India’s DPDP Act does not, today, force patient data to live inside India. It uses a negative-list model. Data can move to any country except the ones the government specifically restricts, and that restricted list isn’t published yet. So when a vendor sells you on a Mumbai data centre, they’re answering a question DPDP doesn’t really ask. The questions that matter: is the data stored at all, who can reach it, can you delete it.
Most “data residency” pitches answer the geography question because geography is easy to demo. The rest of this page is what DPDP actually demands, why purpose limitation beats location, and a checklist you can run any vendor through in about ten minutes.
Key takeaways
- DPDP 2023 uses a negative-list, not mandatory localization: data may leave India unless the government restricts the destination. That restricted list isn’t notified yet.
- The sharper rule is purpose limitation: use data only for the stated purpose, then erase it (Section 8(7)).
- The DPDP Rules 2025 (notified 13 November 2025) phase in; cross-border and general security obligations land around 13 May 2027.
- For an AI scribe, the audio is the residency problem. A tool that never stores it removes the question for the most sensitive artifact.
- ABDM data rules and DPDP data rules are different things. Don’t let a vendor blur them.
DPDP's cross-border model: transfer allowed except to government-restricted countries (none notified yet)
When DPDP general security, breach, and cross-border obligations phase in (Rules 2025)
Practice Copilot Assist, per clinician, annual, ex-GST (+18% GST = ₹1,887); audio never stored
Does DPDP require patient data to be stored in India?
Short answer: no general localization mandate, as of mid-2026.
The DPDP Act 2023 takes a negative-list approach to cross-border transfers. A Data Fiduciary may transfer personal data outside India except to a country or territory the central government specifically restricts. ITIF and several Indian law firms have made the same point: that restricted list has not been notified, so in practice transfers are broadly permitted today. There’s no blanket rule that clinical data must sit on Indian soil.
Two things keep that from being the whole story. Where another Indian law sets a higher bar for a particular sector, the higher bar still applies. DPDP doesn’t dilute it. And the government has reserved the power to restrict specific categories or destinations later, public health among the sensitive sectors named. So “no localization mandate” is the position now, not a permanent guarantee. A vendor that tells you “DPDP requires Indian storage, and we provide it” is overstating the law to sell you a feature.
If location isn’t the test, what is?
Purpose limitation and deletion. This is the part of DPDP that actually governs an AI scribe.
Section 8(7) of the DPDP Act is blunt about it. A Data Fiduciary must erase personal data “upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier,” unless a law requires keeping it. Read it as an operating instruction. Collect the visit data for one stated purpose, drafting your note. Use it only for that. Delete it when the purpose is done or the patient pulls consent.
So the geography question is a distraction. A recording that sits in an Indian data centre for six months while someone uses it to “improve the model” is a bigger DPDP problem than a note processed under a clear purpose and deletable on request. Where the data lives matters far less than how long it lives and what it’s used for.
- Purpose & deletion (DPDP S.8)60%
- Access & security safeguards30%
- Storage location10%
The audio is the real residency problem
For a scribe, one artifact decides almost everything. The visit audio. That’s the raw recording of what your patient said before any of it became a note, and it’s the most sensitive thing the tool ever touches. Store that file anywhere, in India or not, and it becomes what a breach exposes and a court can reach.
So the cleanest answer to “where does my patient data live” is that the most sensitive part of it doesn’t live anywhere. Here’s our position, stated as ours. Visit audio is processed in memory and discarded the moment the note is drafted. Nothing to localize, breach, or subpoena. What survives is the note you reviewed and signed, encrypted at rest with AES-256, in transit with TLS 1.2 or newer, behind role-scoped, logged access. And for tier-2 and tier-3 clinics where the signal drops mid-OPD, capture works offline with on-device AES-256-GCM encryption and syncs later.
Worth doing before you sign anyone: the cross-vendor version of the audio question, what happens to your visit audio across major scribes. The broader vetting routine lives in the AI scribe security checklist, which puts the audio question first for exactly this reason. Want a clean audio answer? Book a demo and ask it before anyone talks features.
