{"id":974,"date":"2026-08-23T21:29:12","date_gmt":"2026-08-23T21:29:12","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=974"},"modified":"2026-08-23T21:29:12","modified_gmt":"2026-08-23T21:29:12","slug":"data-localisation","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/glossary\/data-localisation\/","title":{"rendered":"Data Localisation"},"content":{"rendered":"\n<!-- =========================================================================\n     OSTO GLOSSARY: DATA LOCALISATION\n     Shared glossary design system. Paste into one Custom HTML block. No H1.\n     ========================================================================= -->\n\n<style>\n.og{\n  --navy:#1c267a; --text:#0f1538; --muted:#0f1538; --light:#0f1538;\n  --border:#e7e9f2; --divider:#eceef5; --white:#ffffff;\n\n  --peri-50:#f4f5fd;  --peri-100:#e9ecfa; --peri-200:#cfd5f2; --peri-700:#4a52a8;\n  --sage-50:#f2f8f5;  --sage-100:#e3f0e9; --sage-200:#c3ddce; --sage-700:#3a6f5d;\n  --apri-50:#fdf6f0;  --apri-100:#fbe9dc; --apri-200:#f2cdb2; --apri-700:#a2603a;\n  --plum-50:#f8f3f9;  --plum-100:#f0e6f3; --plum-200:#dcc6e2; --plum-700:#6b4576;\n  --sky-50:#f1f7fb;   --sky-100:#e2eff7;  --sky-200:#bfd9e9;  --sky-700:#2f6a89;\n\n  --shadow:0 6px 22px rgba(15,21,56,.05);\n  --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;\n  font-family:var(--font); font-size:17px; line-height:1.75; color:var(--text);\n}\n.og p{margin:0 0 22px}\n.og h2{font-family:var(--font);font-size:clamp(25px,3vw,31px);font-weight:700;line-height:1.25;letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}\n.og h2::after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}\n.og h2.c-sage::after{background:var(--sage-200)}\n.og h2.c-apri::after{background:var(--apri-200)}\n.og h2.c-plum::after{background:var(--plum-200)}\n.og h2.c-sky::after{background:var(--sky-200)}\n.og ul,.og ol{padding-left:22px;margin:0 0 24px}\n.og li{margin-bottom:9px}\n.og strong{font-weight:600}\n\n.og .dek{font-size:20px;line-height:1.6;color:var(--muted);margin:0 0 18px}\n.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}\n.og .tags li{margin:0}\n.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}\n.og .t-peri{background:var(--peri-100);color:var(--peri-700)}\n.og .t-sage{background:var(--sage-100);color:var(--sage-700)}\n\n.og .short{background:linear-gradient(135deg,var(--peri-100) 0%,var(--sage-100) 100%);border-radius:22px;padding:28px 32px;margin:0 0 30px}\n.og .short .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}\n.og .short p{font-size:19px;line-height:1.65;margin:0;color:var(--text)}\n\n.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}\n.og .toc .k{font-size:12px;font-weight:700;letter-spacing:1.3px;text-transform:uppercase;color:var(--peri-700);margin:0 0 12px}\n.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}\n.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}\n.og .toc a{color:var(--navy);text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}\n.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}\n.og .callout p:last-child{margin-bottom:0}\n.og .callout.c-plum{background:var(--plum-50);border:none;border-radius:20px}\n.og .callout.c-plum .k{color:var(--plum-700)}\n\n.og figure{margin:0 0 30px}\n.og .sx{overflow-x:auto;-webkit-overflow-scrolling:touch;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}\n.og .sx svg{display:block;width:100%;height:auto;min-width:600px}\n.og figcaption{font-size:14px;line-height:1.6;color:var(--muted);margin-top:12px}\n.og .swipe{display:none}\n\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}\n.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}\n.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}\n.og tr:last-child td{border-bottom:none}\n.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}\n.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}\n.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}\n\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}\n.og .tcard{border-radius:18px;padding:20px 22px}\n.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}\n.