India’s DPDP Act does not, today, force patient data to live inside India. Section 16 will use a negative-list model when it commences on 13 May 2027. No restricted-country list has been notified; assess transfers under current applicable law and contracts. So when a vendor sells you on a Mumbai data centre, they’re answering a question DPDP doesn’t really ask. The questions that matter: is the data stored at all, who can reach it, can you delete it.
Most “data residency” pitches answer the geography question because geography is easy to demo. The rest of this page is what DPDP actually demands, why purpose limitation beats location, and a checklist you can run any vendor through in about ten minutes.
Key takeaways
- DPDP 2023 uses a negative-list, not mandatory localization: data may leave India unless the government restricts the destination. That restricted list isn’t notified yet.
- The forthcoming Section 8(7) erasure duty takes effect on 13 May 2027; plan purpose-limited use and retention now.
- The DPDP Rules 2025 (notified 13 November 2025) phase in; cross-border and general security obligations land around 13 May 2027.
- For an AI scribe, the audio is the residency problem. A tool that never stores it removes the question for the most sensitive artifact.
- ABDM data rules and DPDP data rules are different things. Don’t let a vendor blur them.
Key facts
- DPDP's cross-border model: transfer allowed except to government-restricted countries (none notified yet)
- Negative list
- When DPDP general security, breach, and cross-border obligations phase in (Rules 2025)
- 13 May 2027
- Practice Copilot Assist, per clinician, annual, ex-GST (+18% GST = ₹1,887); live audio discarded after drafting; uploads retained only with explicit consent
- ₹1,599/mo
Does DPDP require patient data to be stored in India?
Short answer: no general localization mandate, as of October 2026.
Section 16 of the DPDP Act 2023 provides a negative-list approach to cross-border transfers when it commences on 13 May 2027: a Data Fiduciary may transfer personal data outside India except to a country or territory the central government specifically restricts. ITIF and several Indian law firms have made the same point: that restricted list has not been notified, but Section 16 is not yet in force. Assess transfers under current applicable law and contracts. There’s no blanket rule that clinical data must sit on Indian soil.
Two things keep that from being the whole story. Where another Indian law sets a higher bar for a particular sector, the higher bar still applies. DPDP doesn’t dilute it. And the government has reserved the power to restrict specific categories or destinations later, public health among the sensitive sectors named. So “no localization mandate” is the position now, not a permanent guarantee. A vendor that tells you “DPDP requires Indian storage, and we provide it” is overstating the law to sell you a feature.
If location isn’t the test, what is?
Purpose limitation and deletion. These DPDP duties are scheduled to govern an AI scribe from 13 May 2027.
When it commences on 13 May 2027, Section 8(7) of the DPDP Act will require a Data Fiduciary to erase personal data “upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier,” unless a law requires keeping it. Prepare for it as an operating instruction. Collect the visit data for one stated purpose, drafting your note. Use it only for that. Plan to delete it when the purpose is done or the patient pulls consent, unless another law requires retention.
So the geography question is a distraction. A recording that sits in an Indian data centre for six months while someone uses it to “improve the model” is a bigger DPDP problem than a note processed under a clear purpose and deletable on request. Where the data lives matters far less than how long it lives and what it’s used for. This describes live consultation audio; uploaded recordings use a separate retention mode with explicit consent.
What DPDP actually weighs for an AI scribe
- Purpose & deletion (DPDP S.8)60%
- Access & security safeguards30%
- Storage location10%
The audio is the real residency problem
For a scribe, one artifact decides almost everything. The visit audio. That’s the raw recording of what your patient said before any of it became a note, and it’s the most sensitive thing the tool ever touches. Store that file anywhere, in India or not, and it becomes what a breach exposes and a court can reach.
So the cleanest answer to “where does my patient data live” is that the most sensitive part of it doesn’t live anywhere. Here’s our position, stated as ours. Visit audio is processed in memory and discarded the moment the note is drafted. Nothing to localize, breach, or subpoena. What survives is the note you reviewed and signed, encrypted at rest with AES-256, in transit with TLS 1.2 or newer, behind role-scoped, logged access. And for tier-2 and tier-3 clinics where the signal drops mid-OPD, capture works offline with on-device AES-256-GCM encryption and syncs later. This describes live consultation audio; uploaded recordings use a separate retention mode with explicit consent.
Worth doing before you sign anyone: the cross-vendor version of the audio question, what happens to your visit audio across major scribes. The broader vetting routine lives in the AI scribe security checklist, which puts the audio question first for exactly this reason. Want a clean audio answer? compare the options and ask it before anyone talks features.
