Data residency
Data residency in India,
explained without the jargon.
Every security questionnaire asks where your data lives. With Stornox the answer is short: in India. This page explains what the DPDP Act actually says about storage, and where sector rules go further.
Three terms
They sound alike. They are not.
Data residency
Where your data physically sits. A fact about your setup.
asks: where?Data localisation
A rule saying certain data has to stay in a country. A legal requirement.
asks: must it stay?Data sovereignty
Which country's laws apply to the data. Usually the country it sits in.
asks: whose law?DPDP Act 2023
What the Act asks of whoever holds the data.
A plain summary for storage and IT teams. It is not legal advice.
The Digital Personal Data Protection Act, 2023 covers digital personal data. The organisation that decides why and how that data is used is the data fiduciary. A company that stores or processes it on the fiduciary's behalf, like a storage provider, is a data processor.
The duties that land on your storage
- Reasonable security safeguards to prevent a personal data breach.
- Breach reporting to the Data Protection Board and to the people affected.
- Erasure once the purpose is served, unless another law says keep it.
- A valid contract with any processor that handles the data for you.
Sending data abroad
The Act does not ban cross-border transfers outright. It lets the government restrict transfers to countries it notifies, and it says stricter rules in other laws still apply. So the real question for most teams is which sector rules cover their data.
Sector rules worth checking
- Payments: the RBI requires payment system data to be stored only in India.
- Securities: SEBI's framework for regulated entities using cloud services includes data localisation requirements.
- Government work: tenders and procurement rules often state where data must be hosted.
Keeping every copy in India removes a whole category of questions, which is often what decides it for regulated data.
Where Stornox helps
Controls that support those duties.
Storage in India
Customer data stays on infrastructure located in India, which keeps residency answers simple in audits.
Encryption
AES-256 encryption, plus client-side encryption if you want only your team to hold the keys.
Object Lock and versioning
Keep records unchanged for a fixed period and recover from accidental or malicious changes.
Lifecycle deletion
Set rules that delete data and old versions automatically when the retention period ends.
Separate access keys
Give each application its own keys, limited to its own buckets.
Paperwork on request
A data processing agreement and security documentation for your vendor review.
Checklist
Six things to hand your compliance team.
- 1
Map the data
Which buckets hold personal data, and which sector rules cover each one.
- 2
Confirm every location
Primary copies, backups and replicas, with country and provider.
- 3
Write down retention
How long each type of data is kept. Then enforce it with lock and lifecycle rules.
- 4
Limit access
One key per application. Review who has console access every quarter.
- 5
Sign a DPA
With every provider that stores or processes the data for you.
- 6
Rehearse a breach
Who notices, who decides, who reports, and how fast.
FAQ
Questions we get asked.
Does the DPDP Act say all personal data must stay in India?
Not as a blanket rule. The Digital Personal Data Protection Act, 2023 lets the Central Government restrict transfers of personal data to countries it notifies, and it keeps stricter rules in other laws in force. Some regulators, such as the RBI for payment data, do require data to be stored in India. Your legal team should confirm what applies to you.
What is the difference between data residency, localisation and sovereignty?
Residency is simply where the data is stored. Localisation is a legal requirement that some data must be stored, and sometimes processed, inside a country. Sovereignty is the idea that data falls under the laws of the country where it sits.
If we use Stornox, are we DPDP compliant?
No product can make an organisation compliant on its own. Under the Act, your organisation is the data fiduciary and stays responsible for consent, security safeguards, breach reporting and deletion. Stornox gives you India-hosted storage and controls that support those duties.
Where does Stornox store data?
On infrastructure located in India. We can share site details for your account during onboarding.
Will Stornox sign a data processing agreement?
Yes. Enterprise customers can request a DPA that sets out how we handle data on their behalf. Ask sales on +91 91751 11820.
This page is a general summary for information only. It is not legal advice. Laws, rules and regulator guidance change, so please confirm your obligations with qualified counsel.
Related
Read next.
Get in touch
Questions about data residency?
Book a call and we will walk through where your data would sit and send you our security documentation.
Prefer to call? +91 91751 11820 · hello@stornox.com
