Your ₹20 UPI payment is not allowed to leave India. That rule built buildings

You are standing at a chai stall at the end of the day. The glass is ₹20. You hold your phone over a laminated QR code, type four or six digits, and before the glass has cooled enough to drink, the stall owner's phone announces the payment out loud. A few seconds, start to finish.

You are not alone in that gesture. In September 2026, UPI carried 24.07 billion payments, an average of 802 million a day, the highest daily average it has recorded, according to NPCI's own statistics as reported by Business Standard.

Here is the part nobody tells you at the stall. The record of that ₹20, who paid, who received, from which account, at what second, is not allowed to live outside India. Not as a preference. As a rule, written by the Reserve Bank of India in April 2018.

And that rule, more than any incentive scheme, is one of the reasons India now has a data-centre industry at all.

What happens in the seconds after you scan

Your ₹20 passes through four hands in those few seconds.

The first is the app on your phone. In UPI's language it belongs to a payment service provider, or PSP: the company or bank whose interface you are using. It packages your request and passes it on.

The second is NPCI, the National Payments Corporation of India, the not-for-profit set up by the RBI and the Indian Banks' Association to run retail payment systems. NPCI runs the central UPI switch, which every UPI payment passes through. The World Bank's case study of UPI lays out the order: the switch asks the payee's side to confirm who the money is going to, asks your bank to debit you, then asks the stall owner's bank to credit them, and finally sends the confirmation back to your phone.

The third and fourth are the two banks. Your bank checks your PIN and moves the money out. The stall owner's bank moves it in.

Each of them keeps a record of what passed through its hands. That is the point. Each is a payment system provider or a participant in the chain, and each now has a storage obligation.

Where the switch physically sits

NPCI does not publish a map of its servers, and you should be wary of anyone who claims to know which building handles your payment tonight. What is on the public record is this.

In 2020, NPCI announced its own data centre in the SIPCOT IT Park at Siruseri, Chennai, built to the Uptime Institute's Tier IV standard, Medianama reported. The same year it laid the foundation for a second, at Narsingi on the edge of Hyderabad, an estimated ₹500 crore facility designed for 99.995% availability, ETGovernment reported. Before these, NPCI was reportedly leasing capacity from a third party.

By 2023, NPCI's deputy CTO told the Bharat Fintech Summit that its own data centres in Chennai and Hyderabad could handle 50 to 70 billion transactions a month, according to iTnews Asia. Its security chief told the Times of India the same year that UPI's infrastructure was spread across two locations with a third in the works, that it ran on-premise with no private cloud, and that NPCI always built three to five times the average load.

So the honest version of the chain is: your phone, your app's bank, a switch that runs in NPCI's own facilities in the south, your bank's systems, the stall owner's bank's systems, and the backups each of them keeps. Every one of those sits in a building in India, because it has to.

The rule that keeps your receipt at home

On 6 April 2018, the RBI sent a circular to every authorised payment system and every bank, from the largest commercial lender to district co-operative banks. Its core instruction fits in one sentence.

The RBI gave them six months, asked for compliance reports by 15 October 2018, and demanded a system audit by a CERT-In empanelled auditor by 31 December 2018. The circular gave its reason plainly: the regulator wanted "unfettered supervisory access" to payment data.

The RBI's FAQ on the directive, dated June 2019, spells out what "entire data" means. It covers customer data such as name, mobile number, Aadhaar and PAN; payment-sensitive data such as account details; credentials such as OTPs and PINs; and transaction data such as the reference, timestamp and amount. It reaches beyond the regulated firm to its service providers, gateways and third-party vendors.

There is one door left open, and it is narrow. A payment can be processed abroad. But the data must then be deleted from the foreign systems and brought back to India "not later than the one business day or 24 hours from payment processing, whichever is earlier." For a genuinely cross-border payment, a copy of the domestic leg may also be kept abroad.

Read that again with your ₹20 in mind. A purely domestic payment's record must end up stored only in India, every time, for every one of those 802 million daily payments.

Hard rules and soft rules

There are two ways a country can keep data at home, and the difference matters for anyone building data centres.

Hard localisation says the data may not be stored outside the country at all. Soft localisation says a copy must be kept at home, or that transfers are allowed by default unless the government closes a door. The RBI's rule is the hard kind: stored only in India.

Payments are not the only sector with a hard rule. On 6 March 2023, SEBI's cloud framework told stock exchanges, brokers, depositories and fund houses using cloud services that their data "should reside/be processed within the legal boundaries of India," and only with cloud providers empanelled by MeitY, as the circular's text_1678453860.pdf) circulated by NCDEX shows.

The national privacy law is, so far, the soft kind. The Digital Personal Data Protection Act was enacted on 11 August 2023, and its Rules were notified in November 2025, PIB records. Section 16 lets the government restrict transfers to countries it notifies, which is a blacklist rather than a ban. Rule 13(4) is harder: it lets the government require Significant Data Fiduciaries, large or sensitive data handlers that it designates, to keep specified categories of personal data, and the traffic data about their flow, inside India.

But that machinery is not yet switched on. As of 7 October 2026, no data had been specified under Rule 13(4) and no committee constituted to recommend it, according to a review of MeitY's published documents by dpdprules.org, and these provisions fall in the group computed to commence in May 2027. MeitY proposed in early 2026 to bring the Significant Data Fiduciary provisions forward, Chambers and Partners reported; no amending notification had appeared by the end of September.

The anchor tenant

Here is the analogy to hold on to. When a developer builds a shopping mall, the money does not arrive because the land is pretty. It arrives because a big department store signs a lease first. That anchor tenant makes the building bankable, and the smaller shops follow.

Indian data centres had an anchor tenant before they had a national policy. The RBI's rule arrived in 2018. Infrastructure status for data centres arrived in 2022. A national data centre policy drafted by MeitY in 2020 was never notified, as CEEW noted in February 2026, and CEEW lists data localisation mandates among the primary drivers of demand.

The occupiers tell the same story. On JLL's count, banking, financial services and insurance took 18% of occupied data-centre capacity in 2024, and JLL's India lead described a "regulation driven surge" in that demand. CBRE, in its October 2026 update, names Navi Mumbai and Siruseri as preferred destinations for BFSI institutions, as reported by NBM&CW. Siruseri is the same IT park where NPCI built its Chennai facility.

How big could the localisation effect get? KPMG's July 2026 report says data localisation is expected to add 1,800 to 2,000 MW of data-centre demand by 2027, citing an Economic Times article. Hold that number loosely. KPMG ties it to the DPDP Act, whose localisation clause, as above, has not yet been switched on. And it is roughly the size of India's entire operational capacity today, which CBRE expects to reach about 2 GW by the end of 2026.

So the claim worth keeping is the structural one, not the megawatt one. India's data-centre industry was pulled into existence by compliance as much as by courtship. The world's largest real-time payments system signed the first lease, by law, and everything else built around it.

What we don't know

• How much capacity payments actually occupy. NPCI does not publish the megawatts its facilities draw, and no house splits Indian capacity by regulation-driven demand.
• What the government will localise next. Rule 13(4) can turn soft localisation hard for designated firms, but the categories of data have not been named.
• What the fee change does. From 15 October 2026, NPCI introduced a merchant fee on select UPI payments, with small merchants exempt, Business Standard reported. Fewer or bigger payments would change how much data the system writes, not where it must live.

Next time you read that a new data centre has opened in Navi Mumbai or Siruseri, ask one question before you read the investment figure: which rule is this building here to satisfy?