Bill Shocks, Migration, Exit and Official Sources
Official sources for cloud and hosting buyers in India: GST, income tax, CERT-In, DPDP, RBI and MeitY
Where to check rules for hosting and cloud buyers in India: CBIC GST, Income Tax, CERT-In, MeitY and e-Gazette, RBI, MCA and provider pages.
The rules that affect a hosting or cloud purchase in India sit with a handful of official bodies: CBIC and the GST portal for GST and reverse charge, the Income Tax Department for TDS under the Income-tax Act, 2025, CERT-In for cyber security directions on logs and incident reporting, MeitY and the e-Gazette for the DPDP Act and Rules, RBI for payment data and regulated entities, and MCA for company records. Prices and regions come from each provider's own pages, on the date you check. This guide lists what to check where, and how to read it. It belongs to the bill shock patterns overview.
Tax
| Source | What to check | Used in |
|---|---|---|
| CBIC GST | GST rates on services, reverse charge notifications, OIDAR provisions, circulars | GST guide |
| GST portal | Filing GSTR-3B, reverse charge reporting, GSTR-2B for credit | Monthly returns |
| GST Council | Meeting recommendations before they are notified | Upcoming changes |
| Income Tax Department | Income-tax Act 2025, TDS under section 393, forms for foreign remittances | TDS on hosting payments |
How to read them. A GST Council recommendation is not law until notified. Check the date and effective date of each notification, and whether a later one amends it. The portals sometimes load slowly; try again rather than relying on unofficial copies for exact wording.
Cyber security and data protection
| Source | What to check | Used in |
|---|---|---|
| CERT-In | Directions No. 20(3)/2022 of 28 April 2022, FAQs, incident reporting | Regions and data rules |
| MeitY | DPDP Act 2023, DPDP Rules 2025, cloud empanelment for government | DPDP and empanelment |
| e-Gazette of India | Official text of Acts, Rules and notifications, including any notified transfer restrictions under DPDP s. 16 | Verification |
| India Code | Consolidated text of the IT Act and other Acts | Background |
Key dates to note (as of 28 October 2026):
- CERT-In directions took effect around 27 June 2022; extended deadline for MSMEs and subscriber validation by cloud, VPS, data-centre and VPN providers: 25 September 2022.
- DPDP Rules notified 13 November 2025; consent-manager rule from 13 November 2026; most duties, and sections 3–17 of the Act, from 13 May 2027 (G.S.R. 843(E)). Check for any later amendment to the timeline.
Financial sector
| Source | What to check |
|---|---|
| Reserve Bank of India | Storage of Payment System Data (6 April 2018); master directions on outsourcing and IT for regulated entities; card and e-mandate rules |
| SEBI | Cyber security framework for market intermediaries |
| IRDAI | Information and cyber security guidelines for insurers |
These apply to regulated entities. An ordinary business accepting payments through a gateway is not a payment system operator, but its gateway and bank are.
Company and consumer
| Source | What to check |
|---|---|
| Ministry of Corporate Affairs | Rules on books of account kept electronically and back-ups |
| National Consumer Helpline | Complaints by consumers (individuals buying for personal use) |
| Udyam Registration | MSME registration, relevant to some schemes and payment terms |
Provider pages: prices and regions
Provider pages are not official in the legal sense, but they are the only reliable source for current prices. When you rely on one:
- Select the exact region (for example Mumbai or Hyderabad).
- Note the date you checked and save a copy or screenshot.
- Check the currency and whether prices exclude GST.
- Look for the renewal or after-offer price and data transfer section.
Pages used on this site (checked 28 October 2026):
- AWS Regions — Mumbai (ap-south-1) and Hyderabad (ap-south-2, opt-in)
- Azure regions list — Central India (Pune), South India (Chennai), West India (Mumbai), India South Central (Hyderabad)
- Google Cloud regions — asia-south1 (Mumbai), asia-south2 (Delhi)
- AWS EC2 on-demand pricing — 100 GB of free data transfer out each month (checked 28 October 2026)
- AWS VPC pricing — public IPv4 at $0.005 per hour (checked 28 October 2026)
How to verify a claim you read online
- Find the original notification or circular, not a summary.
- Check the effective date and any later amendment.
- Check whether it applies to your type of entity.
- For tax, confirm with your chartered accountant; for contracts and data protection, with a lawyer.
Before you finalise a hosting purchase
Use the other guides in this section as a final check: cost control routine, renewal price jumps, migration cost and payback and exit costs and lock-in.
FAQ
Is MeitY empanelment needed for a private business?
No. It is for government procurement. A private business can choose any provider that fits.
Where do I find whether DPDP transfer restrictions have been notified?
Notifications are published in the e-Gazette and usually announced by MeitY. As of October 2026 we found none restricting specific countries.
Are provider blogs reliable for prices?
Use the provider's price page or a written quote. Blogs and announcements can be outdated.
Why do some official sites not load?
Some government sites are slow or block automated requests. Try again later or from another network; do not rely on copies for exact wording.
