This is a hosting company's explanation of where data residency and hosting meet. It is not legal advice; for your own obligations, ask a lawyer who knows your sector.
"Our data has to stay in India" is said with confidence in a lot of meetings, and it is true for some businesses, not required for others, and a sensible default for most. The law behind it is more specific than the slogan.
What the Act says
The Digital Personal Data Protection Act 2023 covers personal data of individuals in India. On location, it does not say all personal data must be stored in India. Section 16 allows the central government to restrict transfers of personal data to countries it notifies, which is a different thing from a blanket localisation rule. Separate sector regulators do impose location requirements: the Reserve Bank of India for payment system data, for instance, and others for their own industries.
The Act's main weight is elsewhere: lawful purpose, consent or a legitimate use, reasonable security safeguards, notifying the Data Protection Board and affected people after a breach, deleting data when the purpose ends. Penalties for failing to keep reasonable security safeguards run to ₹250 crore under the Schedule.
What a server in India settles
Hosting in India removes the transfer question from the table. No analysis of which countries are notified, no contract clauses about cross-border movement, no explaining to a customer or auditor why their data is in Frankfurt. For a business under a sector rule that requires it, it is the only option. For everyone else, it is the simplest answer to a question that is otherwise asked repeatedly.
It also means your provider is an Indian company you can serve notice on, invoices with GST you can claim, and engineers in your time zone. Those are not legal points, but they come up in the same meetings.
What it does not settle
A server in Noida does not consent for you, does not limit what you collect, does not encrypt your database, does not write your breach process, and does not delete records when they expire. The host secures the building, the power, the physical access, and the network up to your server; everything inside the operating system is yours. A compliant hosting location with an unpatched application is still a breach waiting to happen.
A practical split
The provider's side: a certified facility, physical access control, 2N power, DDoS scrubbing, a network under the provider's control, hardware that stays in the country, and a written statement of where it is. Ours are a Tier IV facility in Noida and a datacenter in Mumbai; you choose which at order time, and the invoice and the facility page say exactly where your server is.
Your side: a data inventory, a lawful basis for each use, access controls inside the server, encryption where it matters, backups (ours is an add-on; keep your own copy too), a retention schedule, and a breach plan with the board's contact details already in it.
Questions we get asked
Does hosting in India make us DPDP-compliant? No. It settles location. The rest of the Act is about how you handle the data, wherever it is.
Our customers are abroad. Does the Act apply? It applies to personal data of people in India, and to processing outside India connected with offering goods or services to them. Ask a lawyer about your case.
Is a Tier IV facility a compliance requirement? No law names a Tier. It is evidence of reasonable physical safeguards, which the Act does require.
Can we get a written statement of where our data is? Yes. Our facility page and contract name the city, Noida or Mumbai, and the building.
What about backups leaving the country? Our backup add-on keeps copies in the same facility. If you run your own off-site backups, choose a location that fits your rules.
