What is data sovereignty: meaning, laws, and how it applies in India

Let’s start with a question: Where your data lives and whose law governs it? 

If you cannot answer that in one sentence, you have a data sovereignty problem. That is true even if you have never used the term before.

Data sovereignty means data follows the law of the country where it sits. It has nothing to do with where your company is based. Store data in Mumbai, and Indian law applies. Store the same data in Virginia, and US law applies instead.

In this blog we will talk about what data sovereignty actually means. It also covers how this differs from data residency and data localization. And it covers what applies to a business running in India right now and how we take care of this at CloudPe.

Key takeaways

If you only have two minutes, here is what you need to know:

• Data sovereignty means the country where data sits sets the law that governs it.
• Data residency is about physical location. Data sovereignty is about which law applies.
• Data localization is a government rule. It can create data sovereignty as a side effect.
• India’s DPDP Act is enacted but not fully enforced. Full compliance is due by May 2027.
• RBI’s payment data rule is already enforced, and strictly. CERT-In’s reporting rule is too.
• SEBI introduced its own data localization rule in 2024, then paused it. It is still paused in 2026.
• A cloud provider based outside India can still be compelled by its home country’s laws, even if your data sits in an India data center.

What is data sovereignty?

Data sovereignty means data follows the law of wherever it is stored. Store data in a Mumbai data center, and Indian law applies to it. Store the same data in a Virginia data center, and US law applies instead, even if your company is Indian.

This played out in a real case. In United States v. Microsoft Corp., the US government wanted emails Microsoft had stored in Dublin, Ireland. Microsoft said a US warrant could not reach data sitting outside the US. The case went to the Supreme Court in 2018. Before the Court ruled, Congress passed the CLOUD Act, letting US warrants reach data held by US companies anywhere in the world. The Supreme Court then dropped the case, since the new law had already answered the question. (Source: National Constitution Center)

Data sovereignty vs data residency vs data localization

These three terms get thrown around like they mean the same thing. They do not.

Data sovereignty

The law that governs your data, based on where it sits. It decides who can access your data and which court has authority over it.

Data residency

The physical location of your data. Nothing more.

Data localization

A government rule. It says specific data has to stay inside a country’s borders.

Here’s the part people miss. You can have full data residency in India. A foreign law can still apply, if the company storing your data is based somewhere else.

Why data sovereignty matters

1. Legal compliance: Over 100 countries now have data protection laws. The EU’s GDPR alone can fine you up to 4% of your global annual revenue. If you operate across countries, you need to know which law applies to which data. Guessing wrong here is expensive.
2. Cross-border conflicts: The US CLOUD Act lets the US government compel US cloud providers to hand over data, even if that data sits outside the US. If you run an Indian business on a US hyperscaler, this is your exposure. Your data can sit in an India region. A US court order can still reach it, because the company holding it is American.
3. Audits and due diligence: This question comes up during client audits and regulatory inspections more often than you would expect. You need a direct answer to “where is this data, and whose law governs it.” Not having one slows down deals.

Data sovereignty in India

India now has its own data protection law. It is not fully switched on yet. Here is what already applies, and what is still coming.

The DPDP Act, 2023

The Digital Personal Data Protection Act, 2023, or the DPDP Act, is India’s first personal data law. It became law in August 2023. It covers digital personal data processed inside India. It also covers data processed outside India, if that processing involves offering goods or services to people in India.

The DPDP Rules, 2025 were notified in November 2025. They spell out how the Act actually works: consent management, breach reporting, and the Data Protection Board of India.

Here’s the part most people miss. This rollout happens in stages, not all at once.

• The rules setting up the Data Protection Board took effect in November 2025.
• Consent Manager registration rules take effect in November 2026.
• The real compliance load, consent, security safeguards, breach notification, and cross-border transfer rules, lands in May 2027.

So no, the DPDP Act is not fully enforced right now. Full compliance is due in May 2027.