The clinic data-location and deletion checklist
Run any India scribe vendor through this. Every question here is about one of two things that actually bind under DPDP: whether you keep control of the data, and whether you can walk away with it.
| Check | Ask | A good answer | A red-flag answer |
|---|---|---|---|
| Audio | Do you store the visit recording? | No, processed in memory, discarded at note draft. | ”Retained for model improvement,” no timeline. |
| Storage | Where are notes stored, and is that disclosed? | Named region and provider, in writing. | ”Securely in the cloud,” no specifics. |
| Purpose | Is my data used for anything beyond drafting my notes? | No, or a written, separate answer for any other use. | ”To improve our service” with no limit. |
| Deletion | Can I delete any visit myself, anytime? | Yes, self-serve, testable in a trial. | Delete only by support request. |
| Export | Can I export my notes and leave? | Yes, full export, any time. | Export gated or undefined. |
| Retention | What’s your default retention, and can I set it? | Stated default, deletable on demand. | Indefinite, or unstated. |
| Consent | How do you handle DPDP consent and withdrawal? | Consent-first capture, erase on withdrawal. | ”We’re DPDP compliant,” no mechanics. |
| ABDM | Are you ABDM-integrated, or is that on a roadmap? | A straight answer that doesn’t conflate ABDM with DPDP. | Implies ABDM-certified when it isn’t. |
That last row needs an honest concession from us. ABDM integration is on our roadmap, not live. Some India-native platforms do have live ABDM integration today, and if ABDM connectivity is a hard requirement for your practice right now, that’s a genuine reason to look at them. We won’t pretend otherwise. The point we will make plainly: DPDP-aligned handling and ABDM integration are two different claims. We meet the first and we’re honest about the second.
How DPDP’s timeline changes what you should ask in 2026
The DPDP Rules 2025 were notified on 13 November 2025, and they don’t all switch on at once. Consent-manager provisions come into force around 13 November 2026. The heavier set, general obligations covering security safeguards, breach reporting, and the cross-border transfer framework, comes into force around 13 May 2027. Clinics get a transition window.
For a buyer today that means you’re choosing a vendor in the run-up to those obligations. Pick one whose posture already matches where the law is going (consent-first, purpose-limited, deletable) instead of one that’ll be scrambling to retrofit it in early 2027. The phased calendar in plain language is in our DPDP for clinics guide. The ownership half of this question, who actually owns the notes and how you exit, is in who owns your AI scribe notes.
What it costs, and the honest GST line
Pricing earns a spot in a residency conversation for one reason: lock-in and surprise costs are their own kind of risk. So, plainly. Practice Copilot starts in India at ₹1,599 per clinician per month on the annual Assist plan, ex-GST. Add 18% GST and that’s ₹1,887 per clinician per month all-in. The plan you pick decides what’s bundled: Copilot (₹2,399/mo annual) adds an AI EHR and WhatsApp, Autopilot (₹3,999/mo annual) adds the receptionist and follow-ups, and there’s a 7-day free trial on all of them. The full ladder, month-to-month and annual, sits on the pricing page, and the India-specific rate-card breakdown is in AI medical scribe price in India.
And the canonical line, so you know exactly what’s being handled to DPDP standards: Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot: an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot.
The short version for a clinic deciding this week
Five things, in order:
- Stop asking only where the data lives. DPDP doesn’t mandate Indian storage today. It mandates purpose limitation and deletion.
- Ask whether the audio is stored at all. The recording is the residency problem, and a no-storage scribe removes it.
- Confirm you can delete and export any visit yourself, without filing a support ticket to do it.
- Keep DPDP and ABDM separate. They’re different claims, so make the vendor answer both honestly.
- Pick a posture, not a promise. Consent-first and purpose-limited is where the law lands in 2027, so choose a vendor already there.
The cleanest way to test all of it is a quiet week of real OPD visits with you working the deletion and export functions yourself. Book a demo, ask where the audio goes first, then run the 7-day trial on your own clinic days and check every answer against what they told you.