"Do we have to keep our database in India?" is one of the most common questions Indian engineering teams get from customers and compliance reviewers. The short answer under the Digital Personal Data Protection Act, 2023 is: not as a general rule, but there are good reasons to anyway, and some sectors do require it. This post sets out what the Act actually says, then gives a practical checklist for running Postgres in the Mumbai region. It's an engineering guide, not legal advice. Talk to your lawyer about your own obligations.
Key facts
- The law: Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). The DPDP Rules, 2025 were notified on 13 November 2025.
- Timeline: most obligations, including notice, consent, security safeguards and breach intimation, come into force 18 months after notification, on 13 May 2027.
- Cross-border transfer (Section 16): the Act doesn't impose blanket localisation. The Central Government may restrict transfers to countries it notifies. Rule 15 adds that fiduciaries must meet any requirements the government sets by order for making data available to a foreign State or its agencies.
- Sector laws still apply: Section 16(2) keeps stricter laws in force. An example is the RBI's 2018 directive that payment system data be stored only in India.
- Hosting choice ≠ compliance: a Mumbai region is a data-location control. It doesn't make you DPDP-compliant on its own.
What the DPDP Act says about where data lives
The Act regulates Data Fiduciaries, who decide why and how personal data is processed, and the Data Processors who process data on their behalf. A typical SaaS company is the fiduciary for its users' data. Its database host acts as a processor.
On location, three provisions matter:
- Section 16(1): the Central Government may, by notification, restrict the transfer of personal data to countries or territories outside India that it notifies. This is a restriction-by-notification model, not a requirement to keep everything in India.
- Section 16(2): nothing in Section 16 overrides another Indian law that gives a higher degree of protection, or restricts transfers outside India. Sector rules, such as RBI requirements for payment data, keep applying.
- Rule 15, DPDP Rules 2025: personal data may be transferred outside India, subject to the requirements the government specifies by general or special order on making data available to a foreign State, or to entities under its control.
As of the date of this post, we haven't seen a notified list of restricted countries. Check the current position when you read this, because notifications can change it quickly.
Why teams choose an India region anyway
Even without a blanket mandate, many teams keep the primary database in India:
- Customer contracts. Enterprise, education and public-sector buyers often write "data stored in India" into agreements.
- Sector rules. Payments, and some insurance and health contexts, have their own requirements.
- Future-proofing. If a destination country is later restricted under Section 16, data already in India isn't affected.
- Latency. If your app servers and users are in India, a Mumbai database keeps queries short.
Security obligations that apply wherever the data is
Location is only one part. The Act also requires the fiduciary to:
- take reasonable security safeguards to prevent personal data breaches (Section 8(5)). The Schedule sets penalties of up to ₹250 crore for failing to do so.
- intimate the Data Protection Board and each affected Data Principal if a breach happens (Section 8(6)).
- erase personal data when the purpose is served or consent is withdrawn, unless the law requires keeping it.
In Postgres terms, that means encryption in transit, least-privilege roles, Row Level Security on user-facing tables, audit-friendly logs and a tested deletion path.
A Postgres data-residency checklist
"Our database is in Mumbai" is only true if every copy is. Walk through each item and ask your provider about the ones you can't see:
| Where personal data can end up | Question to ask |
|---|---|
| Primary database | Which region? Can it be moved later? |
| Automated backups and snapshots | Stored in the same region, or replicated elsewhere? |
| Read replicas and failover | Any replicas outside India? |
| Logs (query logs, API logs, auth logs) | Do they contain personal data? Where are they kept, and for how long? |
| File storage and CDN | Where's the origin bucket? Which edges cache files? |
| Auth service | Are user emails and phone numbers in the same region as the database? |
| Email/SMS providers | Where does your OTP or email vendor process numbers and addresses? |
| Support access | Can staff outside India access production data? |
| AI tools and MCP servers | Rows returned to an AI assistant are sent to the model provider, which is often outside India |
The last row is new, and teams often miss it. If a developer asks an assistant to "show me the last 20 signups" through an MCP server, those rows leave your database and travel to the AI provider. Use read-only, project-scoped connections against non-production data, or anonymised copies.
Running Postgres in Mumbai on WoWSQL
Here's what we can state today:
- Region choice per project: Mumbai (
ap-south-1, the default) or US East 1. A Mumbai project's Postgres database runs in India. - Standard Postgres: you can export schema and data with
pg_dumpat any time. - Access control: anon and service keys, with Row Level Security respected by the anon key.
- MCP scoping:
project_refandread_only=truelimit what an AI assistant can reach. - Indian company: WoWSQL Technologies Private Limited, Tamil Nadu, CIN U62013TN2025PTC186985.
What we don't claim here: that WoWSQL makes you DPDP-compliant, or where backups and logs are stored. Ask us at contact@wowsql.com for the data-flow details your reviewer needs, and get the answer in writing.
Related reading
- Managed PostgreSQL in India (Mumbai)
- Managed PostgreSQL hosting in Mumbai, India
- Indian Firebase alternative: Postgres vs Firestore
- How WoWSQL keeps your backend secure
- Postgres MCP server options
Frequently asked questions
Does the DPDP Act require data to be stored in India?
Not as a general rule. Section 16 lets the Central Government restrict transfers to countries it notifies, and stricter sector-specific laws continue to apply. Check for current notifications and your sector's rules.
When do DPDP obligations start?
The Rules were notified on 13 November 2025. Data Protection Board provisions applied immediately, consent-manager provisions apply after one year, and most fiduciary obligations apply after 18 months, from 13 May 2027.
Is a Mumbai database enough for DPDP compliance?
No. Location is one control. You also need lawful grounds for processing, notices, security safeguards, breach handling and erasure, plus processors you have contracts with.
What's the maximum penalty under the DPDP Act?
The Schedule allows penalties of up to ₹250 crore for failing to take reasonable security safeguards against a personal data breach. Other breaches carry different maximums.
Does WoWSQL keep backups in India?
We haven't published that detail. Ask us before you rely on it, and get the answer in your agreement.