Data Residency in India: DPDP Act Compliance Guide

Introduction

India's Digital Personal Data Protection Act, 2023 (DPDP Act) represents a landmark shift in the country's approach to data privacy. With over 800 million internet users, India is one of the largest digital markets in the world, and the DPDP Act establishes a comprehensive framework for how personal data must be collected, processed, stored, and transferred. This guide covers the Act's key provisions, data residency implications, and practical compliance steps.

Overview of the DPDP Act

The DPDP Act was passed by the Indian Parliament in August 2023 and received presidential assent shortly after. It replaces the earlier Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and establishes a modern, principles-based data protection framework.

Key Definitions

• Data Principal: The individual whose personal data is being processed (equivalent to "data subject" under GDPR)
• Data Fiduciary: The entity that determines the purpose and means of processing personal data (equivalent to "data controller")
• Data Processor: An entity that processes data on behalf of a Data Fiduciary
• Significant Data Fiduciary: A Data Fiduciary designated by the government based on volume, sensitivity, or risk of data processed
• Consent Manager: A registered entity that manages consent on behalf of Data Principals

Core Principles

The DPDP Act is built around several fundamental principles:

• Lawful and transparent processing
• Purpose limitation
• Data minimization
• Accuracy of data
• Storage limitation
• Security safeguards
• Accountability

Data Residency and Cross-Border Transfers

One of the most closely watched aspects of the DPDP Act is its approach to cross-border data transfers.

The Transfer Framework

The DPDP Act takes a permissive approach to international data transfers compared to earlier drafts of Indian data protection legislation:

• Personal data may be transferred to any country or territory outside India, unless the Central Government has specifically restricted transfers to that destination.
• The government maintains a "negative list" -- a list of countries to which transfers are prohibited.
• There is no blanket requirement for data localization of general personal data.

Government-Restricted Transfers

Transfer Type	Rule
General Personal Data	Permitted unless destination is on the restricted list
Data of Significant Data Fiduciaries	May face additional restrictions
Government-Related Data	Likely subject to localization requirements
Sector-Specific Data	Additional rules under sector regulators (e.g., RBI, SEBI)

Sector-Specific Localization Requirements

While the DPDP Act itself does not mandate broad data localization, several sector regulators in India have their own requirements:

• Reserve Bank of India (RBI): Payment data must be stored exclusively in India. This applies to all payment system operators, including banks and fintech companies.
• Securities and Exchange Board of India (SEBI): Certain financial data must be maintained within India.
• Insurance Regulatory and Development Authority (IRDAI): Insurance-related data has localization expectations.
• Telecom Regulatory Authority of India (TRAI): Subscriber data may face localization requirements under telecom regulations.

Rights of Data Principals

The DPDP Act grants Data Principals several important rights:

• Right to Access: Obtain a summary of personal data being processed and the processing activities
• Right to Correction and Erasure: Request correction of inaccurate data or erasure of data no longer needed
• Right to Grievance Redressal: File complaints with the Data Fiduciary and, if unresolved, with the Data Protection Board
• Right to Nominate: Designate a nominee to exercise rights in case of death or incapacity

Duties of Data Principals

Uniquely, the DPDP Act also imposes duties on Data Principals:

• Do not file false or frivolous complaints
• Provide accurate information when exercising rights
• Do not impersonate another person when providing personal data

Obligations for Data Fiduciaries

Consent Requirements

• Consent must be free, specific, informed, unconditional, and unambiguous
• Consent must be given through a clear affirmative action
• Data Fiduciaries must provide a notice in clear and plain language before collecting data
• Consent may be withdrawn at any time, and withdrawal must be as easy as giving consent

Security Safeguards

Data Fiduciaries must implement reasonable security safeguards to prevent personal data breaches, including:

• Encryption of personal data
• Access controls
• Regular security assessments
• Incident response procedures

Breach Notification

In the event of a personal data breach, Data Fiduciaries must notify:

• The Data Protection Board of India
• Affected Data Principals

The notification must be made in the prescribed manner and within the prescribed timeframe (to be specified in rules).

Significant Data Fiduciaries

The Central Government may designate certain Data Fiduciaries as "Significant Data Fiduciaries" based on:

• Volume and sensitivity of personal data processed
• Risk to the rights of Data Principals
• Potential impact on India's sovereignty and integrity
• Risk to electoral democracy
• Security of the state
• Public order

Additional Obligations for Significant Data Fiduciaries

• Appoint a Data Protection Officer based in India
• Appoint an independent data auditor
• Conduct periodic Data Protection Impact Assessments
• Comply with additional requirements prescribed by the government

The Data Protection Board of India

The DPDP Act establishes the Data Protection Board of India (DPBI) as the primary enforcement body. Key functions include:

• Adjudicating complaints from Data Principals
• Imposing penalties for non-compliance
• Directing remedial actions
• Publishing decisions and guidelines

Penalties

The DPDP Act prescribes significant penalties for non-compliance:

Violation	Maximum Penalty (INR)	Approximate USD
Failure to take security safeguards resulting in breach	250 crore	~$30 million
Failure to notify a breach	200 crore	~$24 million
Non-compliance with obligations regarding children	200 crore	~$24 million
Non-compliance with Significant Data Fiduciary duties	150 crore	~$18 million
Other violations	50 crore	~$6 million

Practical Compliance Steps

Step 1: Classify Your Role

Determine whether you are a Data Fiduciary, Data Processor, or both. Assess whether you might be designated as a Significant Data Fiduciary.

Step 2: Audit Data Flows

Map all personal data processing activities involving Indian Data Principals:

• What data is collected?
• Where is it stored?
• Who has access?
• Is it transferred outside India?
• What sector-specific rules apply?

Step 3: Implement Consent Mechanisms

Build consent collection and management systems that meet the DPDP Act's requirements:

• Clear and plain language notices
• Granular consent options
• Easy withdrawal mechanisms
• Record-keeping for consent

Step 4: Review Cross-Border Transfers

• Check the government's restricted country list
• Ensure compliance with sector-specific localization requirements (especially RBI for payment data)
• Document transfer mechanisms and safeguards

Step 5: Establish Breach Response Procedures

Develop and test incident response plans that include:

• Detection and assessment processes
• Notification procedures for the DPBI and affected individuals
• Remediation steps
• Documentation requirements

How GlobalDataShield Supports DPDP Compliance

Organizations processing data of Indian residents face a complex patchwork of requirements from the DPDP Act and sector regulators. GlobalDataShield provides granular data residency controls that enable organizations to keep payment data within India as required by the RBI while maintaining flexibility for other data categories -- all managed through a single platform with built-in encryption and audit capabilities.

Conclusion

The DPDP Act brings India into the ranks of countries with comprehensive data protection legislation. While its approach to cross-border transfers is more permissive than many expected, the combination of government restriction powers, sector-specific localization mandates, and significant penalties means that organizations must take compliance seriously. Staying informed about implementing rules and sector-specific guidance will be essential as the regulatory framework matures.