Your SaaS product passes the demo. Then the CISO asks one question: “Where exactly will our data sit?” For many Indian enterprises, the answer decides whether the deal moves to procurement or stops.
The short answer: India has no single blanket data localisation law for all software, but several rules and buyer policies push enterprise data into Indian regions. Vendors who can show in-region hosting, documented data flows and sector-specific attestations clear the security gate faster than those who explain after being asked.
This guide is a practical, step-by-step checklist. It is general information, not legal advice, so confirm your position with counsel.
What does the data residency mandate actually require in India?
There is no single rule covering all enterprise data. The Digital Personal Data Protection Act, 2023 allows cross-border transfers except to countries the government restricts, while sector regulators and company policies add stricter in-country expectations. In practice, enterprise buyers often treat Indian hosting as the safe default.
| Source of expectation | What it typically means for a SaaS vendor |
|---|---|
| DPDP Act, 2023 | Lawful processing and security safeguards; transfers can be restricted to specific countries by the government |
| Sector regulators (RBI, SEBI, IRDAI) | Stricter storage, audit and outsourcing expectations for regulated buyers |
| CERT-In directions | Incident reporting and log retention requirements that buyers expect vendors to support |
| Enterprise security policy | Many groups require Indian regions or a written exception for any offshore processing |
How do you map where customer data actually flows?
Start with a data-flow diagram that shows every place customer data is stored, processed, backed up or accessed. Include sub-processors, support tooling, analytics and logging systems, because buyers often find residency gaps there rather than in the main database. Keep the diagram current, because it becomes your core evidence in the security review.
- Primary database and file storage region
- Backup and disaster recovery region
- Logs, monitoring and error-tracking tools
- Support access from outside India
- Third-party APIs and sub-processors
How do you configure an in-region deployment step by step?
Choose an Indian cloud region, pin all storage and backups to it, and restrict replication to Indian regions only. Then enforce the setting through infrastructure-as-code so it cannot drift. Document the result in a one-page residency statement for buyers.
- Select an Indian region with a paired Indian disaster recovery region.
- Pin databases, object storage and backups to those regions by policy.
- Disable cross-region replication to non-Indian regions.
- Route logs and telemetry to Indian storage or anonymise before export.
- Encrypt data at rest and in transit, and keep keys in an Indian region where required.
- Run a quarterly check that confirms no data sits outside approved regions.
How do you control support and engineering access from outside India?
Treat remote access as processing. Offer just-in-time, logged and approved access, and give buyers the option to restrict support to Indian staff. Show access logs on request. This answers the second half of the residency question that many vendors miss.
What evidence should you hand to the enterprise security team?
Provide a short, consistent evidence pack rather than long explanations. Security reviewers reward vendors who answer before the questionnaire arrives.
- Data-flow diagram with regions marked
- Residency statement signed by your CTO or security lead
- Sub-processor list with locations
- Access-control and logging summary
- Security certifications such as ISO/IEC 27001 or SOC 2
- Incident response plan aligned with CERT-In reporting expectations
What mistakes slow data residency approvals?
Most delays come from vague answers and hidden dependencies. A single offshore logging tool can reopen a review that looked finished.
- Claiming “India hosted” while backups or logs replicate abroad
- Ignoring sub-processors and analytics tools
- Giving sales answers to engineering questions
- Waiting for the questionnaire before preparing evidence
Frequently Asked Questions
Is data localisation mandatory for all SaaS products in India?
No single law requires all enterprise data to stay in India. However, sector regulators, enterprise policies and the DPDP Act’s power to restrict transfers mean Indian hosting is often expected, especially by regulated buyers.
Which cloud regions do Indian enterprises prefer for SaaS deployments?
Most prefer Indian regions from major cloud providers, with disaster recovery also inside India. The best choice depends on the buyer’s cloud agreements and any regulator-specific rules.
How can a startup prove data residency during a security review?
Share a data-flow diagram, a signed residency statement, a sub-processor list and configuration evidence showing storage and backups pinned to Indian regions. Offer to demonstrate the settings during the review call.
Conclusion
Data residency is a trust test as much as a legal one. Map your data flows, pin storage and backups to Indian regions, control offshore access, and hand over a clear evidence pack before the questionnaire arrives. Vendors who do this turn a deal-stopping question into a quick checkbox.
Next step: Selling SaaS into Indian enterprises? Share notes with other founders and CXOs at thebuildersclub.me.
References and Further Reading
- India’s DPDP Act could trigger a mass repatriation of cloud data, exchange4media
- Why Data Residency Is Now a Board-Level Issue for Indian Enterprises, CXOToday
- Data sovereignty and cloud computing: A call to action for Indian businesses, YourStory
- India’s data protection rules trigger race to readiness, PwC
- CERT-In, Indian Computer Emergency Response Team
