Why “the cloud” is becoming a compliance problem for Indian enterprises

For a decade, “move it to the cloud” was the obvious answer to almost every enterprise IT question. For regulated Indian enterprises in 2026, on one specific question — where does our data actually go when we use AI? — that answer is quietly becoming a liability.

The shift isn’t one dramatic law. It’s the accumulation of several, all pointing the same direction: data about Indians should, increasingly, stay under Indian control.

What actually changed

The Digital Personal Data Protection Act, 2023 (DPDP Act) is the headline. It introduces meaningful penalties for mishandling personal data, and it reaches extraterritorially — a vendor processing Indian users’ data abroad is within its scope. Enterprises are working toward compliance ahead of the Act’s phased enforcement, not treating it as a someday problem.

But the sectoral regulators moved earlier and, in some respects, go further:

• RBI has long required that payment system data be stored in India.
• SEBI has tightened expectations around where regulated market data lives.
• IRDAI applies equivalent expectations to insurance data.

Stack these together and a pattern emerges. If you are a bank, an NBFC, an insurer, or a broker, the question “is it acceptable to send this customer record to a model hosted outside our control?” increasingly has an uncomfortable answer.

Why AI makes this sharper than ordinary SaaS

Enterprises have used cloud SaaS for years, so why does AI feel different? Because of what you have to send to get value from it.

A cloud CRM stores structured records you chose to put there. But to get a useful answer from a cloud LLM, employees paste in whatever they’re working on: a draft contract, a customer complaint, a loan file, a set of transactions. The most sensitive material in the organisation flows through the prompt box — often informally, without a data-processing assessment, without anyone deciding it was allowed to leave.

That’s the exposure. Not a hypothetical breach, but the everyday reality that your most confidential data is being routed to infrastructure in another jurisdiction, thousands of times a day, as a side effect of people trying to do their jobs.

The usual answers, and why they fall short

There are three common responses, and each has a gap:

“We’ll rely on the vendor’s contract.” A data-processing agreement is a promise plus a remedy after something goes wrong. For a regulator asking where data physically resides, a contractual assurance is not the same as the data never having left.

“We’ll ban the tools.” This fails in practice. Employees use AI whether or not IT sanctions it — “shadow AI” is now one of the most common data-governance headaches, precisely because a blanket ban pushes usage underground rather than eliminating it.

“We’ll wait for clarity.” The direction of travel is clear enough. Regulation is tightening, not loosening. Waiting mostly means accumulating exposure and retrofitting risk later.

The architectural answer

There is a fourth response, and it’s the one we built Altern8 around: change where the AI runs, not just what the contract says.

If the AI runs entirely inside your own infrastructure — your servers, your network, cloud tenancy you control, or fully air-gapped — then the question of cross-border transfer doesn’t need managing, because there is no transfer. Inference happens locally. The documents, the prompts, the answers: none of them leave the perimeter.

To be clear about what this does and doesn’t do: running on-premise removes the cross-border-transfer question. It does not, by itself, make you compliant with the DPDP Act or any sectoral rule — compliance depends on your configuration, your processes, and your own assessment. What it does is remove one of the hardest parts of the problem from the table entirely, so the compliance work you do have to do is smaller and more defensible.

Where this goes

Our view is that data control stops being a niche concern for the most-regulated firms and becomes a default expectation across the enterprise — the same way encryption-at-rest went from “nice to have” to “of course.” The enterprises that already control their AI architecture will have less to retrofit each time a new rule lands.

The cloud isn’t going anywhere. But for the specific question of where your most sensitive data goes when your people use AI, “on our own infrastructure” is starting to look less like a constraint and more like the sensible default.

This article is general information about regulatory trends, not legal advice. Regulations change and their application depends on your specific circumstances; consult qualified counsel for your organisation’s obligations.