RBI payment data localisation and AI: what can and can't leave India

The rule in one paragraph

RBI's April 2018 directive requires payment system providers to ensure that the entire data relating to the payment systems they operate is stored in a system only in India. Data may be processed abroad, but it must be brought back to India within 24 hours, and the copy abroad deleted.

Where AI touches payment data

AI systems create new copies of data in places teams don't always think about:

• Indexes and embeddings built from transaction records, statements or disputes.
• Model inputs and outputs when a question about a payment is sent to a model.
• Logs of conversations, voice transcripts and automation steps.
• Fine-tuning sets built from historical cases.

Each of these is payment data if it contains payment details, so each needs to live in India.

Why cloud AI makes this hard

A hosted AI service may process prompts in another country, keep logs there, or use sub-processors you don't control. Even with a contract, you have to evidence where every copy went. With an AI system running inside your Indian environment, there is nothing to evidence beyond your own infrastructure.

A practical architecture

1. Keep connectors, index and logs in your Indian data centre or private cloud.
2. Run inference on models hosted in the same environment.
3. Use the model gateway to block hosted models for any agent that touches payment data.
4. Keep the audit trail with the system, available to your auditors.

Is all banking data covered?

The 2018 directive targets payment system data. RBI's own FAQ allows banks to keep other banking data abroad where previously permitted, except for domestic payment transactions. Other RBI rules, the DPDP Act and your outsourcing policies still apply, so we map them per data type in discovery.

See also our RBI compliance page.