Skip to content
Menu

Cloud · Guide

Cloud region and spend in India: prove residency, then cut waste.

Microsoft now runs four cloud regions in India, each paired with another Indian region, so primary, backup and disaster recovery copies can stay in India12. Choose the region for what your regulator asks you to prove, and test residency every month. On cost, tag and review spend before you buy commitments.

Written by
NetScale IT Services
Published
Sources checked
Read
11 minutes
On this page

The facts

Which cloud regions can an Indian firm use today?

Take a firm that moved to Microsoft Azure a few years ago. The region was picked for price, and the backup vault kept its defaults. Now a regulator or a customer’s DPDP questionnaire asks where every copy of the data sits. The answer has to cover the backups, the disaster recovery copy and the logs as well as the primary region.

The choice inside India has widened. Microsoft made its Hyderabad region, India South Central, generally available on 6 August 2026, with three availability zones1. It now runs four cloud regions in India: Pune, Chennai, Mumbai and Hyderabad1.

Each Indian Azure region is paired with another Indian region2. Microsoft’s region list shows three availability zones in Pune and Hyderabad, and lists none for Chennai or Mumbai2. The table uses the names Azure Policy expects, because that is where residency gets enforced.

Table 1. Microsoft Azure regions in India, from Microsoft’s region list as read on 8 October 20262
Region name in Azure PolicyCityAvailability zonesPaired with
centralindiaPune3southindia (Chennai)
indiasouthcentralHyderabad3centralindia (Pune)
southindiaChennaiNone listedcentralindia (Pune)
westindiaMumbaiNone listedsouthindia (Chennai)

More capacity is on the way. Microsoft has committed US$17.5 billion in India over 2026 to 2029, for cloud and AI infrastructure, skilling and operations3. AWS plans to invest over US$21 billion in Indian cloud infrastructure from 2026 to 2030, to expand capacity in Hyderabad and Mumbai4. Google plans about US$15 billion over 2026 to 2030 for an AI hub in Visakhapatnam, with AdaniConnex and Airtel5.

Savills India counts 258 MW of data centre capacity added in the first half of 2026, up 59% from 162 MW a year earlier6. That took India’s operational capacity to 1.8 GW IT6.

The facts

Which rules decide where the data and logs sit?

No single residency law covers every firm. Four instruments matter most to a cloud design in India, and their status differs.

Table 2. Location rules that touch a cloud design in India, as of 8 October 2026
InstrumentWho it bindsWhat it says about locationStatus
RBI circular on storage of payment system data, 6 April 20187Authorised payment system providers and all banks operating in India, for data held by them and by the vendors they engage8The entire data relating to the payment systems they operate is to be “stored in a system only in India”7. Processing abroad is allowed if that data is deleted there and brought back within one business day or 24 hours, whichever is earlier8.In force
SEBI framework for adoption of cloud services, 6 March 20239SEBI-regulated entitiesData at the primary site, the disaster recovery (DR) site and near DR, logs included, “should reside/be processed within the legal boundaries of India”9. Providers must be empanelled by the Ministry of Electronics and Information Technology (MeitY), with a valid STQC (Standardisation Testing and Quality Certification) audit status9.In force. On 31 December 2024 SEBI held a separate localisation standard, in its cyber resilience framework, “in abeyance until further notification”10.
CERT-In Directions, 28 April 202211Service providers, intermediaries, data centres, body corporate and government organisationsLogs of all information and communication technology (ICT) systems kept for a rolling 180 days, “maintained within the Indian jurisdiction”11. CERT-In’s FAQ says logs “may be stored outside India also” if they reach CERT-In in reasonable time12.In force
DPDP Act, 2023, section 16, and DPDP Rules, 2025131415Data fiduciaries, and significant data fiduciaries for rule 13(4)The government may, by notification, restrict transfers to a country or territory outside India, and Indian laws with stricter transfer rules still apply13. Rule 13(4) lets the government specify data that a significant data fiduciary must not transfer outside India15. Rule 15 lets it set requirements for making data available to a foreign State15.Not yet in force. Section 16 and rules 13 and 15 apply from 13 May 20271415.