RBI and SEBI: two very different stories

RBI moved first, and it is not messing around. An RBI circular has required this since April 2018. Every payment system operator must store Indian transaction data only in India.

Mastercard, American Express, and Diners Club found out the hard way. RBI barred all three from onboarding new customers in India over this exact rule.

SEBI tried something similar. In 2024, it introduced a data localization rule for regulated entities. This was part of its Cybersecurity and Cyber Resilience Framework. Then, in December 2024, SEBI put that rule on hold after industry pushback. As of 2026, it is still on hold, waiting on further consultation.

Here’s the real picture. RBI’s rule is live and enforced. SEBI’s rule exists on paper, but it is not active right now. SEBI’s older record-keeping rules are a separate thing. They still require stock brokers to preserve transaction records for five years.

CERT-In requirements

CERT-In requires you to report cybersecurity incidents within 6 hours of noticing them. It also requires you to keep logs of your ICT systems for 180 days, inside India. This applies no matter where your main infrastructure sits. It has been in force since 2022.

If you handle Indian user data, you are dealing with three layers at once: DPDP, RBI or SEBI, and CERT-In. Clearing one does not clear the other two.

Challenges of data sovereignty

• Cross-border data flows: If you operate across regions, you often need to move the same customer record between countries. Sovereignty rules can restrict exactly how and when that move happens. One customer record touching India, the EU, and the US can trigger three separate rule sets at once.
• Cost of localization: Storing data in a specific country usually means local infrastructure, even in a region you were not planning to operate in. That is real, added cost.
• Conflicting jurisdictions: A cloud provider can be legally required to meet one country’s data request. That same request can break another country’s data law. This is exactly what happens when the US CLOUD Act runs into GDPR or the DPDP Act.
• Regulatory change: Laws change, and the DPDP Act’s own rollout proves it, spread across 2023 to 2027 in stages. A compliance program needs one clear owner, or it falls behind.

How businesses achieve data sovereignty

• Run a data audit first: Know what data you hold. Know where each type sits. Know which law applies to each one. Most companies cannot answer this properly until they map it out.
• Pick a cloud provider that can name the data center: Ask exactly which data center holds your data. Ask who can access it. A vague answer is your red flag.
• Encrypt data at rest and in transit: This limits what a government can actually use, even if it forces disclosure. The data stays unreadable without the keys.
• Write your response plan before you need it: Decide now who in your company handles a foreign data request if one lands on your desk. Figuring this out mid-incident means deciding under pressure.
• Put one person in charge of tracking the law: DPDP, RBI, SEBI, and CERT-In requirements change on a schedule. November 2026 and May 2027 are both real dates. Miss one, and the penalties are real too.

Data sovereignty in cloud computing

A cloud provider’s data center network usually spans several countries. By default, you often will not know which country your backup data lands in.

A sovereign cloud fixes exactly this. It is a cloud platform built to keep your data inside one country, under that country’s law, with no automatic backup somewhere else.

For a business in India, this decides what “the cloud” actually means for you. A hyperscaler can offer an India region for storage. Its parent company still answers to its home country’s laws, including the US CLOUD Act if that parent is American. A cloud provider incorporated in India has no foreign parent for a foreign government to lean on.

How CloudPe approaches data sovereignty

CloudPe is built for data sovereignty. Your data stays in India, hosted in Tier 4 certified data centers, with no automatic replication outside the country.

CloudPe holds ISO 9001, ISO 27001, and SOC 2 certifications. We run on infrastructure built by Leapswitch, which has been in this industry for 20+ years.

If you run a BFSI or healthcare business, this gives you a direct answer to “where is my data, and whose law applies”: India, under Indian law. CloudPe is not a US company, so the US CLOUD Act does not reach it.

To be clear, this does not cover your DPDP, RBI, SEBI, or CERT-In compliance for you. That work stays yours. What we remove is the foreign jurisdiction sitting on top of it.