If you're choosing between an India-based GPU cloud region and a provider whose infrastructure sits abroad, the short answer is: the Digital Personal Data Protection Act, 2023 does not require you to keep GPU compute physically inside India, and as of September 2026 no country has been notified as restricted under its cross-border transfer clause. Region choice is a real risk-and-documentation question, but it is not the blanket legal requirement many buyers assume it is.
What DPDP Section 16 actually says
Section 16(1) of the DPDP Act takes a negative-list approach to cross-border transfer: personal data can be transferred to any country or territory outside India unless the Central Government specifically notifies that country as restricted. This is the opposite structure from GDPR-style adequacy lists, which allow transfer only to approved destinations. Under DPDP, the default is permission; restriction is the exception, and it has to be named explicitly.
As of this writing, no country has been notified under Section 16. Rule 15 of the DPDP Rules, 2025 also does not prescribe Standard Contractual Clauses, binding corporate rules, or a mandatory adequacy assessment as a precondition for transfer. None of that is speculative — it is the current, checkable state of a provision that has not yet needed to be tested.
The provision isn't fully in force yet either
Section 16 and Rule 15 sit inside the DPDP Act's phased commencement schedule. Substantive provisions, including the cross-border transfer clause, are set to come into force within an 18-month window from notification, which points to mid-2027. Buyers evaluating a GPU cloud region today are making a decision ahead of the rule that would most directly govern it — which is a reason to build in flexibility, not a reason to skip the question.
Where region actually matters right now
Even with Section 16 dormant, where compute physically sits still has practical weight for three reasons that have nothing to do with a restricted-country list:
- Breach notification and jurisdiction. If a security incident touches personal data, DPDP's breach-notification obligations run on the Data Fiduciary — whoever determines how the data is processed — regardless of where the servers are. But which jurisdiction's investigators, subpoenas, or disclosure law apply to that infrastructure changes with region, and that's a contract-and-subprocessor question, not a DPDP one.
- Sector-specific localization rules that sit outside DPDP. RBI's data localization requirements for payment system data, and similar sectoral rules for some categories of financial and telecom data, apply independently of the DPDP Act. If your workload touches that kind of data, the relevant restriction may already exist — just not from the law most people are checking.
- Significant Data Fiduciary status. Entities the government designates as Significant Data Fiduciaries face heavier obligations (data protection officer, independent audits, algorithmic impact assessment) — but this status turns on the volume and sensitivity of data processed, not on which region a GPU provider's data center sits in.
What region choice does not change
It's worth separating this from an adjacent question buyers often fold in by mistake: GST treatment. Whether a provider issues a valid Indian GST invoice depends on whether the entity is India-registered under the CGST Act, not on which physical region hosts the GPU. A foreign-incorporated provider can operate an India-based data center and still bill without a domestic GSTIN, triggering Reverse Charge Mechanism on your side; an India-incorporated provider can serve workloads from a region outside India and still invoice normally as a domestic supplier. Region and invoicing entity are two different facts about a provider — check both, but don't assume one tells you the other.
A neutral checklist before picking a region
Before treating "India region" as a compliance requirement rather than one input among several, it's worth confirming directly with any provider: which specific data center location(s) host the compute and any backups; whether any subprocessor outside that region touches logs, telemetry, or model artifacts; what jurisdiction governs the data-processing agreement; and separately, whether the entity billing you is India-registered for GST purposes. None of these four questions has the same answer across the providers this site tracks — see the provider comparison and individual provider pages for what each one currently discloses.
This is a general compliance framework based on the DPDP Act, 2023 and the DPDP Rules, 2025 as notified through September 2026, not legal advice for a specific transfer or sector. Cross-border transfer provisions under Section 16 are not yet in force, and the rules governing their eventual operation may change before commencement. Confirm current data center locations and invoicing status directly with any provider via the compare tool before making a decision that depends on either.