Where is your AI processed? Data residency in India

The short answer: where your documents are stored and where an AI reads them are two different questions, and in 2026 most vendors can answer only the first one with "India". The law does not ban sending personal data abroad for processing, but the DPDP Rules notified in November 2025 make you answerable for it, the main obligations arrive around May 2027, and the government can restrict transfers. Microsoft has said in-country AI processing for Microsoft 365 Copilot in India is expected by the end of 2026. Google lists an India location for Gemini Enterprise, with conditions. So ask every AI vendor one precise question: when my employee presses Enter, in which country is the prompt processed?

Why is "where is it processed" a separate question?

For years, data residency meant storage: your mailboxes and files sit in a data centre in Mumbai or Pune. Vendors learned to promise that.

AI adds a second journey. When someone asks an assistant to summarise a contract, the contract's text is sent to wherever the model runs. That may be a different building, a different country, and a different company from the one storing the file. Storage in India does not, by itself, tell you anything about that step.

Microsoft's own documentation shows the distinction. Its page on data, privacy and security for Microsoft Copilot says: "Customers outside the EU may have their queries processed in the US, EU, or other regions." The same page explains that calls to the model "are routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods".

That is an honest statement, and it is the default. Anything better has to be specifically offered and specifically switched on.

What do the DPDP Rules say about sending data abroad?

The Government of India notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025, according to the Press Information Bureau's backgrounder of 17 November 2025. They put the DPDP Act, 2023 into operation, with compliance phased in over eighteen months. Law firms that have analysed the rules put the main obligations for businesses in the final phase, around mid-May 2027. We have seen the notification date given as both 13 and 14 November in different sources, so we say "mid-May" and suggest you confirm the exact date with your adviser.

Three points matter for AI.

Transfers abroad are generally allowed, but can be restricted. The law firm AZB & Partners summarises the position as: personal data may be transferred outside India except to countries the Government restricts. We did not find any notification naming restricted countries.

Larger organisations can be told to keep some data in India. The PIB backgrounder says Significant Data Fiduciaries "must follow government directions on restricted categories of data, including local storage where needed".

You remain responsible. If an AI vendor processes your customers' or employees' personal data, you are the one who must protect it and, after a breach, "inform all affected individuals without delay". The backgrounder gives the highest penalty as up to ₹250 crore, for failing to maintain reasonable security safeguards.

So the rules do not say "AI must run in India". They say you must know where personal data goes, be able to justify it, and be ready for the government to narrow the options. Our DPDP Act data location checklist turns that into questions.

Are there sectors where data must stay in India?

Yes. The clearest is payments. The Reserve Bank of India's FAQ on storage of payment system data says: "The entire payment data shall be stored in systems located only in India, except in cases clarified herein." Where processing happens abroad, the data must be deleted there and brought back to India within one business day or 24 hours of payment processing, whichever is earlier. That FAQ dates from June 2019 and rests on a circular of 6 April 2018; we did not check for later changes.

If you are in banking, insurance, securities or health, your regulator's rules come first. Ask your compliance team before you ask a vendor.

What do the big vendors offer in India today?

Here is what we could verify from the vendors' own pages on the day of writing.

Two lessons follow. Timelines slip, so a promise in a blog post is not a term in your contract. And in-country processing, where it exists, is often an option you must request and configure, with a narrower choice of models.

What should you ask an AI vendor?

• In which country is a prompt processed, not only stored?
• Is that a contractual commitment or a default that can change under load?
• Does it apply to every model and feature we will use, or only some?
• Do we have to request it, and does it cost more?
• Which other companies (sub-processors) handle our prompts?
• Are prompts and outputs kept, for how long, and are they used to train models?
• If the answer changes, how will we be told?

Write the answers down with the date. For how Indian regulators are approaching AI more widely, see AI rules in India in 2026.

Is there a way to avoid the question altogether?

Yes: run the AI where the data already is.

If the model runs on the employee's own computer, or on a server in your own office, the prompt never leaves your premises, so there is nothing to locate. This is what "on-device" or "local" AI means, and it is why interest in it has grown alongside the residency debate. The trade-off is model size: a model that fits on a laptop is smaller than the largest cloud models. We compare the two fairly in on-device AI vs cloud AI, and explain the wider idea in sovereign AI and private AI.

This is the approach we took in DNX OS. Nova, its assistant, runs on the PC's own processor, and each AI service is sandboxed with no network access. The system's privacy page states it in one line.

The limits, stated plainly: DNX OS is in beta from December 2026 and launches in January 2027. Its on-device models are small. Larger models hosted on GPUs in India are on our roadmap for 2027, not available now. If you would like to test the on-device route on your own work, apply for the beta.

What is still uncertain?

• The exact DPDP commencement dates, as noted above.
• Which countries, if any, will be restricted for transfers, and which data Significant Data Fiduciaries must keep in India.
• Whether Microsoft's India processing is live. The last statement we found is the April 2026 note.

Sources

All sources were opened on 12 November 2026.

• Press Information Bureau, DPDP Rules, 2025 Notified (backgrounder), 17 November 2025.
• AZB & Partners, India's Digital Personal Data Protection framework comes into effect, 19 November 2025: phases and cross-border transfers. A law firm's summary.
• Microsoft Learn, Data, Privacy, and Security for Microsoft Copilot, updated 4 November 2026.
• Microsoft 365 Blog, in-country data processing for Microsoft 365 Copilot, 4 November 2025, editor's note 3 April 2026.
• Google Cloud, Gemini Enterprise locations.
• Reserve Bank of India, FAQ: Storage of Payment System Data, 26 June 2019.