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}\n.og .tcard p{font-size:14px;line-height:1.55;margin:0;color:var(--muted)}\n.og .tcard.a{background:var(--sky-50)}   .og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}\n.og .tcard.b{background:var(--sage-50)}  .og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}\n.og .tcard.c{background:var(--plum-50)}  .og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}\n.og .p-req{background:var(--plum-200);color:#4d2f57}\n.og .p-exp{background:var(--sky-100);color:var(--sky-700)}\n.og .p-imp{background:#eef0f4;color:var(--muted)}\n.og .p-ask{background:var(--apri-100);color:var(--apri-700)}\n\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}\n.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px;align-items:flex-start}\n.og summary::-webkit-details-marker{display:none}\n.og summary::after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700);flex:0 0 auto}\n.og details[open] summary::after{content:\"\\2013\"}\n.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}\n\n.og .related{font-size:15px;color:var(--muted);border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n\n@media(max-width:700px){\n  .og{font-size:16px}\n  .og .dek{font-size:18px}\n  .og .short p{font-size:17px}\n  .og .short,.og .toc,.og .callout{padding:22px 20px}\n  .og .toc ol{columns:1}\n  .og .trio{grid-template-columns:1fr}\n  .og .swipe{display:inline;font-weight:600;color:var(--peri-700)}\n  .og table{font-size:14px}\n  .og th,.og td{padding:11px 12px}\n}\n<\/style>\n\n<div class=\"og\">\n\n<p class=\"dek\">Data localisation is the requirement to store data inside a country&#8217;s borders, and in India it is not one rule but several sectoral rules that apply to different kinds of data.<\/p>\n\n<ul class=\"tags\">\n  <li><span class=\"tag t-peri\">Glossary<\/span><\/li>\n  <li><span class=\"tag t-sage\">India<\/span><\/li>\n<\/ul>\n\n<div class=\"short\">\n  <p class=\"k\">The short answer<\/p>\n  <p>Data localisation, also written data localization, means keeping data physically within a jurisdiction. India has no single localisation statute. The strictest rule is the RBI directive of 6 April 2018, which requires payment system data to be stored only in India. CERT-In requires logs to be maintained within Indian jurisdiction. The DPDP Act, contrary to a widespread assumption, does not impose general data localisation. Which rule binds you depends on what data you hold and who regulates your customer.<\/p>\n<\/div>\n\n<p>That distinction matters commercially. Teams routinely over-engineer for a DPDP requirement that does not exist while missing a payment rule that does.<\/p>\n\n<div class=\"toc\">\n  <p class=\"k\">On this page<\/p>\n  <ol>\n    <li><a href=\"#what\">What data localisation means<\/a><\/li>\n    <li><a href=\"#which\">Which rule applies to which data<\/a><\/li>\n    <li><a href=\"#dpdp\">The DPDP misconception<\/a><\/li>\n    <li><a href=\"#payment\">Payment data, the strictest rule<\/a><\/li>\n    <li><a href=\"#prove\">Proving data localisation, not just doing it<\/a><\/li>\n    <li><a href=\"#osto\">How Osto gets you audit-ready<\/a><\/li>\n    <li><a href=\"#faq\">FAQ<\/a><\/li>\n  <\/ol>\n<\/div>\n\n<h2 id=\"what\">What data localisation means<\/h2>\n\n<p>Localisation sits on a spectrum. At the soft end, a copy must be kept in-country while the original may travel. In the middle, data may be processed abroad but must return and be deleted overseas. At the hard end, the data may never leave. India uses all three, in different sectors, at the same time.<\/p>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 260\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Three Indian data localisation regimes: payment system data, security logs, and general personal data under the DPDP Act.\">\n  <rect x=\"14\" y=\"20\" width=\"732\" height=\"66\" rx=\"15\" fill=\"#1c267a\"\/>\n  <text x=\"34\" y=\"46\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#ffffff\">Payment system data<\/text>\n  <text x=\"34\" y=\"66\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#b9c1e6\">Stored only in India. Processing abroad is allowed for cross-border legs, but the data must be<\/text>\n  <text x=\"34\" y=\"80\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#b9c1e6\">purged overseas and returned. Evidenced through an annual audit filed with the RBI.<\/text>\n  <rect x=\"596\" y=\"34\" width=\"132\" height=\"26\" rx=\"13\" fill=\"#4a52a8\"\/>\n  <text x=\"662\" y=\"52\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#ffffff\">Hard requirement<\/text>\n\n  <rect x=\"14\" y=\"96\" width=\"732\" height=\"66\" rx=\"15\" fill=\"#cfd5f2\"\/>\n  <text x=\"34\" y=\"122\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#4a52a8\">Security logs<\/text>\n  <text x=\"34\" y=\"142\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#0f1538\">Maintained within Indian jurisdiction under the CERT-In Directions, for a rolling window,<\/text>\n  <text x=\"34\" y=\"156\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#0f1538\">and produced on demand during an investigation.