Data localisation laws do not ask whether a transfer is safe; they require certain data to be stored or processed inside the country, and a contract clause or encryption key cannot satisfy them. That makes them different in kind from transfer rules such as GDPR Chapter V, and harder to engineer around. This map sets out the main localisation mandates in force in major economies: what data they cover, who they bind, whether a copy may also exist abroad, what triggers them and their status. It then shows how to turn them into architecture decisions, including the identity data (directories, sign-in logs, keys) that teams often forget is personal data too. It is for cloud architects, privacy and GRC teams and identity owners running multi-country estates. For transfer mechanisms see the International Data Transfers Map; for sovereign cloud models see the Data Sovereignty and Residency Guide. Status as of 11 November 2026.
Sources: rows are based on the official texts we could read (RBI circular, EUR-Lex, MeitY, US Department of Justice) and, where the official text was not reachable, on named translations and law firm analyses: DigiChina for China, SCC Online for India's DPDP Rules, B1 for Russia, Allen and Gledhill for Vietnam and AHP for Indonesia. Confirm against the official text before relying on it.
Key takeaways
- Localisation comes in four strengths. Strict (store and process only in-country, as with Indian payment data), primary-copy (the first database must be in-country, as in Russia), conditional or triggered (in-country unless an assessment or approval allows export, as in China, or only after a regulator's order, as for foreign firms in Vietnam) and public-sector only (Indonesia).
- Russia tightened its rule in 2025. From 1 July 2025 the use of databases outside Russia for recording, systematising, storing, updating and retrieving Russian citizens' personal data "shall not be permitted", replacing the earlier positive obligation.
- India is moving from sector rules to a general power. Payment data has been localised since 2018; the DPDP Act lets the government restrict transfers by notification, and the DPDP Rules 2025 add a localisation duty for data specified for significant data fiduciaries, with most rules applying 18 months after 14 November 2025.
- The EU prohibits localisation for non-personal data. Regulation (EU) 2018/1807 bans member state localisation requirements except on public security grounds, so in-EU residency choices are usually contractual or sovereignty-driven, not statutory.
- Identity systems are in scope. A directory, sign-in log or help desk record of an in-scope citizen is personal data, so a global identity provider can breach a localisation rule even when the business application is local.
Regulations and frameworks at a glance
| Jurisdiction and law | Data covered | Who it binds | Strength and export route | Status (11 November 2026) |
|---|---|---|---|---|
| China Cybersecurity Law, Article 37 | Personal information and important data collected or generated in mainland China | Critical information infrastructure (CII) operators | Store in mainland China; export only if truly necessary and after a security assessment | In force since 1 June 2017 |
| China PIPL, Articles 38, 40 and 41 | Personal information collected or generated in China | CII operators and handlers above CAC volume thresholds (Article 40); all handlers for transfer conditions (Article 38) | Article 40 entities store domestically and pass a CAC security assessment to export; others use assessment, certification or the CAC standard contract; no provision to foreign courts or police without approval | In force since 1 November 2021; CAC thresholds revised by later provisions |
| Russia Federal Law 152-FZ, Article 18(5) (as amended) | Personal data of Russian citizens | Operators (and, following the 2025 wording, arguably processors acting for them) | Recording, systematisation, storage, updating and retrieval using foreign databases not permitted; narrow exceptions | Prohibition wording applies from 1 July 2025; official interpretation awaited |
| India RBI circular of 6 April 2018 (RBI/2017-18/153) | Payment system data | All payment system providers | Strict: stored in a system only in India; foreign leg data may be stored abroad | In force; compliance was due by 15 October 2018 |
| India DPDP Act 2023, s. 16, and DPDP Rules 2025, Rules 13(4) and 15 | Personal data generally; specified personal data and related logs of significant data fiduciaries | Data fiduciaries; significant data fiduciaries for Rule 13(4) | Transfer allowed unless restricted by notification (negative list); stricter sector laws prevail (s. 16(2)); significant data fiduciaries must not transfer specified data outside India | Rules notified 14 November 2025; Rules 13 and 15 apply 18 months after publication |
| Vietnam Cybersecurity Law 2018 and Decree 53/2022/ND-CP | Users' personal data, data users generate (account names, usage times, card details, emails, last login IP, phone numbers) and relationship data | Domestic enterprises providing telecoms, internet and value-added services; foreign providers of listed services only after a Ministry of Public Security request | Domestic: store in Vietnam. Foreign: store locally for at least 24 months and set up a branch or representative office within 12 months of a request | In force since 1 October 2022 |
| Indonesia Government Regulation 71/2019 | Electronic systems and data | Public scope electronic system operators | In-country unless the storage technology is unavailable; private scope operators may host abroad if authorities retain access; financial sector regulators set their own rules | In force since October 2019 |
| EU Free Flow of Non-Personal Data Regulation (EU) 2018/1807, Article 4 | Non-personal data | EU member states | Anti-localisation: member state localisation requirements prohibited unless justified on public security grounds; existing ones to be repealed or notified by 30 May 2021 | In force |
| US Data Security Program, 28 CFR part 202 | Bulk sensitive personal data and US government-related data | US persons transacting with countries of concern and covered persons | Not localisation: prohibits or restricts access by countries of concern; restricted transactions must meet CISA security requirements | Effective 8 April 2025; due diligence, audit and reporting duties from 5 October 2025 |
Many other countries apply sector rules (health records, government data, telecoms subscriber data, financial records) that are not listed here. Sector rules often matter more than the general data protection law: check your sector supervisor before you check the privacy statute.
