Understanding RBI Data Localization for Cloud Infrastructure in India

The Regulatory Landscape: RBI & CERT-In

Under the Reserve Bank of India's directive on the 'Storage of Payment System Data', all payment system operators and fintech entities must ensure that complete end-to-end transaction data is stored exclusively in systems located inside India.

In addition, CERT-In guidelines mandate strict 180-day retention of server and firewall logs within Indian jurisdiction, alongside a mandatory 6-hour incident reporting window for cybersecurity breaches.

What Constitutes 'Payment System Data'?

Payment data includes customer information (Name, Mobile, AADHAAR/PAN where applicable), payment credentials (OTP, PIN, Tokenized card data), and end-to-end transactional logs from initiation to clearing and settlement.

While data may be processed offshore for cross-border fraud analysis, it must be permanently repatriated and stored on Indian soil within 24 hours of processing.

Designing Compliant Server Architectures

To achieve 100% compliance without sacrificing operational agility, enterprises employ single-tenant dedicated bare-metal servers or private cloud hypervisors located in Tier-III Indian facilities:

• Physical Isolation: Dedicated servers with hardware IPMI console access located in Noida or Mumbai data centers.
• Encryption at Rest: AES-256 hardware-level full disk encryption on all NVMe volumes.
• Private VLAN Segregation: Isolated internal network perimeters with strict ingress/egress firewall ACLs.

Audit Trails and Mandatory Log Retention

System administrators must configure centralized immutable syslog servers utilizing NTP time synchronization against the National Physical Laboratory (NPL) standard, ensuring tamper-proof audit trails for RBI and CERT-In audits.