Compliance · India
Sovereign AI for India’s data rules.
Personal data, payment data and model logs stay on infrastructure you control in India, designed for the DPDP Act, RBI localisation and SEBI’s cyber-resilience framework.
- Office
- T-Hub, Hyderabad
- DPDP core duties
- From 14 May 2027
- RBI payment data
- Stored only in India
- SEBI CSCRF
- Binding; localisation in abeyance
In short
Indian organisations using AI must prepare for the DPDP Act, whose core obligations apply from 14 May 2027, and sector rules: RBI requires payment system data to be stored only in India, and SEBI’s CSCRF binds regulated entities. Running AI on infrastructure you control in India makes these duties easier to evidence.
The rules
Rule by rule.
DPDP-ready AI before the May 2027 deadline.
The DPDP Rules phase in over 18 months. Use the time to put notice, consent, retention and breach workflows around every AI system that touches personal data.
DPDP Act →RBI data localisationAI over payment data, stored only in India.
RBI’s 2018 directive requires payment system providers to store the entire payment data in India. An AI system running in your Indian environment meets that without exceptions to manage.
RBI data localisation →SEBI CSCRFAI that meets SEBI’s cyber-resilience framework.
CSCRF controls are binding for SEBI-regulated entities. Its data-localisation control is in abeyance, not repealed, so an on-prem deployment in India keeps you ready either way.
SEBI CSCRF →Our angle
What matters in India.
- DPDP Act: notice, consent, security, retention and 72-hour breach reporting designed in.
- RBI: payment system data stored only in India; inference runs in India.
- SEBI CSCRF: controls met on infrastructure you operate; ready if data localisation is reinstated.
- IRDAI: insurers’ information and cyber-security guidelines mapped in discovery.
FAQ
Questions, answered.
Do you have a local team in India?
Yes. Our Hyderabad, T-Hub office works with clients in India.
Is self-hosting always required?
Not always. Some rules allow vetted cloud services. Self-hosting removes the hardest questions, and we tell you when it is not needed.
Related
By industry
Sector-specific rules and use cases.
Learn more →Security
How we protect your deployment.
Learn more →Access control
Who uses which agent, on what data.
Learn more →General information, not legal advice. Have your counsel confirm how each rule applies to you. Updated October 2026.
Start with two weeks of evidence, not a sales call.
A fixed-price discovery sprint, credited against whatever comes next. Or write to sales@deepvox.ai.