Scope: who and what is covered
Four variables decide what a localisation rule means for your systems.
| Variable | Strict reading | Permissive reading | Example |
|---|---|---|---|
| Operation covered | Storage and every processing step in-country | Primary storage in-country, mirror copies or processing abroad permitted | RBI says "stored in a system only in India"; Russia lists specific operations |
| Data covered | All personal data of residents or citizens | A defined category (payment data, important data, specified data) | Russia (citizens) versus RBI (payment system data) |
| Entity covered | Every organisation processing the data | Designated entities only (CII, significant data fiduciaries, public scope operators) | China Article 40, India Rule 13(4), Indonesia |
| Trigger | Applies by default | Applies after a regulator's order | Vietnam foreign enterprises after a Ministry of Public Security request |
Remote access counts. "Stored in" is not "processed in", and neither wording settles whether staff abroad may view the data. Where the rule restricts retrieval or processing, a support engineer abroad querying the local database may itself be the prohibited operation. Read the operative verbs and get local advice.
Key obligations
- In-country primary storage: Russia and the Article 40 China entities need the system of record inside the country. Replicas abroad are at best uncertain in Russia after 2025 and need a passed assessment in China.
- Export gates: China requires a CAC security assessment for Article 40 entities and one of assessment, certification or standard contract for others; India's Rule 15 allows transfer subject to conditions the government may set by country or recipient.
- Foreign authority requests: PIPL Article 41 bars handlers from giving personal information stored in China to foreign judicial or law enforcement bodies without Chinese approval. A global eDiscovery or law enforcement response process must route around this.
- Retention under a localisation order: Vietnam requires at least 24 months of local storage once ordered, and system logs on investigations and violations for at least 12 months.
- Local presence: Vietnam can require a branch or representative office within 12 months of a request.
- Return of foreign-processed data: payment data processed abroad must come back to India; the RBI permits the foreign leg of a cross-border transaction to be stored abroad.
Timeline and current status
- 1 June 2017: China Cybersecurity Law, Article 37 CII localisation.
- 6 April 2018: RBI payment data storage circular; compliance reported by 15 October 2018.
- October 2019: Indonesia GR 71/2019 narrows localisation to public scope operators.
- 1 November 2021: China PIPL in force.
- 1 October 2022: Vietnam Decree 53/2022 in force.
- 8 April 2025: US Data Security Program effective.
- 1 July 2025: Russia's prohibition wording for foreign databases applies.
- 14 November 2025: India's DPDP Rules notified; Rules 13 and 15 apply 18 months later (May 2027 on that count). Watch for the government's specification of data for significant data fiduciaries.
Localisation rules change through implementing decrees and regulator guidance rather than headline statutes. Re-check status at least twice a year and after any regulator announcement.
Enforcement and penalties
- China: PIPL Article 66 allows fines up to CNY 50 million or 5% of prior-year revenue for serious violations, suspension of business and fines on responsible managers.
- Russia: fines under the Code of Administrative Offences, with higher amounts for repeat violations, and blocking of services by the regulator, Roskomnadzor. Check current amounts with local counsel.
- India: RBI can act against payment system providers under its supervisory powers; DPDP Act penalties are set by the Act's schedule once the relevant rules apply.
- Vietnam: the practical sanction is the Ministry of Public Security's request and the obligations it triggers.
- US: Data Security Program violations carry IEEPA civil and criminal penalties.
Market exit is the most common real consequence: blocking, licence conditions or loss of a contract can follow before any fine.
What it means for AI agents and non-human identities
- Identity data is personal data: user directories, MFA registrations, sign-in and audit logs and help desk tickets about a Russian citizen or Chinese CII user are in scope. A global SaaS identity provider with logs in another region is a localisation decision. Plan a separate tenant or in-country identity stack where the rule requires it.
- Machine credentials cross borders: service accounts, API keys and replication jobs in another region that can read the local data store are a transfer path. Inventory them, restrict their network location and log every read. See the Data Sovereignty and Residency Guide on key custody.
- AI agents and model calls: an agent that sends in-scope records to a model endpoint in another country is processing abroad. Pin model endpoints by region, block cross-region inference for in-scope data and record the endpoint in the processing inventory. See the Sovereign AI Guide.
