Quick answer

The Digital Personal Data Protection Act does not say every business must keep every personal dataset in India. Cross-border transfers are still allowed unless the government restricts a specific country by notification. But several rules make Indian hosting far safer and simpler for compliance: Rule 6 requires reasonable safeguards and one year of logs, CERT-In requires logs kept in India for 180 days, and RBI and SEBI still require certain categories of data to remain within the country. For businesses handling personal data, the hosting location is now part of risk management, not just infrastructure planning.

This is why many Indian businesses are moving workloads to certified Indian infrastructure. It reduces cross-border risk, keeps logs where regulators expect them, and makes breach reporting far easier under the 72-hour and 6-hour clocks. Elite Hosting gives you India-based infrastructure with the certifications and support model that support this approach.

Last updated: 11 October 2026. This is a practical compliance overview and not legal advice. Confirm your specific obligations with qualified counsel.

The DPDP timeline: what applies and when

The DPDP Act was passed in 2023, and the Rules were notified on 13 November 2025. That gives most businesses a phased runway to prepare.

That gives businesses a little over seven months from today to finish the infrastructure work. Moving hosting, setting up encryption, and testing breach reporting all take longer than people expect, so waiting is riskier than acting early.

Does the DPDP Act require data localisation?

Not as a blanket rule. Section 16 follows a negative-list approach: transfers are allowed unless the government specifically restricts a country by notification. As of early 2026, no country had been notified, and that means cross-border transfer remains generally allowed.

The catch is that the law still preserves stricter sector requirements. If a regulated domain such as payments or securities has local storage rules, those rules still apply. And the government can add countries to the restricted list at any time; if that happens, you would be forced into a difficult migration. Keeping personal data in India removes that risk from the start.

Which rules actually require data to stay in India?

The CERT-In rule is the one most companies miss. It applies far more broadly than RBI and SEBI, and it has been active since 2022. If your logs sit on a foreign server, you already have a gap before the DPDP deadline even arrives.

What DPDP Rule 6 asks of your hosting

Rule 6 sets out minimum reasonable security safeguards for a data fiduciary. Each one maps directly to choices in your hosting stack and operational controls:

If a breach happens, the Rules require you to inform the Data Protection Board without delay and provide a detailed report within 72 hours. CERT-In also requires many incidents to be reported within 6 hours. You can only meet those clocks if logs, alerts, access control, and backups are already in place and easy to inspect.

Shared responsibility: what your host does and what you do

The provider handles the facility, network, and core infrastructure. You remain responsible for the data and the controls that sit on top of it.

A good host makes your job easier: Indian location, certified data centre, root access, snapshots, and clean billing. It does not replace your own security model. The organisation that holds the personal data remains accountable.

Hosting checklist for DPDP readiness

Before your compliance deadline, ask the provider these questions:

• Where exactly is the data centre located and is it within India?
• Which certifications does the provider hold, such as ISO 27001 and Tier IV or Tier III?
• Where do backups and snapshots live?
• Can you encrypt volumes and control your own keys?
• Do you get full root access and KVM control?
• How is DDoS handled and how fast is support during an incident?
• Are logs and backups kept in India, with retention that meets DPDP and CERT-In requirements?
• Is the invoice in INR and does the vendor support procurement and audit requests?

These are not nice-to-haves. They are the difference between “we have a server” and “we have a compliant hosting environment.”

Why Elite Hosting for DPDP-ready hosting in India

Elite Hosting supports the Indian compliance story with infrastructure built for regulated workloads and local business needs. A local provider makes it easier to keep logs in India, keep backup and recovery close to home, and manage a clean audit trail from a single billing and procurement flow. For many businesses, this is simpler than mixing a foreign cloud region with a separate legal and operational compliance process.

The bigger point is design. If your business handles personal data, a compliant stack needs location, certification, encryption, logging, and a tested breach response. The provider should make those controls operationally easy to set up, not just claim “security” in marketing copy. Elite Hosting is a practical fit for businesses that want a cleaner Indian-hosting path without the friction of a large hyperscale platform.

The honest verdict

The DPDP Act does not ban all foreign hosting, but it also does not remove the need for data localism in the real world. Rule 6, CERT-In, RBI, and SEBI together make Indian hosting the safest and simplest default for businesses handling personal data. The risk is not only legal exposure — it is also operational speed when a security event triggers 6-hour and 72-hour reporting. The cleanest path is to keep personal data and logs in India on infrastructure designed for compliance, then layer in encryption, access control, monitoring, and tested incident workflows.

Elite Hosting gives you a practical India-based hosting route with the kind of infrastructure and support model that make compliance work easier. Use it as one part of your controls, not as a substitute for your own policies and legal review. That is the realistic strategy for 2026 and beyond.

Frequently asked questions

Does the DPDP Act require data to stay in India? Not for all data. Cross-border transfers are allowed unless the government notifies a restricted country. But sector laws and the operational requirements in Rule 6 still push many businesses toward Indian hosting.

What does the law require for hosting? It requires reasonable safeguards, access control, monitoring, encryption, retained logs, and a tested breach response. These are operational controls, not simple legal paperwork.

How long do logs need to be kept? DPDP requires logs and relevant records to be retained for one year for breach investigation, while CERT-In requires ICT logs to stay in India for a rolling 180 days.

What if my company uses AWS or a foreign cloud? It may still be compliant if your data flow and safeguards meet the rules, but you must evaluate country restrictions, retention, data maps, and sector requirements. For many Indian firms, Indian hosting is the simpler default.

Does the provider handle DPDP compliance? Only partly. The host handles the facility and infrastructure, but your business remains the data fiduciary and is responsible for encryption, access rules, logging, consent, and breach response.

What is the biggest mistake companies make? Waiting until the last minute. Moving hosting, setting up logging, and testing breach procedures takes time, and the compliance deadlines are not flexible.