<\/text>\n  <rect x=\"596\" y=\"110\" width=\"132\" height=\"26\" rx=\"13\" fill=\"#4a52a8\"\/>\n  <text x=\"662\" y=\"128\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#ffffff\">Hard requirement<\/text>\n\n  <rect x=\"14\" y=\"172\" width=\"732\" height=\"66\" rx=\"15\" fill=\"#e3f0e9\"\/>\n  <text x=\"34\" y=\"198\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#3a6f5d\">General personal data<\/text>\n  <text x=\"34\" y=\"218\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#0f1538\">Transfer abroad is permitted by default under the DPDP Act. Only destinations the government<\/text>\n  <text x=\"34\" y=\"232\" font-family=\"Inter,sans-serif\" font-size=\"11\" fill=\"#0f1538\">restricts are blocked, plus specified categories for significant data fiduciaries.<\/text>\n  <rect x=\"596\" y=\"186\" width=\"132\" height=\"26\" rx=\"13\" fill=\"#3a6f5d\"\/>\n  <text x=\"662\" y=\"204\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11\" font-weight=\"700\" fill=\"#ffffff\">Not localisation<\/text>\n<\/svg>\n<\/div>\n<figcaption><span class=\"swipe\">Swipe to see the full diagram. <\/span>One company can sit under all three lanes at once, with different answers for different tables in the same database.<\/figcaption>\n<\/figure>\n\n<h2 id=\"which\" class=\"c-sage\">Which rule applies to which data<\/h2>\n\n<table class=\"h-sage\">\n  <thead>\n    <tr><th>Data<\/th><th>Source of the obligation<\/th><th>Effect<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Payment system data<\/td><td>RBI directive on storage of payment system data, 6 April 2018<\/td><td><span class=\"pill p-req\">Store in India<\/span><\/td><\/tr>\n    <tr><td>Security and system logs<\/td><td>CERT-In Directions, 2022<\/td><td><span class=\"pill p-req\">Maintain in India<\/span><\/td><\/tr>\n    <tr><td>Insurance records<\/td><td>Insurance record-keeping regulations<\/td><td><span class=\"pill p-req\">Hold in India<\/span><\/td><\/tr>\n    <tr><td>General personal data<\/td><td><a href=\"https:\/\/www.osto.one\/resources\/glossary\/dpdp-act\/\">DPDP Act<\/a>, Section 16 and Rule 15<\/td><td><span class=\"pill p-exp\">Transfer allowed by default<\/span><\/td><\/tr>\n    <tr><td>Specified categories held by a significant data fiduciary<\/td><td>DPDP Rules, Rule 13<\/td><td><span class=\"pill p-ask\">Blocked once notified<\/span><\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<p>Section 16 of the DPDP Act also preserves any Indian law that sets a higher bar. The payment rule is not softened by the newer statute. It sits on top.<\/p>\n\n<h2 id=\"dpdp\" class=\"c-apri\">The DPDP misconception<\/h2>\n\n<p>Early drafts of India&#8217;s privacy legislation did contain broad data localisation. The version that became law did not. Under Section 16 and Rule 15, personal data may be transferred outside India except to countries the Central Government specifically restricts, and no such list has been notified. This is a negative-list model, the opposite of an adequacy regime.<\/p>\n\n<div class=\"callout\">\n  <p class=\"k\">What this means in practice<\/p>\n  <p>For an ordinary SaaS company, an e-commerce platform or a marketing tool, there is currently no general DPDP obligation to keep personal data on Indian servers. There is also no requirement to adopt standard contractual clauses, binding corporate rules or transfer impact assessments. Those are GDPR constructs with no Indian equivalent, and retrofitting them is wasted effort.<\/p>\n<\/div>\n\n<p>Two caveats keep this from being a free pass. Rule 13 lets the government bar a significant data fiduciary from moving specified categories of personal data offshore, and once notified that is absolute. And the cross-border provisions come into force on a staggered timetable following the notification of the DPDP Rules on 13 November 2025, so the position can change with a single gazette notification. Mapping your flows now is the cheap version of that risk.