Data Residency vs Data Sovereignty: Not the Same

A tender evaluation committee in a PSU once scored two bids as equivalent on sovereignty because both offered an India region. One ran inference on a Mumbai VPC whose control plane, support break-glass and model endpoint lived in another country. The other ran on the PSU's own rack. The scores should not have been the same.

The committee was not careless. The RFP had used residency, localisation and sovereignty as if they were one checkbox. Vendors answered the checkbox. The architecture differences disappeared inside a single cell of the Excel.

This article separates the three words the way an auditor will, then puts them back together as a scoring method you can attach to the next file.

Three words, three questions

Term	Question it answers	What it does not answer
Residency	Where is the data stored, including backups?	Who can be compelled to hand it over
Localisation	Is export of this class forbidden or limited by a circular or contract?	Whether the operator is under Indian control
Sovereignty	Which law and which operator actually govern access?	The street address of the rack

Residency is a geography fact. Localisation is a legal restriction on movement. Sovereignty is about jurisdiction and operational control. You can have residency without sovereignty. You can have a localisation circular without an AI architecture that honours it. You can have an Indian-owned company that still ships every prompt offshore.

The practical test is ugly and useful. Imagine a foreign court or a foreign regulator serves the parent company. Can that company produce your prompts, embeddings or admin logs without your consent? If the honest answer is yes or we are not sure, you have residency at best. You do not have sovereignty.

What Indian law actually localises

DPDP is not a blanket localisation statute. Section 16, read with Rule 15 of the 2025 Rules, lets a Data Fiduciary transfer personal data outside India unless the Central Government restricts a destination or sets conditions on making that data available to a foreign State. As of August 2026, no public country blacklist had been notified. That is not permission to ignore the rest of the stack.

Allowed under DPDP still requires a lawful basis, purpose limitation, a processor contract, security, and any sector rule that is stricter. Vendor language that says DPDP permits global processing is true in the same way that a highway permits trucks. It does not tell you whether this truck is allowed on this bridge.

Sector rules bite harder, and they bite by class of data, not by the word AI.

• The Reserve Bank of India's 6 April 2018 direction on storage of payment system data requires the entire payment data of authorised payment system operators to be stored in systems located only in India. Processing abroad is not banned, but the data must be brought back and deleted abroad within one business day or 24 hours, whichever is earlier.
• CERT-In's 28 April 2022 directions require specified logs to be retained in India for 180 days and incidents to be reported on a six-hour clock. Agent traces that never land in an Indian store fail that duty even if the model is local.
• SEBI's CSCRF localisation control for Indian securities-market data has been in abeyance since December 2024. Abeyance is not repeal. Design so you can repatriate.
• IRDAI, DoT and individual ministry instructions add overlays that do not appear in a generic DPDP slide.

Why AI makes the old circulars sharper

Payment data in 2018 meant messages and databases. In 2026 it also means the prompt that contains an account number, the embedding of a reconciliation spreadsheet, and the screenshot a reviewer saved because the agent got the IFSC wrong. If your inventory of localised classes stops at the core banking table, the agent has already walked around the circular.

The five places residency dies after the order form

Auditors do not stop at the data-centre pin on page two. They walk the path the bits actually take. These are the five places the path usually leaves India after someone already ticked residency.

1. Identity. The IdP is foreign. Every login exports officer identifiers, device signals and group membership.
2. Control plane. The cluster API, billing, marketplace and feature flags sit in another region. Storage is local. Command is not.
3. Model path. Embeddings, rerankers, speech, OCR or a timeout fallback call a hosted API.
4. Observability. Crash dumps, traces and prompt logs go to a foreign APM because that is the vendor's default.
5. People. Support break-glass, professional services laptops, and annotation vendors read production or near-production data from abroad.

Write those five as rows in the evaluation sheet. Ask for evidence against each row. A single certificate that says data stays in India is an answer to none of them.

Jurisdiction is not a feeling

A company organised under the law of another country can be compelled by that country even when the disk is in Navi Mumbai. The US CLOUD Act is the example everyone knows. It is not the only one. Mutual legal assistance, extraterritorial discovery, and simple vendor terms that let a parent company access affiliates are enough.

This is not an argument that foreign companies are untrustworthy. It is an argument that the file must record residual compulsion risk. If the secretary accepts that risk for a public website, write it down. If the secretary does not accept it for citizen case files, do not hide the same operator behind an India-region label.