The clinic data-location and deletion checklist
Run any India scribe vendor through this. Every question here prepares you for two DPDP duties scheduled for 13 May 2027: whether you keep control of the data, and whether you can walk away with it.
| Check | Ask | A good answer | A red-flag answer |
|---|---|---|---|
| Audio | Do you store the visit recording? | Live consultation audio is processed in memory and discarded at note draft; uploaded recordings use a separate retention mode with explicit consent. | ”Retained for model improvement,” no timeline. |
| Storage | Where are notes stored, and is that disclosed? | Named region and provider, in writing. | ”Securely in the cloud,” no specifics. |
| Purpose | Is my data used for anything beyond drafting my notes? | No, or a written, separate answer for any other use. | ”To improve our service” with no limit. |
| Deletion | Can I delete any visit myself, anytime? | Yes, self-serve, testable in a trial. | Delete only by support request. |
| Export | Can I export my notes and leave? | Yes, full export, any time. | Export gated or undefined. |
| Retention | What’s your default retention, and can I set it? | Stated default, deletable on demand. | Indefinite, or unstated. |
| Consent | How do you handle DPDP consent and withdrawal? | Consent-first capture, erase on withdrawal. | ”We’re DPDP compliant,” no mechanics. |
| ABDM | Are you ABDM-integrated, or is that on a roadmap? | A straight answer that doesn’t conflate ABDM with DPDP. | Implies ABDM-certified when it isn’t. |
That last row needs an honest concession from us. ABDM integration is on our roadmap, not live. Some India-native platforms do have live ABDM integration today, and if ABDM connectivity is a hard requirement for your practice right now, that’s a genuine reason to look at them. We won’t pretend otherwise. The point we will make plainly: DPDP-aligned handling and ABDM integration are two different claims. We meet the first and we’re honest about the second.
How DPDP’s timeline changes what you should ask in 2026
The DPDP Rules 2025 were notified on 13 November 2025, and they don’t all switch on at once. Consent-manager provisions come into force around 13 November 2026. The heavier set, general obligations covering security safeguards, breach reporting, and the cross-border transfer framework, comes into force around 13 May 2027. Clinics get a transition window.
For a buyer today that means you’re choosing a vendor in the run-up to those obligations. Pick one whose posture already matches where the law is going (consent-first, purpose-limited, deletable) instead of one that’ll be scrambling to retrofit it in early 2027. The phased calendar in plain language is in our DPDP for clinics guide. The ownership half of this question, who actually owns the notes and how you exit, is in who owns your AI scribe notes.
DPDP 2025 phase-in dates that matter to a clinic
What it costs, and the honest GST line
Pricing earns a spot in a residency conversation for one reason: lock-in and surprise costs are their own kind of risk. So, plainly. Practice Copilot starts in India at ₹1,599 per clinician per month on the annual Assist plan, ex-GST. Add 18% GST and that’s ₹1,887 per clinician per month all-in. The plan you pick decides what’s bundled: Copilot (₹2,399/mo annual) adds an AI EHR and WhatsApp, Autopilot (₹3,999/mo annual) adds the receptionist and follow-ups, and there’s a 7-day free trial on all of them. The full ladder, month-to-month and annual, sits on the pricing page, and the India-specific rate-card breakdown is in AI medical scribe price in India.
And the canonical line, so you know exactly what’s being handled to DPDP standards: Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot: an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus Patient Square EHR from the Copilot tier or an alongside path for an existing EHR, with scheduling and messaging as you move up the plan. Hospitals get Hospital Copilot, which can use the complete Patient Square HIS/EHR or work alongside an existing HIS/EHR.
The short version for a clinic deciding this week
Five things, in order:
- Stop asking only where the data lives. DPDP doesn’t mandate Indian storage today. Its purpose limitation and erasure duties commence on 13 May 2027.
- Ask whether the audio is stored at all. The recording is the residency problem, and a no-storage scribe removes it.
- Confirm you can delete and export any visit yourself, without filing a support ticket to do it.
- Keep DPDP and ABDM separate. They’re different claims, so make the vendor answer both honestly.
- Pick a posture, not a promise. Consent-first and purpose-limited is where the law lands in 2027, so choose a vendor already there.
The cleanest way to test all of it is a quiet week of real OPD visits with you working the deletion and export functions yourself. compare the options, ask where the audio goes first, then run a 7-day free trial on your own clinic days and check every answer against what they told you.