A cloud region does not describe every place your data travels

A supplier says the database is hosted in Mumbai. That answers a useful question about one location, but it may not answer where support staff work, where diagnostic logs are stored or which service receives a file attachment. Procurement needs a map of the relevant processing, not just the name of the primary region.

This does not mean every service necessarily moves data through all those routes. It means the business should ask which routes exist and obtain evidence about the actual arrangement. Assumptions are a poor substitute for a supplier’s specific explanation.

As of 22 October 2026, the main DPDP transfer-related provisions discussed here are scheduled for 13 May 2027 under the commencement notification. Existing sector restrictions and other applicable laws must be assessed separately.

Break the service into data paths

Start with primary storage and processing. Then ask about replicas, backups, logs, monitoring tools, support tickets, remote administration and subprocessors. Identify whether each route contains personal data, a limited subset or no personal data relevant to the business.

A hypothetical travel agency uses a customer platform with its main database in India. A support ticket might contain a screenshot of a traveller’s details. That screenshot could follow the support service’s storage and access arrangements rather than the main database’s regional setting.

The example is a reason to examine the route, not an assertion about every vendor. Ask the supplier to explain the locations, purposes, access controls and retention for the categories that actually apply.

Distinguish storage from access

A system can have a specified storage location while permitting remote administrative access. The business should understand who can access personal data, from where, for what task and under which controls. Whether a particular arrangement falls within an applicable legal restriction requires analysis of the relevant text and facts.

The future section 16 of the Act authorises government restrictions on transfers to notified countries or territories and preserves more protective restrictions under other Indian law. It does not create a general rule that selecting an Indian cloud region resolves every possible legal question.

The future Rule 15 separately addresses compliance with requirements specified by the Central Government concerning making personal data available to a foreign State, a person or entity under its control, or an agency of that State. That provision should not be replaced by a simplistic domestic-versus-foreign vendor label.

Examine each specialised restriction on its own terms

Rule 13(4) concerns specified personal data and associated traffic data of Significant Data Fiduciaries, where the government specifies the relevant data on the basis of the prescribed process. It is not a blanket localisation instruction for every company or every dataset.

Likewise, a business in a regulated sector may face requirements that are more specific than the general DPDP framework. Obtain the relevant current primary source and assess its scope before importing a restriction into an unrelated business.

As of the research cutoff, this article does not assert a verified universal DPDP country blacklist or a general localisation mandate. Teams should monitor official notifications and orders as the framework develops, rather than treating an absence of a named restriction in a sales presentation as permission.

Turn the map into contract questions

Ask the supplier to identify material processing locations and subprocessors, explain changes and provide relevant evidence. Determine which commitments are contractual and which are merely descriptions on a website that may change.

For the travel agency, useful questions include whether staff can prevent personal information entering support screenshots, whether support access can be limited and how the supplier communicates a new subprocessor. The most efficient control may sometimes be reducing what enters a secondary route in the first place.

Connect location review with security and retention. A clearly mapped overseas route with appropriate legal analysis and controls is a different factual arrangement from an unexplained export to a personal account. Geography alone does not describe purpose, authority or safeguards.

Maintain the map when the service changes

Assign an owner to review material supplier notices, configuration changes and new integrations. An approved region can remain unchanged while a new feature introduces a separate analytics or support path.

Keep a concise record of the data categories, destinations or access locations, purposes, relevant restrictions and evidence. Note uncertainties and who is resolving them. Do not create a visually impressive map that hides unknown routes behind a single cloud icon.

A useful cloud-region decision explains what the selected region covers and what further processing arrangements the business has assessed. That explanation is much more durable than treating a location label as a complete account of where personal data travels.