SEBI’s technical clarifications of 28 August 2025 list “SEBI Cloud circular compliance” as an item of its cyber resilience framework16. The same table marks data localisation “currently in abeyance”16. The standard in abeyance is PR.DS.S2, not the cloud framework1016.

The CERT-In FAQ quoted in the table calls itself “not a legal document”12. Its next answer says a provider serving users in India “needs to enable and maintain logs and records of financial transactions in Indian jurisdiction”12.

The facts

What does “sovereign cloud” add?

Microsoft introduced Sovereign Public Cloud and Sovereign Private Cloud for Indian customers on 9 December 20253. It said Sovereign Public Cloud “is now available from Microsoft’s Indian regions”3. The private option, on Azure Local, “will support both connected and disconnected operations”3.

Microsoft’s documentation describes Sovereign Public Cloud as working “while using existing Microsoft hyperscale cloud regions”17. It adds keys you hold in hardware security modules, confidential computing and a Sovereign Landing Zone that applies policy as code17. Its EU Data Boundary and Data Guardian features are specific to EU and EFTA data centres17.

The facts

How much cloud spend is wasted, and where is AI spend going?

Flexera’s 2026 State of the Cloud report surveyed more than 750 cloud decision-makers and users18. Managing cloud spend remains a top challenge for 85% of them18. Wasted cloud spend rose to 29%, the first increase in five years, which Flexera ties to surging cloud-based AI workloads18. Flexera also found that 63% have established FinOps teams, the people who manage cloud spend18.

The FinOps Foundation’s State of FinOps 2026 drew 1,192 respondents with more than US$83 billion of annual cloud spend19. Of those, 98% now manage AI spend, up from 63% in 2025 and 31% in 202419. Many practitioners report difficulty gaining “clear visibility into AI-related usage and costs”19.

On Azure, tags reach cost data only while they sit on the resource, and they “aren’t applied to historical data”20. Azure Advisor’s savings figures for resizing or shutting down virtual machines use retail rates21. They do not account for the reservations or savings plans you already hold21.

What it means

Where do copies leave the region without anyone deciding?

In-country DR is practical on Azure, because every Indian region has an Indian pair2. The gap is proof: where each copy sits, and who owns each line of the bill.

Start with the defaults. A Recovery Services vault uses geo-redundant storage unless you change it, and the setting locks once a backup is configured22. Its Cross Region Restore option restores into the Azure paired region22. From an Indian region, that pair is Indian2.

Logs are looser. For a regional resource, Azure requires a storage account or event hub that receives its diagnostic logs to sit in the same region23. It sets no such rule for a Log Analytics workspace, so logs land wherever that workspace was created23. The built-in “Allowed locations” policy also skips resource groups and resources that use the “global” region24.

Residency checks for Monday

  1. Export every resource with its subscription, type and region from Azure Resource Graph. Flag anything outside centralindia, southindia, westindia and indiasouthcentral.
  2. Assign the built-in “Allowed locations” and “Allowed locations for resource groups” policies at the management group, set to the four Indian regions24. Run them in Audit for a month, then switch to Deny.
  3. List the resources that use the “global” region on their own sheet, because the policy does not cover them24.
  4. Record each Recovery Services vault’s storage replication type and Cross Region Restore setting before its first backup is configured22.
  5. Trace every diagnostic setting to its destination. Record the region of each workspace, storage account and event hub, and any export to a tool outside Azure23.
  6. Write down, for each workload, which rule applies: RBI, SEBI, CERT-In, a customer contract or none. Attach the evidence to the row.
  7. Send a one-page residency report every month: policy compliance, exceptions, owners and review dates.

Spend checks for Monday

  1. Tag every resource with owner, cost centre and environment, and enforce the tags with Azure Policy. Tags added today do not relabel last month’s costs20.
  2. Report each owner’s spend in rupees every month from invoiced data. Microsoft treats open-month costs as estimates until the invoice is generated20.
  3. Work through Advisor’s shutdown and resize recommendations first. By default, Advisor looks back seven days for machines that were not used at all21.
  4. Buy reservations or savings plans only for workloads that stay steady after that clean-up, since Advisor’s resize figures ignore the commitments you already hold21.
  5. Give AI work its own subscription or tag, and its own budget, from the first pilot.

