Data residency and the DPDP Act: what Indian buyers should ask

If you are buying or selling SaaS in India, data residency has moved from a procurement footnote to a question with regulatory weight behind it. This is a practical guide, not legal advice — and you should take actual legal advice before making commitments in a contract.

Why it has changed

Two things happened at once. India put a comprehensive data protection framework in place, and Indian enterprises started asking about it seriously in procurement rather than treating it as a tick-box.

The effect on a SaaS purchase is that questions which used to be answered with "we use AWS" now require a more specific answer: which region, which sub-processors, what happens on deletion, and who you would notify if something went wrong.

Seven questions worth asking

Where is the data stored, specifically? Not the cloud provider — the region. "AWS" is not an answer. "AWS Mumbai, ap-south-1" is.

Where is it processed? Storage and processing can differ. A vendor storing in India and sending data to a US endpoint for analytics or AI inference has a cross-border transfer whether or not they describe it as one.

Who are the sub-processors? Every SaaS vendor uses others — email delivery, error monitoring, analytics, payment processing, AI inference. Each is a place your data goes. Ask for the list. A vendor who cannot produce one has not thought about this.

What happens to backups? Backups frequently live in a different region from the primary database, and this is frequently overlooked in the answer to question one.

What is the deletion behaviour? When you leave, or when your own customer exercises a deletion right, what actually happens and how long does it take, including backups.

What are the breach notification terms? Timeframe, method and to whom. This should be in the contract, not in an assurance.

Can you get your data out? Export format, completeness, and whether it costs anything. The best time to test this is before signing.

The AI wrinkle

This is the one most buyers currently miss.

If a product has AI features, customer data is being sent to a model provider for inference. That provider is a sub-processor, may be in a different jurisdiction, and may have its own retention behaviour.

A vendor who has thought about this will be able to tell you which provider, in which region, and whether you can choose. A vendor who has not will look surprised by the question.

This is one of the reasons PlaNath supports multiple AI providers including custom endpoints — so the organisation using it can make its own decision about where inference happens, rather than inheriting one.

Where PlaNath stands

PlaNath is India-first by design rather than by adaptation: pricing in INR, billing through Razorpay including RBI e-mandate handling, and deployment planned in AWS Mumbai (ap-south-1). Tenant isolation is enforced in PostgreSQL with row-level security.

Two honest notes. The AWS deployment is in progress rather than complete, and a third-party penetration test of the deployed environment is on the pre-launch checklist. When PlaNath asks buyers to hold vendors to specific answers, it expects the same standard applied to itself.

For founders selling into India

The seven questions above are also your preparation list. Answering them precisely is a competitive advantage against larger vendors whose answer is a generic trust page — and being unable to answer them is increasingly where deals stall in security review, long after everyone liked the product.