The Information Technology Act establishes a safe harbour regime for intermediaries for copyright infringements. Section 79 of the Act provides intermediaries with qualified immunity for unlawful content as long as they follow the prescribed due diligence requirements and do not conspire, abet or aid an unlawful act. However, the protection lapses if an intermediary with "actual knowledge" of any content used to commit an unlawful act or, on being notified of such content, fails to remove or restrict access to it.

Section 13.4 of the "Reserve Bank of India (Digital Lending) Directions, 2025" stipulates that regulated entities must ensure that all data are stored exclusively on servers located within India. Where data are processed outside India, such data must be deleted from servers located abroad and repatriated to India within 24 hours of completion of processing. These requirements apply to all commercial banks; all primary (urban) co‑operative banks, state co‑operative banks, and central co‑operative banks; all non-banking financial companies, including housing finance companies; and all all‑India financial institutions.
Previously, pursuant to Section 4.4.2.2 of Annex 1 of the Regulatory Framework for Digital Lending, entities were required to ensure that all data were hosted on servers located within India, in strict adherence to applicable regulatory directives and legal obligations. This framework was introduced by the Reserve Bank of India, drawing upon the recommendations of the Working Group on Digital Lending, which examined lending practices conducted through online platforms and mobile applications.

Clause IV of Direction No. 20(3)/2022-CERT-In requires all service providers, intermediaries, data centres, body corporates, and government organisations to enable logs of all their ICT systems (that is, chronological record of system activities—a set of logs that can show who did what, when, and how within an ICT system) and to maintain such logs securely for a rolling period of 180 days within India.

In April 2018, the Reserve Bank of India (RBI) issued a directive stating that, within six months, all payment data held by payment companies should be held in local facilities. The Directive noted that this would help the RBI gain "unfettered supervisory access" to transaction data, which it needs to ensure proper monitoring.
Following a negative response from international payment companies such as MasterCard, Visa and American Express, the RBI has proposed (in "Frequently Asked Questions" of its website) to ease this restriction so as to allow payment firms to store data offshore as long as a copy was kept in India. The RBI has further clarified that for cross-border transaction data consisting of a foreign component and a domestic component, a copy of the domestic component may be stored abroad if required.
With respect to the processing of payment transactions outside India, the RBI requires that the data must be stored only in India after processing and should be deleted from systems abroad and brought back to India no later than 24 hours after processing. Any subsequent activity, such as settlement processing after payment processing done outside India, must be undertaken on a real-time basis, pursuant to which the data must be stored only in India.
The RBI has clarified that banks, especially foreign banks, can continue to store banking data abroad. Still, with respect to domestic payment transactions, the data must be stored only in India.

Rule 3.5 of the Companies (Accounts) Rules of 2014 provides that if company books and papers (or backups of them) are kept electronically in any location, they must also be periodically stored on a server physically located in India. 

India has only partially appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Section 16.1 of the Digital Personal Data Protection Act stipulates that the Central Government may, by notification, impose restrictions on the transfer of personal data by a data fiduciary for processing to any country or territory outside India as may be specified. In addition, Section 16.2 provides that nothing in Section 16 shall limit the operation of any law currently in force in India that affords a higher level of protection or imposes stricter conditions on the transfer of personal data by a data fiduciary outside India, whether in respect of particular categories of personal data, specific data fiduciaries, or designated classes thereof. Under Section 2, a data fiduciary is defined as any person who, either independently or jointly with others, determines the purpose and means of processing personal data.
Section 15 of the Digital Personal Data Protection Rules, which implement the Digital Personal Data Protection Act, provides that personal data processed by a data fiduciary under the Act may be transferred outside the territory of India, subject to the requirement that the data fiduciary complies with such conditions as the Central Government may prescribe, by general or special order, in relation to making such personal data available to any foreign State, or to any person, entity, or agency under the control of, or associated with, such a State; in addition, section 13.4 of the Rules requires a significant data fiduciary to implement measures ensuring that personal data specified by the Central Government, on the basis of recommendations of a committee constituted for that purpose, is processed subject to the restriction that both the personal data and the traffic data relating to its flow are not transferred outside the territory of India. “Significant data fiduciary” is defined as any data fiduciary or class of data fiduciaries notified as such by the Central Government under section 10 of the Act.
Once the Digital Personal Data Protection Act is fully in force, on 13 May 2027, the Information Technology Rules will be repealed. Rule 7 of Information Technology Rules states that the export of sensitive personal data or information within or outside India is permissible, provided that the same standards of data protection required in India are adhered to and that transfer is necessary for the performance of a lawful contract or has been consented to by the provider of the information. Sensitive personal information includes passwords, financial information such as bank account or credit/debit card details, sexual orientation, physical and mental health condition, and biometric information, among others.