Our view

How should you choose a region, and who should own the bill?

Choose the region for what you must prove, not for list price. Ask the questions in this order: which rule binds the data, where the DR copy goes, whether the services you need run there, then latency, then price.

A pair is not a DR plan. Microsoft says deploying resources to a paired region “doesn’t automatically make them more resilient”25. Its guidance is to develop your own disaster recovery plans25.

New regions also fill in gradually. Microsoft’s launch note for India South Central says its benefits come “as services become available in the region over time”1. Check each service before you design around it.

Write residency as a control you can test. A Deny policy, a vault setting recorded before go-live and a monthly report are evidence an auditor can read. A slide that says “data stays in India” is a claim.

On cost, fix ownership before you buy any tool. Advisor already lists idle machines21. One of the FinOps Foundation’s principles is “Everyone takes ownership for their technology usage”26. Someone has to own that list every month, in rupees.

Separate AI spend early. Many practitioners already report poor visibility into AI costs19, and a budget line is easier to read while it is small.

The region rule has fair exceptions. A model or service you need may run only outside India for now. Write that exception down, with the data class, the rule that permits it and a review date. Where counsel confirms that no sector rule or customer clause applies, price and latency can lead, as long as the choice is recorded.

Limits

What does this leave out?

Whether a rule applies to you is for your counsel and compliance team. The insurance regulator (IRDAI), other sector regulators and customer contracts set their own location terms, which this piece does not cover. Region and service details are as Microsoft’s pages stood when we read them on 8 October 2026. The Flexera and FinOps Foundation figures come from global surveys, not Indian estates.

Where we fit

Where does NetScale fit?

We work on Microsoft Azure, with Yotta for India-based capacity. Our cloud services start with a cloud readiness assessment: cost against what was promised, region and residency, identity and access in the tenant, and backup and recovery. After go-live, monitoring runs on KloudMate, and cost and performance are reported every month in writing. The assessment is free, and the written findings are yours whether we work together or not.

Questions readers ask

Does the DPDP Act require our cloud data to stay in India?

The Act sets no general rule that data must stay in India. Section 16 lets the government restrict transfers to a country it notifies, and Indian laws with stricter transfer rules still apply13. Rule 13(4) lets it specify data that a significant data fiduciary must not transfer outside India15. Both apply from 13 May 20271415. Applicability is for your counsel.

Can a SEBI-regulated firm keep its DR copy outside India?

Not if the DR copy is in the cloud. SEBI’s cloud framework says data at the primary site, DR and near DR, logs included, “should reside/be processed within the legal boundaries of India”9. Providers must be MeitY-empanelled9. The localisation standard SEBI put in abeyance on 31 December 2024 is a different one, in its cyber resilience framework10. Applicability is for your counsel and compliance team.

Can our CERT-In logs sit in a SIEM hosted abroad?

Possibly, but keep a copy in India. The Directions say logs are kept for 180 days “within the Indian jurisdiction”11. CERT-In’s FAQ allows storage outside India if logs reach CERT-In in reasonable time, and calls itself “not a legal document”12. A 180-day copy in India follows the stricter of the two texts. Applicability is for your counsel.

Will Azure Backup send our backups out of India?

Not by default, if the vault sits in an Indian region. A geo-redundant vault replicates to the paired region2225, and every Indian Azure region is paired with another Indian region2. Check the vault’s replication setting before the first backup, because it locks after that22.

Should we buy reserved instances now to cut the bill?

Not before you resize and retire. Advisor’s resize and shutdown savings figures ignore the reservations and savings plans you hold21. Microsoft also warns that some resizes can raise costs where reservations exist21. Commit only for workloads that stay steady after the clean-up.

