Sector Rules Beyond DPDP: RBI, Health Data and Government Procurement

Overview

The DPDP Act is India’s general personal data law, but for most regulated buyers it is not the binding constraint on AI infrastructure – the sector layer is. A bank siting a GPU cluster answers to RBI directions that predate DPDP and are stricter in places; a hospital ecosystem answers to ABDM policies and health record standards; a government department carries procurement and empanelment conditions that behave like localisation rules even where no statute imposes one. Reading these as layers – general law at the bottom, sector instruments above, contracts on top, with the strictest applicable rule winning on each point – turns a confusing landscape into an implementable control set. This article maps the layers as published; it is orientation for planning, not legal advice.

The layering model

Think of compliance obligations on an Indian AI platform as four layers. Layer one is general law: the DPDP Act and Rules, applying to all digital personal data, with cross-border transfer permitted except to restricted countries – the baseline detailed in The DPDP Act for AI Infrastructure. Layer two is sector regulation: RBI, IRDAI and SEBI instruments in finance, health-sector policies, telecom licence conditions. Layer three is contract: procurement terms, customer data-processing agreements, empanelment conditions. Layer four is internal policy. Nothing in a higher layer relaxes a lower one; each can only add. The design consequence: identify every applicable instrument per workload, and build to the strictest requirement on each control point rather than to any single document.

BFSI: the RBI layer

Three RBI instruments matter most for GPU infrastructure. First, the April 2018 direction on Storage of Payment System Data requires end-to-end payment transaction data to be stored only in India, with a narrow allowance for the foreign leg of cross-border transactions – a genuine localisation rule, unlike DPDP. Second, the outsourcing and IT governance directions make regulated entities accountable for third-party arrangements, with audit and access rights – which reaches colocation, managed GPU services and AI vendors. Third, the FREE-AI framework released in August 2025 sets out, as published by the RBI, principles and recommendations for responsible AI adoption – governance, model risk, data use and third-party AI safeguards. The siting consequences are worked through in Where BFSI AI Compute Must Sit and the model-risk consequences in FREE-AI and Model Risk Rules.

Health: ABDM, EHR standards and DPDP together

Health data has no dedicated statute in force – the earlier DISHA draft was not enacted – so the operative stack is DPDP as the statutory layer plus the ABDM ecosystem’s policies for participants. The ABDM Health Data Management Policy sets consent-centric expectations for entities in the ecosystem, built around ABHA IDs and consent-managed exchange, and the EHR Standards recommend interoperability and security standards for records, as published by the health authorities. For AI teams this lands as three practical duties: treat health records as high-sensitivity personal data under DPDP safeguards; design AI access to records through consented, logged exchange rather than bulk copies; and prefer architectures where data stays within institutions – which is why federated learning across hospitals maps so cleanly onto the Indian health stack.

Government: procurement as regulation

For government and PSU workloads, the binding instruments are usually contractual: GeM bid conditions, ministry security guidelines, and hosting expectations that government data sit in India – commonly in MeitY-empanelled data centres or departmental facilities. Sourcing rules add supply-chain conditions: Make in India preference under the Public Procurement Order, class-of-supplier restrictions, and increasingly detailed security and registration requirements for hardware. These bind as firmly as statute for the workload concerned, and they reward bidders who arrive with provenance paperwork and residency architecture already documented – the ground covered in GeM GPU Server Procurement Guide.

One control set to satisfy all layers

The layers converge on a small number of control families, which is good news: a residency map per data class (strictest rule wins – payment data in India only, government data per contract, the rest per DPDP baseline); identity-based access control with MFA and privileged access records; the four-layer logging stack with retention meeting CERT-In, DPDP Rules and sector expectations simultaneously; breach response rehearsed against all applicable clocks; and vendor accountability flowing down through contracts. Build each control once against the strictest applicable layer and let every regulator inherit it – the alternative, per-regulator control silos, is how compliance budgets die.

Sector instruments and their infrastructure consequences

Frequently asked questions