Data Localisation, Explained

'Data localisation' gets used as if it's a single rule. In practice it's a family of related but distinct requirements, and which version applies depends heavily on what kind of data is involved and which regulator is asking.

Two different things people mean by it

Sometimes localisation means a hard mirroring requirement — a copy of specified data must be stored on servers physically located in the country, even if a copy also exists elsewhere. The Reserve Bank of India's 2018 directive requiring payment system data to be stored only in India is an example of a stricter version of this kind of rule for that specific sector.

Other times, 'localisation' is used more loosely to describe restrictions on transferring data outside the country at all, rather than a strict in-country storage mandate — a distinction that matters a great deal for compliance, because the second is generally more restrictive than the first.

Why regulators want it

• Law enforcement access — data stored abroad can be slower and legally harder for domestic authorities to access when investigating a crime.
• Economic considerations — keeping data infrastructure and the associated economic activity within the country.
• Sovereignty and security concerns — reducing dependence on foreign jurisdictions for data critical to national systems, particularly financial and payment data.

The compliance reality

For a company operating in India, the practical question is rarely 'does data localisation apply to us' in the abstract — it's which specific sectoral rule applies to which specific category of data they hold, since payment data, personal data more broadly, and other regulated categories can each carry different requirements under different regulators.