References

  1. 1Microsoft Source Asia. Microsoft’s newest India datacenter region goes live to power the country’s AI economy and enable Frontier Firms. 6 August 2026. news.microsoft.com (opens in a new tab)
  2. 2Microsoft Learn. List of Azure regions. 23 September 2026. learn.microsoft.com (opens in a new tab)
  3. 3Microsoft Source Asia. Microsoft invests US$17.5 billion in India to drive AI diffusion at population scale. 9 December 2025. news.microsoft.com (opens in a new tab)
  4. 4W.Media. AWS breaks ground for new DC in Hyderabad, plans US$ 21 billion investment in India. 17 July 2026. w.media (opens in a new tab)
  5. 5Google India Blog. Our First AI Hub in India, Powered by a $15 Billion Investment. 14 October 2025. blog.google (opens in a new tab)
  6. 6Indian Infrastructure, reporting Savills India. India’s data centre capacity additions grow 59 per cent in H1 2026, says industry report. 22 July 2026. indianinfrastructure.com (opens in a new tab)
  7. 7Reserve Bank of India. Storage of Payment System Data (RBI/2017-18/153, DPSS.CO.OD No.2785/06.08.005/2017-2018). 6 April 2018. rbi.org.in (opens in a new tab)
  8. 8Reserve Bank of India. Storage of Payment System Data (FAQs). 26 June 2019. rbi.org.in (opens in a new tab)
  9. 9Securities and Exchange Board of India. Framework for Adoption of Cloud Services by SEBI Regulated Entities (REs) (SEBI/HO/ITD/ITD_VAPT/P/CIR/2023/033). 6 March 2023. sebi.gov.in (opens in a new tab)
  10. 10Securities and Exchange Board of India. Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs) (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/184). 31 December 2024. sebi.gov.in (opens in a new tab)
  11. 11CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet. 28 April 2022. cert-in.org.in (opens in a new tab)
  12. 12CERT-In, Ministry of Electronics and Information Technology. Frequently Asked Questions (FAQs) on Cyber Security Directions of 28.04.2022. May 2022. cert-in.org.in (opens in a new tab)
  13. 13Ministry of Law and Justice (Legislative Department), Gazette of India. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023). 11 August 2023. meity.gov.in (opens in a new tab)
  14. 14Ministry of Electronics and Information Technology, Gazette of India. Notification G.S.R. 843(E) under section 1(2) of the Digital Personal Data Protection Act, 2023. 13 November 2025. meity.gov.in (opens in a new tab)
  15. 15Ministry of Electronics and Information Technology, Gazette of India. Digital Personal Data Protection Rules, 2025 (notification G.S.R. 846(E)). 13 November 2025. meity.gov.in (opens in a new tab)
  16. 16Securities and Exchange Board of India. Technical Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs) (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119). 28 August 2025. sebi.gov.in (opens in a new tab)
  17. 17Microsoft Learn. What is Sovereign Public Cloud. 31 March 2026. learn.microsoft.com (opens in a new tab)
  18. 18Flexera (press release on the 2026 State of the Cloud Report). Flexera Finds Cloud Value is Rising While AI Waste Grows. 18 March 2026. flexera.com (opens in a new tab)
  19. 19FinOps Foundation. State of FinOps 2026 Report. Undated. data.finops.org (opens in a new tab)Checked
  20. 20Microsoft Learn. Understand Cost Management data. 27 June 2025. learn.microsoft.com (opens in a new tab)
  21. 21Microsoft Learn (Azure Advisor). Optimize virtual machine (VM) or virtual machine scale set (VMSS) spend by resizing or shutting down underutilized instances. 18 February 2026. learn.microsoft.com (opens in a new tab)
  22. 22Microsoft Learn (Azure Backup). Create and Configure Recovery Services Vaults. 13 January 2026. learn.microsoft.com (opens in a new tab)
  23. 23Microsoft Learn. Diagnostic Settings in Azure Monitor. 22 September 2026. learn.microsoft.com (opens in a new tab)
  24. 24Microsoft Learn (Azure Policy). List of built-in policy definitions. 7 July 2026. learn.microsoft.com (opens in a new tab)
  25. 25Microsoft Learn. Azure region pairs and nonpaired regions. 26 June 2026. learn.microsoft.com (opens in a new tab)
  26. 26FinOps Foundation. FinOps Principles. Undated. finops.org (opens in a new tab)Checked

Changes

  • First published.

Written by NetScale IT Services. How these guides are written

  1. Privacy and compliance10 minutes

    DPDP Rules 2025: what your IT team has to build before 13 May 2027.

  2. Security operations10 minutes

    Ransomware in India: who to report to, how fast and how to recover.