<\/p>\n\n<h2 id=\"payment\" class=\"c-plum\">Payment data, the strictest rule<\/h2>\n\n<p>The RBI directive covers the full end-to-end transaction detail and any information collected, carried or processed as part of the payment message or instruction. Storage is India-only. Where a transaction has a foreign leg, the data may be processed abroad, but it must be deleted from the foreign systems and brought back within the permitted window.<\/p>\n\n<table class=\"h-peri\">\n  <thead>\n    <tr><th>What auditors actually check<\/th><th>What satisfies it<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Where the data physically resides<\/td><td>Region-pinned infrastructure with <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">cloud posture management<\/a> proving no resource drifted to a foreign region<\/td><\/tr>\n    <tr><td>End-to-end data flow, including every third party<\/td><td>Current flow maps that match the running system, not last year&#8217;s architecture<\/td><\/tr>\n    <tr><td>Backups, replicas and disaster recovery copies<\/td><td>The same residency rule applied to every copy, which is where most teams are caught out<\/td><\/tr>\n    <tr><td>Logs, analytics pipelines and monitoring tools<\/td><td>Confirmation that observability vendors are not silently exporting payment fields<\/td><\/tr>\n    <tr><td>Deletion after offshore processing<\/td><td>Evidence of purge, not an assertion that purge happens<\/td><\/tr>\n    <tr><td>Access from outside India<\/td><td>Controlled remote access with <a href=\"https:\/\/www.osto.one\/resources\/glossary\/mfa\/\">multi-factor authentication<\/a> and full session logging<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<h2 id=\"prove\" class=\"c-sage\">Proving data localisation, not just doing it<\/h2>\n\n<p>Compliance and evidence of compliance are different projects. A payment system operator demonstrates data localisation through a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/system-audit-report\/\">System Audit Report<\/a> prepared by a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cert-in-empanelment\/\">CERT-In empanelled auditor<\/a> and filed annually with the RBI. The auditor is not looking for a policy document. They are looking for storage locations, flow diagrams, deletion records and access trails that agree with each other.<\/p>\n\n<p>This is where the failure mode lives. Architecture is usually compliant. The evidence for it usually is not, because nobody was generating it while the system was being built.<\/p>\n\n<h2 id=\"osto\">How Osto gets you audit-ready<\/h2>\n\n<p>Osto covers the technical side of data localisation by default rather than as add-ons. <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">Cloud posture management<\/a> across AWS, Azure and GCP catches resources created outside an approved region before an auditor does. <a href=\"https:\/\/www.osto.one\/resources\/glossary\/api-security\/\">API discovery<\/a> surfaces the integrations that quietly move data offshore. <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dlp\/\">Data loss prevention<\/a> and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest\/\">encryption at rest and in transit<\/a> handle the protection side, and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/siem\/\">correlated logging<\/a> produces the retained trail the CERT-In Directions expect to see held in India.<\/p>\n\n<p>The evidence layer is purpose-built for this. One control set answers an RBI reviewer, a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/payment-aggregator\/\">payment aggregator<\/a> customer&#8217;s vendor questionnaire, <a href=\"https:\/\/osto.one\/resources\/blog\/soc-2-for-startups\/\" target=\"_blank\" rel=\"noopener\">SOC 2<\/a> and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a> together. Osto prepares your evidence and gets you through the review. The mandated audit is performed by the empanelled auditor.<\/p>\n\n<!-- ============ CTA ============ -->\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\">\n  <p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:11px;font-weight:700;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Free security assessment<\/p>\n  <p style=\"color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:26px;line-height:1.3;font-weight:700;letter-spacing:-.4px;margin:0 0 12px;\">Know where your data actually lives<\/p>\n  <p style=\"color:#cfd3ea;font-family:'Inter',-apple-system,sans-serif;font-size:16px;line-height:1.65;margin:0 auto 26px;max-width:520px;\">Osto maps your cloud footprint, catches resources outside approved regions, and holds the evidence an auditor asks for. Cloud posture, VAPT, logging and compliance in one platform.