Data Localisation

Data localisation sits at the far end of the cross-border-transfer spectrum: not just restrictions on where data may go, but affirmative requirements that it must remain inside a specified jurisdiction. India's RBI payment-data circular requires payment system data to be stored only in India (with a mirror copy abroad permitted for processing). SEBI, IRDAI, UIDAI and the earlier DISHA proposals impose their own sector-specific localisation. China's PIPL contains localisation requirements for critical-information-infrastructure operators. Russia's FZ-242 requires personal data of Russian citizens to be stored in Russia.

Under GDPR, the DPDP Act and the UAE PDPL, there is no general data-localisation requirement — all three regulate cross-border transfer rather than mandating local storage. The DPDP Act's Rule 15 and the UAE PDPL's cross-border framework operate on destination-restriction, not jurisdiction-of-storage. Multinational privacy programmes typically model localisation obligations per sectoral regulator rather than per general privacy law, and keep a dated mapping of which workloads must stay where.