How to score the next two bids

Give both bidders the same three-column table. Accept only artefacts: a signed data-flow, a packet capture from staging, a key ceremony note, a sub-processor schedule with countries, and a DPA draft. Presentations do not score.

Mark eligibility first. If the RFP said personal data shall not leave the SDC, a hosted model API is not a quality deduction. It is a fail. Then mark quality on keys, restore drills and exit. Price only after those two gates.

If a vendor answers all three columns with India region, they have not understood the question. If your own evaluation sheet has only one column, neither have you.

How committees confuse the words in practice

The confusion is rarely philosophical. It is clerical. An RFP writer copies sovereign / resident / India region from the last tender. A vendor copies the same phrase into the compliance matrix. Three evaluators mark yes because the phrase appears. Nobody traces a packet.

A cleaner habit is to ban the word sovereign from the technical form unless the bidder is answering a defined row. Let them use it in the cover letter if they must. The form should only accept residency, localisation and control, each with an artefact. Language discipline is cheaper than a failed audit.

State data centres already have this discipline for other systems. They do not accept hosted in India as an answer for a treasury application. They ask which VLAN, which backup site, which administrator. AI deserves the same boredom. Boredom is how public money stays defensible.

Backups are the forgotten copy

Residency claims die in the disaster-recovery design more often than in the primary database. A Mumbai primary with a Singapore replica is not an India-resident system. A snapshot that lands in a global object store because that was the default bucket is not an India-resident system. A laptop image an SI took home for debugging is not an India-resident system.

Write backups, replicas, snapshots and support images into the residency row. Ask for the retention of each. Ask who can restore, from where, and whether a restore creates a third copy. If the vendor cannot draw the backup, they cannot claim the primary.

What to tell the secretary in one page

Secretaries do not need the taxonomy. They need a decision. Write four lines. Where the disks are. Who can compel the operator. Which circulars restrict which classes. What residual risk you are asking them to accept. If you cannot fit it in four lines, you do not understand the deployment yet.

Attach the four lines to the note seeking approval. Do not bury them in annexure 17. Approval of an annexure nobody read is not acceptance of compulsion risk. Acceptance has to be visible.

A four-week residency-versus-control review

Week 1 is inventory, not opinion. List every store the agent will touch: systems of record, indexes, traces, backups, support recordings, eval sets. Against each store write the facility, the legal entity that operates it, and the country that can compel that entity. If a cell is blank, it is a finding, not a to-do for later.

Week 2 is the packet. Force staging through a proxy. Disable outbound internet and record what dies. Those deaths are control-plane, model, licence or telemetry paths that the order form did not mention. Photograph the proxy log and file it. A log that exists only on an engineer's laptop will not survive a transfer.

Week 3 is law. Map each data class to DPDP, to any sector circular, and to the department's own hosting policy. The strictest rule wins. Write the residual compulsion risk in four lines a secretary can sign. If no one will sign, you do not have acceptance. You have a hope that nobody asks.

Week 4 is the RFP language. Replace sovereign with three rows: residency, localisation, control. Attach the artefacts you already collected as the example of what a bidder must produce. Bidders who cannot match the artefact standard are non-responsive. That sentence will feel harsh in a meeting. It will feel obvious after the first audit.

1. Do not let a vendor rewrite the three rows into one checkbox.
2. Do not accept India region as an answer to control.
3. Do not skip backups. The replica is the real copy.
4. Do not bury residual risk in annexure 17.

Objections you will hear — and what to do with them

Vendors will say everyone uses these words interchangeably. Everyone also used safe harbour until they could not. Interchangeability is not a defence. It is a diagnosis.

Internal drafters will say three columns will confuse the committee. One column already confused the committee. Three columns with artefacts are how they unconfuse. Sit with them for the first scoring. Do not abandon the sheet because the first hour is slow.

A cloud account team will say backups are an implementation detail. Implementation details are where copies live. Copies are the thing you are regulating. Invite the backup owner to the meeting.

Someone will ask for a legal opinion on sovereignty. Ask instead for an opinion on transfers, compulsion and the circulars that apply. Sovereignty opinions without those three are essays.

Leadership will want a simple India-yes / India-no dashboard. Give them disks, control, compulsion as three lights. Simple is allowed. False-simple is not.

Prcept AI deploys on your facility layer. We will not describe an India region of a foreign control plane as sovereignty. Score us on the same three columns.