India's technology ecosystem: DPDP, data, sovereign tech

The short answer: an Indian company choosing technology in 2026 works inside four facts. The DPDP Act makes you answerable for personal data wherever it is stored, with the main duties arriving around the middle of 2027. The law does not, in general, force data to stay in India, so keeping it here is a choice, and often a sensible one. There is no single AI Act, but several binding rules already touch a business that uses AI. And "sovereign" or "Made in India" on a brochure means nothing until a vendor answers precise questions about where data is stored, where it is processed and who can change the terms.

This page explains each of the four and then lists every article we have written on them. It is practical guidance, not legal advice; take the decisions to your lawyer or company secretary.

What does the DPDP Act ask of a business?

The Digital Personal Data Protection Act was passed in August 2023. The Rules that put it into operation were notified on 14 November 2025, with an eighteen-month period for phased compliance, so the main obligations arrive around May 2027. Confirm the dates that apply to you with your adviser.

In the Act's words your company is a Data Fiduciary: it decides why and how personal data is used. In working terms it must be able to do five things:

• Tell people what it collects and why, and get their agreement.
• Keep the data secure.
• Report a breach to the Board and to the affected people.
• Answer requests to see, correct or erase data.
• Delete data when the purpose is over.

The penalties are ceilings, not standard fines, but they explain the attention: up to ₹250 crore for failing to maintain reasonable security safeguards. Every one of the five duties turns into the same first job. You cannot secure, report on or delete a copy you do not know exists, so start with a map of where personal data lives.

Does data have to stay in India?

For most companies, no. The Act does not ban storing or processing personal data abroad. It gives the Central Government the power to restrict transfers to particular countries, and larger organisations classed as Significant Data Fiduciaries may be directed to keep certain data locally. Some regulated sectors have their own storage rules; if you are in one, your regulator's circulars come first.

So data residency is usually a decision, not a mandate. The reasons to choose India are practical:

• One legal system, which you understand, governs the data.
• The data is easier to locate when a customer, an auditor or the Board asks.
• A client's compliance team has one less question for you.
• A future restriction on transfers would not force a hurried migration.

The reasons against are also real: a service you need may not offer an Indian location, or may charge more for it.

Why is "where is it processed" a different question from "where is it stored"?

Because AI changed the answer. A vendor may store your documents in India and still send them to another country when an AI feature reads them. In 2026 most vendors can answer the storage question with "India" and are still working on the processing one. Microsoft has said that in-country AI processing for Microsoft 365 Copilot in India is expected by the end of 2026, and Google lists an India location for Gemini Enterprise, with conditions. Our article on AI data residency gives the sources.

The useful question for any AI vendor is therefore precise: when my employee presses Enter, in which country is the prompt processed? The one arrangement in which the question does not arise is AI that runs on the employee's own computer.

Which AI rules already apply in India?

As of November 2026 India does not have one AI Act. A business faces a set of instruments of different weight:

For most companies this reduces to four duties: obey existing laws when you use AI, label synthetic media, protect personal data given to AI, and keep a record of which AI you use and for what.

What do "sovereign" and "Made in India" mean when you are buying?

They are claims about control, and they are easy to make. Sovereign AI means your company, or your country, decides where the AI runs, who can reach it and which law applies. A "Made in India" product may still store its customers' data abroad, and a foreign product may offer an Indian data centre. Judge by answers, not labels:

1. Storage. In which country, and with which hosting provider, is our data held?
2. Processing. Where is it processed, including by AI features?
3. Access. Who at your company can see it, and is that logged?
4. Training. Do you use our data or prompts to train models?
5. Exit. How do we export everything, in a standard format, and how do you delete it?
6. Terms. Under which country's law is the contract, and who can change the price and conditions?
7. Support. Where are the people who answer when something breaks?

A vendor that answers promptly and specifically is a good sign. A brochure in reply is also an answer.

The strongest form of control is not a promise at all. It is running the software on machines you own, so that the location of the data is simply where you put the machine. That used to need an IT department. It is becoming practical for small companies, which is one reason this subject matters now.

What should a company do this quarter?

• Map personal data. Every kind you hold and every place it is stored, including phones, inboxes and chat groups.
• Write the country beside each cloud tool. If a vendor will not say, record that.
• Ask each AI vendor the processing question.
• Encrypt every laptop and phone that holds company data.
• Decide which AI tools may see personal data.
• Write a one-page breach plan, including who makes the six-hour report.
• Label AI-generated media you publish.
• Put the mid-2027 date in the calendar and work backwards.

Where does DNX OS fit?

This is our own product, so weigh it as a vendor's statement. Denovarix Technologies LLP is based in West Bengal, and DNX OS is built in India. More to the point for this guide, it is designed so that location is your decision: documents, mail, HR records and chat stay on your own machines and on a hub you host, on your premises or in an Indian data centre, and the AI runs on the device, so prompts are not sent to an outside AI company. Keeping personal data in India under your own control makes DPDP duties simpler to meet. It does not meet them for you; you still need the notice, the retention rule and the breach plan.

DNX Cloud, with AI hosting and self-hosting in India, is planned for 2027 and is not available today. DNX OS is in beta from December 2026 and launches in January 2027. Registered Indian businesses can apply for the beta.

Which articles go deeper?

Law and compliance

• DPDP Act checklist: where does your company's data live?: the seven principles, the penalties, twelve steps, and five questions for every vendor.
• AI rules in India in 2026: what a business must do: each instrument, how binding it is, and what to do now, with sources.

Data residency and sovereignty

• Where is your AI processed? Data residency in India: storage versus processing, what the DPDP Rules say about transfers, and what the large vendors offer in India.
• Sovereign AI and private AI: what they mean in India: the two ideas, the law, and five questions for a vendor who uses the words.

Keeping company conversations in India

• DNX Team Chat: team chat that keeps data in India: a chat that runs on a server the company hosts, in real screenshots.
• Branches on WhatsApp groups: moving to company chat: the four-week move, step by step.

Related, from other guides

• Passkeys, encryption, device management: the 2026 baseline: includes the CERT-In baseline for MSMEs.
• Open document formats: files you can leave with: why formats decide whether you control your own records.
• A Slack or Teams alternative that keeps data in India: what each vendor's own pages say about Indian data residency.
• Private and on-device AI for business: the AI side of the same question.

Terms such as Data Fiduciary, data residency and sovereign AI are defined in the glossary.