It is reported that the Telecom Regulatory Authority of India (TRAI), the executive body responsible for the supervision and regulation of services in the telecommunications sector, operates independently of the government in its decision‑making processes. Pursuant to section 3 of the Telecom Regulatory Authority of India Act, TRAI is constituted as a body corporate with perpetual succession and a common seal, and is empowered, subject to the provisions of the Act, to acquire, hold and dispose of movable and immovable property, to enter into contracts, and to sue or be sued in its corporate name.

Section 4 of the Public Records Act states that no person shall take or cause to be taken public records out of India without the prior approval of the Central Government, except if done for any official purpose. 

India’s National Data Sharing and Accessibility Policy requires that “non-sensitive data available either in digital or analogue forms but generated using public funds” must be stored within the borders of India. The policy states that data belongs to the "agency/department/ministry/entity which collected them and resides in their IT-enabled facility” (Section 10).

In 2015, India’s Ministry of Electronics and Information Technology (MeitY) issued guidelines for a cloud computing empanelment process under which cloud computing service providers may be provisionally accredited as eligible for government procurement of cloud services. The guidelines require such providers to store all data in India to qualify for accreditation.
In addition, Section 2.1.d of the Guidelines for Government Departments on Contractual Terms Related to Cloud Services requires that any government contracts contain a localisation clause mandating that all government data residing in cloud storage networks is located on servers in India.
Also, Section 1.17.4 of the Master Service Agreement: Procurement of Cloud Services outlines, among other things, that cloud service providers must offer cloud services to the purchaser from a MeitY-enrolled data centre which is located in India, the data must be stored within India, and must not be taken out of India without explicit approval by the purchaser.

Section 3.9 of the Maintenance of Insurance Records Regulations mandates that insurance providers retain data pertaining to policies and claims on systems located within India, irrespective of whether such data is maintained in electronic form. In addition, Section 53.2 of the Protection of Policyholders’ Interests, Operations and Allied Matters of Insurers Regulations stipulates that all policyholder records must likewise be preserved within the territory of India.

Under Condition 39.23(viii) of the Unified Licence Agreement granted by the Department of Telecommunications, licensees are not permitted to transfer “subscriber accounting information” (except for roaming and related billing purposes) or “user information” (except if pertaining to foreign subscribers using an Indian Operator’s network while roaming, and International Private Leased Circuit subscribers) to any person or place outside of India. “User information” is not defined by Indian telecommunications law, and the requirements do not restrict financial disclosures imposed by statute. Condition 39.23(iii) prohibits the transfer of domestic technical network details to any place outside of India.

In accordance with Section 3 of the "Advisory for Financial Sector Organisations regarding Software as a Service (SaaS) based Solutions", certain categories of critical data, including credit and liquidity risk data, market risk data, system and sub-system information, supplier details, system configuration data, audit and internal audit records, as well as network topology and design, must be stored within the territorial jurisdiction of India. This advisory, issued by the Securities and Exchange Board of India (SEBI), applies to financial sector entities such as merchant banks, credit rating agencies, Straight Through Processing (STP) service providers, debenture trustees, depository participants, and other financial institutions that utilise SaaS-based solutions for the management of governance, risk, and compliance functions.

Pursuant to Section 18 of the "Reserve Bank of India (Know Your Customer (KYC)) Directions, 2016", all customer data, including recordings generated through Video-based Customer Identification Processes (V-CIP), must be stored within the territorial jurisdiction of India. The utilisation of cloud-based solutions is permissible only on the condition that the regulated financial institution retains complete control over such data. In addition, the V-CIP infrastructure and associated applications must incorporate mechanisms to prevent access originating from Internet Protocol (IP) addresses located outside India, as well as from spoofed IP addresses.