Hosting Prices, Bill Drivers and 2026 Rules
Indian cloud regions and data rules for hosting: Mumbai, Hyderabad, Delhi, CERT-In, DPDP and RBI
Indian cloud regions in 2026 (Mumbai, Hyderabad, Pune, Chennai, Delhi) and how CERT-In, DPDP s. 16, RBI and MeitY rules affect hosting.
As of October 2026, all of the large public clouds run regions in India: AWS in Mumbai and Hyderabad, Microsoft Azure in Pune, Chennai, Mumbai and Hyderabad, Google Cloud in Mumbai and Delhi, and Oracle Cloud in Mumbai and Hyderabad, according to their own region lists. Indian hosting companies operate data centres in hubs such as Mumbai and Navi Mumbai, Chennai, Delhi NCR, Hyderabad, Pune and Bengaluru. For most private businesses there is no general law requiring all data to stay in India, but the CERT-In directions of 2022 require logs to be kept within Indian jurisdiction, the DPDP Act 2023 lets the government restrict transfers to notified countries, and sector rules (for example RBI's payment data storage circular) can require local storage. This guide sets out the regions, the price and latency trade-offs and the rules, as part of the hosting pricing overview.
Public cloud regions in India (checked 28 October 2026)
| Provider | Region name (code) | City | Notes from the provider's list |
|---|---|---|---|
| AWS | Asia Pacific (Mumbai), ap-south-1 | Mumbai | 3 availability zones; enabled by default |
| AWS | Asia Pacific (Hyderabad), ap-south-2 | Hyderabad | 3 availability zones; must be enabled (opt-in) |
| Microsoft Azure | Central India | Pune | 3 availability zones |
| Microsoft Azure | South India | Chennai | No availability zones listed |
| Microsoft Azure | West India | Mumbai | No availability zones listed |
| Microsoft Azure | India South Central | Hyderabad | 3 availability zones |
| Google Cloud | asia-south1 | Mumbai | 3 zones |
| Google Cloud | asia-south2 | Delhi | 3 zones |
| Oracle Cloud | India West (Mumbai), ap-mumbai-1 | Mumbai | Listed as a commercial region |
| Oracle Cloud | India South (Hyderabad), ap-hyderabad-1 | Hyderabad | Listed as a commercial region |
Other global and Indian providers also run data centres or regions in India. Regions and the services offered in each change; always check the provider's current list and whether the service you need is available in that region.
What choosing an Indian region changes
- Latency. Users in India usually get faster responses from an Indian region than from Singapore or Europe.
- Price. Each region has its own price list. An Indian region may be cheaper or dearer than a foreign one for the same instance; compare on the price page with the region selected.
- Service availability. Newer services sometimes launch in older regions first. Check before designing around a service.
- Disaster recovery. Two Indian regions in different cities (for example Mumbai and Hyderabad) let you keep a recovery copy in India. Inter-region data transfer is charged; see egress charges.
- Data rules. Keeping data in India simplifies questions from customers, auditors and regulators.
CERT-In directions of 28 April 2022
CERT-In's directions under section 70B(6) of the IT Act (No. 20(3)/2022-CERT-In) apply widely, with specific duties for hosting businesses. In summary:
| Duty | Who | What it means for you as a buyer |
|---|---|---|
| Report specified cyber incidents within 6 hours of noticing them | Service providers, intermediaries, data centres, body corporates, government | Your contract should say how the host alerts you and helps you report |
| Keep logs of ICT systems for a rolling 180 days within Indian jurisdiction | Same | Budget for log storage in India; see backups and log storage |
| Synchronise clocks to NIC or NPL NTP servers (or traceable ones) | Same | Ask your host how servers keep time |
| Register and keep validated subscriber details for 5 years after the service ends | Data centres, VPS providers, cloud service providers, VPN providers | Expect KYC at sign-up: names, address, contact, ownership, purpose, IPs allotted |
The directions took effect 60 days after issue, around 27 June 2022; MSMEs and the subscriber-validation duty were given time until 25 September 2022. CERT-In's own site has the text and FAQs; it does not always load quickly. This is a summary, not legal advice.
DPDP Act 2023: cross-border transfers
Section 16(1) of the Digital Personal Data Protection Act, 2023 lets the Central Government, by notification, restrict the transfer of personal data by a data fiduciary to countries or territories it notifies. This is a negative-list approach: transfers are allowed unless restricted. Section 16(2) keeps any other Indian law that provides a higher degree of protection or restriction, such as a sector regulator's localisation rule.
Status in October 2026. The commencement notification G.S.R. 843(E) and the DPDP Rules, 2025 were published on 13 November 2025. The Board provisions applied at once; the consent-manager provisions apply one year later, from 13 November 2026; and sections 3 to 17 of the Act, including section 8 (processor contracts and safeguards) and section 16 (transfers outside India), come into force eighteen months after publication, that is from 13 May 2027, together with most duties in the Rules. We did not find a notified list of restricted countries. A consultation in 2026 proposed shortening the transition; check the e-Gazette and MeitY for changes.
For hosting buyers: the hosting provider is usually your data processor. Section 8 requires a data fiduciary to engage a processor only under a valid contract and to keep reasonable security safeguards. Ask for written processing terms and the region where data and backups are kept.
RBI payment data storage
RBI's circular Storage of Payment System Data (6 April 2018, RBI/2017-18/153) requires system providers (authorised payment system operators) and banks participating in payment systems to store the entire data relating to payment systems they operate only in India, with limited allowance for the foreign leg of cross-border transactions. It applies to payment entities, not to an ordinary business that accepts payments through a gateway. Regulated entities also have outsourcing directions from RBI that affect cloud contracts. If you are a payment entity, NBFC or bank, take advice on the current master directions.
MeitY empanelment for government work
For government departments and many public bodies, MeitY has run an empanelment of cloud service offerings, granted after an audit, and government buyers are generally expected to procure from empanelled offerings. The process, audit body and list change over time, so treat this as a pointer and read MeitY's current empanelment page. If you are a vendor hosting a government application, check the current empanelment list and procurement rules with MeitY and the buying department. Private businesses do not need an empanelled provider, though some use the list as one input.
Related guides
Region choice also changes which price list applies; see compute and storage pricing.
FAQ
Do I have to choose an Indian region?
Not by general law for most private businesses as of October 2026. Customer contracts, sector rules or future DPDP notifications may require it.
Is the Hyderabad AWS region available by default?
No. According to AWS's region list it is an opt-in region that you must enable for your account; Mumbai is enabled by default.
Does the CERT-In 180-day log rule apply to my company?
It applies to service providers, intermediaries, data centres, body corporates and government organisations. Most companies are body corporates, so plan for it.
Can backups be kept outside India?
Check sector rules, customer contracts and the CERT-In log location rule. Many businesses keep both primary and backup copies in Indian regions for simplicity.
Sources
- CERT-In — directions of 28 April 2022 and FAQs
- MeitY — DPDP Act 2023, DPDP Rules 2025, cloud empanelment
- e-Gazette of India — DPDP Act text and notifications
- Reserve Bank of India — Storage of Payment System Data (6 April 2018)
- AWS Regions, Azure regions, Google Cloud regions, Oracle Cloud regions — checked 28 October 2026
