Where your data is stored, and who can reach it, matters for contracts, customers and regulators. This article gives practical questions. It is not legal advice; ask your own adviser about the rules that apply to your industry.

Why it matters

India's Digital Personal Data Protection Act, 2023 sets duties for organisations that handle personal data. Some sectors, such as banking and insurance, have their own rules on top. Customers and enterprise buyers also often ask where data is kept.

Questions to ask every vendor

  1. In which country and region is my data stored?
  2. Where are backups kept?
  3. Which of your staff or sub-processors can access it, and from where?
  4. Can I choose a region, and can I change it later?
  5. How is data encrypted at rest and in transit?
  6. What happens to my data when the contract ends?
  7. How and when will you tell me about a breach?
  8. Can I get an export in a standard format?

Check the contract, not only the brochure

Ask for the answers in the agreement or a data processing addendum. Marketing pages describe options; contracts describe commitments.

Get help

Pick a partner with experience in your sector. Browse verified cloud and security partners on SARVO.

FAQ

Does data have to stay in India? It depends on your sector and contracts. Ask your legal adviser.

Is a global cloud provider fine? Often yes, if you can select an Indian region and the contract matches your needs.