<\/p>\n  <a href=\"https:\/\/osto.one\/contact\/\" style=\"display:inline-block;background:#ffffff;color:#1c267a;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:700;font-size:16px;text-decoration:none;border-bottom:none;padding:14px 30px;border-radius:12px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#1c267a;\">Get a free security assessment<\/span><\/a>\n  <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:transparent;color:#ffffff;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:600;font-size:16px;text-decoration:none;border:1.5px solid rgba(255,255,255,.5);border-radius:12px;padding:13px 28px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a platform walkthrough<\/span><\/a>\n  <p style=\"color:#b3b8d8;font-family:'Inter',-apple-system,sans-serif;font-size:13px;margin:14px 0 0;\">Audit-ready in days &middot; RBI, SEBI and DPDP mapped &middot; One platform, everything<\/p>\n<\/div>\n\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n\n<details>\n  <summary>What is data localisation?<\/summary>\n  <p>The requirement to store or process data within a defined jurisdiction. Versions range from keeping a mirror copy in-country, through allowing offshore processing followed by return and deletion, to prohibiting the data from leaving at all. India applies different versions to different categories of data.<\/p>\n<\/details>\n\n<details>\n  <summary>Does the DPDP Act require data localisation?<\/summary>\n  <p>Not generally. Section 16 and Rule 15 permit transfer of personal data outside India except to countries the Central Government restricts, and no restricted list has been notified. The exception is Rule 13, under which the government may bar a significant data fiduciary from transferring specified categories of personal data offshore.<\/p>\n<\/details>\n\n<details>\n  <summary>What does the RBI payment data localisation rule cover?<\/summary>\n  <p>All data relating to payment systems operated in India, including the full end-to-end transaction detail and any information collected, carried or processed as part of the payment instruction. It must be stored only in India. Data processed abroad for a foreign leg must be deleted from those systems and brought back within the permitted window.<\/p>\n<\/details>\n\n<details>\n  <summary>Do the CERT-In Directions require data localisation for logs?<\/summary>\n  <p>They require logs of information and communication technology systems to be maintained within Indian jurisdiction for a rolling period, and produced to CERT-In when an incident is being investigated. That is a residency obligation on logs specifically, separate from any payment or privacy rule.<\/p>\n<\/details>\n\n<details>\n  <summary>How do you prove data localisation to a regulator?<\/summary>\n  <p>Through evidence rather than assertion. Storage locations, end-to-end data flow maps, backup and replica configuration, third-party integrations, deletion records and access logs all have to agree. For payment system operators this is assembled into a System Audit Report by a CERT-In empanelled auditor and filed annually with the RBI.<\/p>\n<\/details>\n\n<p class=\"related\"><strong>Related glossary terms:<\/strong> DPDP Act &middot; System Audit Report &middot; CERT-In Empanelment &middot; Payment Aggregator &middot; CSPM &middot; DLP &middot; Encryption at Rest &middot; SIEM<\/p>\n\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Data localisation is the requirement to store data inside a country&#8217;s borders, and in India it is not one rule\u2026<\/p>\n","protected":false},"author":8,"featured_media":975,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[180],"tags":[433,434,435],"class_list":["post-974","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-glossary","tag-data-localisation","tag-data-localization-india","tag-rbi-data-localisation"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=974"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/974\/revisions"}],"predecessor-version":[{"id":976,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/974\/revisions\/976"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/975"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}