- Telemetry and backups: security tooling, EDR telemetry and backup copies replicate data quietly. Check where your SIEM and backup vault store in-scope logs.
Compliance steps
Choosing the design pattern
| Pattern | When to use | Trade-off |
|---|---|---|
| Separate in-country stack (application, identity, logs, keys) | Strict or primary-copy rules with uncertain replica status (Russia, China Article 40 entities) | Highest cost; separate operations and access paths |
| In-country region of a global platform with region pinning | Sector rules that cover storage only (payment data), or where export gates are met | Depends on the platform's control of support access and telemetry |
| Global platform with export mechanism | Transfer rules without localisation (most jurisdictions, EU) | Needs transfer assessments, not localisation |
| Exit or partner model | Triggered rules with heavy local presence demands, or where risk outweighs revenue | Commercial cost; partner becomes the controller or processor |
Small organisations: a regional deployment of a SaaS tool and a written analysis is usually enough unless you process payment data in India or citizens' data in Russia. Large organisations: need a data map by citizenship or residence, CII and significant data fiduciary status, and a register of every cross-border access path.
- Map obligations: for each country of operation, list the localisation and sector rules, the data they cover and their trigger.
- Map data and identities: tag in-scope datasets, including identity data and logs, and list every human and machine identity that can read them, with its location.
- Choose the pattern: one of the four above per country and dataset; record the reasoning.
- Enforce location: use region restriction policies, resource location constraints and network controls on replication and support access; pin AI endpoints.
- Test before cut-over: run a dry run that lists every replica, backup, log sink and support path; confirm none leaves the country; keep the old path available until the new stack passes.
- Roll back: keep migration reversible until the in-country stack has run a full backup and restore cycle locally.
- Prepare for orders: document how you would respond to a Vietnam storage request or a foreign authority request for China-stored data.
Detection and measurement
- Location drift: in-scope resources created outside the permitted region, from cloud policy and inventory alerts (target zero).
- Cross-border reads: reads of in-scope stores from identities or IP ranges outside the country, per week.
- Replica inventory: share of in-scope datasets with every copy (backups, logs, analytics) located and recorded.
- AI endpoint compliance: share of model calls with in-scope data routed to in-country endpoints.
- Status freshness: days since each country's rules were last reviewed.
Framework mapping
| Framework | Reference | How it relates |
|---|---|---|
| NIST SP 800-53 Rev 5 | SA-9(5), CM-8, AC-20 | Processing, storage and service location; component inventory; use of external systems |
| NIST CSF 2.0 | GV.OC-03, PR.DS-01, PR.DS-02 | Legal requirements understood and managed; data at rest and in transit protected |
| ISO/IEC 27001:2022 | Annex A 5.31, 5.34 | Legal, statutory, regulatory and contractual requirements; privacy and protection of PII |
Common failure patterns
- Application local, identity global: the business database is in-country but the directory and sign-in logs sit in another region.
- Backups and logs forgotten: disaster recovery copies and SIEM ingestion replicate in-scope data abroad.
- Support access unmanaged: follow-the-sun support staff query the local store from abroad without analysis.
- Old analysis after a change of wording: Russia's 2025 amendment changed what replicas may be lawful; analyses from 2015 to 2024 need review.
- Treating residency marketing as compliance: a provider's regional commitment covers its scope, not your telemetry, AI calls or support processes.
Practitioner checklist
- Keep a per-country register of localisation and sector rules with trigger, data and status date.
- Tag in-scope datasets, including identity data, logs and backups.
- List every human and machine identity that can read in-scope data, with location.
- Choose and document a design pattern per country and dataset.
- Enforce region restrictions and alert on drift.
- Pin AI model endpoints by region for in-scope data.
- Route foreign authority requests for China-stored data through an approval process.
- Review Russia and India positions as official interpretations and rules commence.
Standards and references
- DigiChina, Stanford: Translation of the Personal Information Protection Law of the PRC
- DigiChina, Stanford: Translation of the Cybersecurity Law of the PRC
- Reserve Bank of India: Storage of Payment System Data (RBI/2017-18/153)
- MeitY: Digital Personal Data Protection Act, 2023
- EUR-Lex: Regulation (EU) 2018/1807 on the free flow of non-personal data
- US Department of Justice National Security Division: Data Security Program
- SCC Online: Digital Personal Data Protection Rules 2025, key highlights
- Allen and Gledhill: Data localisation requirement in Vietnam effective 1 October 2022
Related NHI Mgmt Group resources: Data Sovereignty and Residency Guide · International Data Transfers Map · Global Privacy Regulatory Map · EU Sovereign Cloud Options Compared Guide · Sovereign AI Guide. This guide summarises data localisation requirements in selected jurisdictions and is not legal advice.