RBI rules on where banks, NBFCs and payment firms keep data and run software

Payment data must be stored in India

• RBI circular RBI/2017-18/153 of 6 April 2018 requires every payment system provider to store the entire data of the payment systems it operates only in India [1].
• That covers end-to-end transaction details and information carried or processed in the payment message; data on the foreign leg of a transaction may be stored abroad if required [1].
• If a payment is processed abroad, the data must be deleted there and brought back to India within one business day or 24 hours of processing, whichever is earlier [2].
• The directions apply to all banks operating in India [2].

Outsourcing and cloud: the 2025 directions

On 28 November 2025 RBI issued entity-wise Managing Risks in Outsourcing Directions, 2025, which replace earlier outsourcing instructions, including the 2023 IT outsourcing Master Direction for NBFCs [3]. Existing IT outsourcing agreements of commercial banks must comply at renewal or by 10 April 2026, whichever is earlier [4].

• IT outsourcing agreements must provide for storage of data only in India, as applicable under existing regulations [4].
• RBI must have the right to inspect the service provider and its subcontractors and to access the bank's infrastructure and data held by the provider [4].
• Encryption keys and Hardware Security Modules for cloud workloads must remain under the bank's control [4].
• A cyber incident at a service provider must be reported to RBI within six hours of the provider detecting it [4].
• For offshore outsourcing, the bank and RBI must be able to audit the foreign provider, and records must stay available even if the provider is liquidated [4].

The phrase 'as applicable under existing regulations' points back to rules such as the 2018 payment data circular; the outsourcing directions do not by themselves localise all bank data.

IT governance and resilience

• The Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, effective 1 April 2024) applies to commercial banks, larger NBFCs, credit information companies and all-India financial institutions [5].
• It requires a Board-level IT Strategy Committee, DR drills for critical systems at least every six months with well separated DC and DR sites, vulnerability assessment every six months and penetration testing every twelve months for critical systems [5].
• Non-bank payment operators must report unusual incidents to RBI within 6 hours, keep audit logs for at least five years and keep the DR site in a different seismic zone (2024 cyber resilience directions) [6].

CERT-In applies on top

• Cyber incidents of the specified types must be reported to CERT-In within 6 hours of noticing them [7].
• Logs of all ICT systems must be kept securely for a rolling 180 days within Indian jurisdiction and produced on request; CERT-In's FAQs say they may be stored abroad if the entity can produce them in reasonable time [7][8].
• System clocks must be synchronised with NIC or NPL time servers, or servers traceable to them [7].

Where your software runs matters

Every SaaS tool a regulated entity uses is outsourcing that needs the right contract terms, audit rights, key control and a six-hour incident path. Software that runs on your own infrastructure removes the provider from the data path: the data, keys and logs stay with you.

Own360 deploys on-premise, in your private cloud or air-gapped, and your data never transits Own360 servers. OwnCentral keeps an immutable audit log, OwnComply maps one control to multiple frameworks with continuous evidence collection, and OwnITSM covers incident, problem and change management with a CMDB.

Questions buyers ask

Does RBI require banks to store data in India?

Payment system data must be stored only in India under the 2018 circular, and the 2025 outsourcing directions require IT outsourcing contracts to provide for storage in India where existing rules apply [1][4].

Can banks use cloud services under RBI rules?

Yes, under the outsourcing directions: with data stored in India where required, RBI's right to inspect the provider, encryption keys under the bank's control and six-hour incident reporting [4].

How fast must a bank report a cyber incident?

An incident at a service provider must reach RBI within six hours of the provider detecting it, and specified incidents go to CERT-In within six hours of being noticed [4][7].

Read next

• The DPDP Act and data localisation
• Own360 vs ServiceNow
• Security at Own360