According to the Regulation on the Use of Aadhaar e-KYC Service of the Unique Identity Authority of India (UIDAI) for Issuing New Mobile Connections and Re-Verification of Existing Subscribers via OTP-Based Authentication, Indian citizens are required to register their SIM card with their Aadhaar Card (a type of national identity card). Foreigners have to provide their passport, a photocopy of their Indian visa/ travel permit, a passport-sized photo and contact details.

According to Art. 3.3 of the Information Technology Intermediaries Guidelines Rules, intermediaries are required to deploy technology-based automated tools or appropriate mechanisms with appropriate controls for proactively identifying and removing or disabling public access to unlawful information or content.

Section 69 of the Indian Information Technology Act (IITA) requires intermediaries to extend all facilities and technical assistance to intercept, monitor or decrypt information as well as to provide information stored in a computer or provide access to a computer resource when called upon to do so by certain agencies. This extends to online intermediaries, which are required to designate an officer to facilitate the execution of such orders. Intermediaries that fail to meet these obligations may be punished with imprisonment of up to seven years.

According to Art. 4.2 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules of 2021, a significant social media intermediary (defined as a social media intermediary having a number of registered users in India above five million) providing messaging services must enable identification of the first originator of the information on its computer resource as may be required by a judicial order or an order passed by a competent authority. In complying with an order for the identification of the first originator, a significant social media intermediary will not be required to disclose the contents of the electronic message related to the first originator or other users. No order must be passed in cases where there are less intrusive means of identifying the originator of the information.

It is reported that the Telecom Regulatory Authority of India (TRAI), the executive body responsible for the supervision and regulation of services in the telecommunications sector, operates independently of the government in its decision‑making processes. Pursuant to section 3 of the Telecom Regulatory Authority of India Act, TRAI is constituted as a body corporate with perpetual succession and a common seal, and is empowered, subject to the provisions of the Act, to acquire, hold and dispose of movable and immovable property, to enter into contracts, and to sue or be sued in its corporate name.

Section 4 of the Public Records Act states that no person shall take or cause to be taken public records out of India without the prior approval of the Central Government, except if done for any official purpose. 

India’s National Data Sharing and Accessibility Policy requires that “non-sensitive data available either in digital or analogue forms but generated using public funds” must be stored within the borders of India. The policy states that data belongs to the "agency/department/ministry/entity which collected them and resides in their IT-enabled facility” (Section 10).

In 2015, India’s Ministry of Electronics and Information Technology (MeitY) issued guidelines for a cloud computing empanelment process under which cloud computing service providers may be provisionally accredited as eligible for government procurement of cloud services. The guidelines require such providers to store all data in India to qualify for accreditation.
In addition, Section 2.1.d of the Guidelines for Government Departments on Contractual Terms Related to Cloud Services requires that any government contracts contain a localisation clause mandating that all government data residing in cloud storage networks is located on servers in India.
Also, Section 1.17.4 of the Master Service Agreement: Procurement of Cloud Services outlines, among other things, that cloud service providers must offer cloud services to the purchaser from a MeitY-enrolled data centre which is located in India, the data must be stored within India, and must not be taken out of India without explicit approval by the purchaser.

Section 3.9 of the Maintenance of Insurance Records Regulations mandates that insurance providers retain data pertaining to policies and claims on systems located within India, irrespective of whether such data is maintained in electronic form. In addition, Section 53.2 of the Protection of Policyholders’ Interests, Operations and Allied Matters of Insurers Regulations stipulates that all policyholder records must likewise be preserved within the territory of India.

Under Condition 39.23(viii) of the Unified Licence Agreement granted by the Department of Telecommunications, licensees are not permitted to transfer “subscriber accounting information” (except for roaming and related billing purposes) or “user information” (except if pertaining to foreign subscribers using an Indian Operator’s network while roaming, and International Private Leased Circuit subscribers) to any person or place outside of India. “User information” is not defined by Indian telecommunications law, and the requirements do not restrict financial disclosures imposed by statute. Condition 39.23(iii) prohibits the transfer of domestic technical network details to any place outside of India.

In accordance with Section 3 of the "Advisory for Financial Sector Organisations regarding Software as a Service (SaaS) based Solutions", certain categories of critical data, including credit and liquidity risk data, market risk data, system and sub-system information, supplier details, system configuration data, audit and internal audit records, as well as network topology and design, must be stored within the territorial jurisdiction of India. This advisory, issued by the Securities and Exchange Board of India (SEBI), applies to financial sector entities such as merchant banks, credit rating agencies, Straight Through Processing (STP) service providers, debenture trustees, depository participants, and other financial institutions that utilise SaaS-based solutions for the management of governance, risk, and compliance functions.

Pursuant to Section 18 of the "Reserve Bank of India (Know Your Customer (KYC)) Directions, 2016", all customer data, including recordings generated through Video-based Customer Identification Processes (V-CIP), must be stored within the territorial jurisdiction of India. The utilisation of cloud-based solutions is permissible only on the condition that the regulated financial institution retains complete control over such data. In addition, the V-CIP infrastructure and associated applications must incorporate mechanisms to prevent access originating from Internet Protocol (IP) addresses located outside India, as well as from spoofed IP addresses.

Under Clause ix of the "Guidelines for Acquiring and Producing Geo-Spatial Data and Geo-Spatial Services including Maps", digital maps and geospatial data with spatial accuracy or value finer than the prescribed threshold must be stored and processed exclusively on domestic cloud infrastructure or on servers physically located within the territory of India. Conversely, data with spatial accuracy or value up to the threshold may be uploaded to cloud platforms.

Principle 3 of the "Framework for Adoption of Cloud Services by SEBI-Regulated Entities (REs)" stipulates that all data, including logs and any other information relating to the regulated entity, which is stored or processed in a cloud environment must remain within the territorial jurisdiction of India. A regulated entity refers to SEBI-registered or recognised intermediaries, such as brokers, mutual funds, KYC registration agencies, and qualified registrars to an issue (QRTAs), as well as market infrastructure institutions, including stock exchanges, clearing corporations, and depositories, all of which are subject to SEBI regulation.

Section 5.e of the Annexure to Circular No. PFRDA/2023/33/ICS/01 stipulates that entities regulated by the Pension Fund Regulatory and Development Authority (PFRDA) are required to ensure that all data storage and processing activities, including logs and any other information pertaining to the intermediary hosted on cloud infrastructure, are conducted strictly within the territorial jurisdiction of India.