for transactions in India must be stored only in India
  • This covers full transaction details — payer/payee information, amounts, timestamps, and related messages
  • A mirror copy of data stored abroad must be brought back to India within one business day or payment day
  • Foreign leg of cross-border transactions (where the transaction leg is outside India) is exempt
  • System auditors must certify compliance annually, and the RBI conducts on-site examinations

Why the RBI insisted

The stated rationale is supervisory access: in a payment failure or fraud investigation, the regulator must be able to inspect data without depending on foreign governments or companies. The rule also pushed global players — Visa, Mastercard, and others — to build Indian data infrastructure, and drove the creation of domestic payment networks like RuPay and UPI.

What Counts as "Payment Data"

The RBI's definition is broad: data relating to funds transfer, payment instructions, beneficiary details, and transaction messages. Notably, it does not include:

  • Transaction attributes needed solely for risk management that aren't part of payment instructions
  • Non-payment data such as merchant analytics unrelated to transaction processing

Fintechs must map their data flows carefully — misclassifying payment data as "analytics" is a common compliance failure.

Beyond Payments: The DPDP Act, 2023

The Digital Personal Data Protection Act takes a different approach: not strict localisation, but restrictions on cross-border transfer. Personal data may be sent abroad except to countries on a government-notified "negative list." Key obligations for fintechs:

  • Consent-based, purpose-limited processing
  • Breach notification to the Data Protection Board and affected users
  • Data fiduciary responsibilities including deletion on request
  • Higher obligations for "significant data fiduciaries," which may include localisation requirements for specific data classes

So the practical picture is layered: payment data must stay in India; other personal data can flow abroad unless restricted.

Other Sector-Specific Rules

  • RBI's outsourcing and cloud guidance requires regulated entities to ensure service providers (including cloud vendors) comply with Indian data norms
  • Account Aggregator framework enforces end-to-end encryption and no data retention by intermediaries
  • SEBI and IRDAI impose their own storage expectations for securities and insurance data
  • UPI ecosystem rules require payment data processing within India for UPI participants

Practical Compliance Steps for Fintechs

  1. Classify your data: tag payment data, KYC data, and general personal data separately — each has different rules
  2. Choose infrastructure accordingly: Indian regions of AWS, Azure, and GCP exist specifically for this; verify your SaaS vendors' data residency claims contractually
  3. Audit the data flow: trace where every field originates, is processed, replicated, and backed up — including logs and analytics pipelines
  4. Get certified: annual system audit certification for payment data is mandatory, not optional
  5. Prepare for DPDP: consent management, breach playbooks, and a grievance officer are table stakes

    6. How Compliant Architecture Enables Products

    Data localisation is often framed as a burden, but domestic, verified data infrastructure is what makes fast, compliant credit decisions possible. B2B financing platforms demonstrate the payoff: KredFlow uses GSTIN-based verification to approve businesses instantly, letting them pay annual SaaS contracts monthly while vendors receive payment upfront — all built on India-resident, consent-based data flows that regulators can inspect end to end.

    The Bottom Line

    India's data rules are strict where it matters most — payments — and pragmatic elsewhere. Fintechs that classify data correctly, choose India-resident infrastructure deliberately, and build consent architecture for the DPDP era will find localisation is less a constraint than a trust signal to lenders, partners, and regulators alike.