HR systems hold some of the most sensitive personal data a company has: salaries, bank details, identity documents, health declarations, performance ratings and exit records. For a long time, where that data physically sat was treated as a technical detail. In India, that is changing quickly, and in our view HR leaders need to start treating data location as a business decision.

Three forces are behind this shift.

To be clear, the DPDP Act does not require all personal data to be stored in India. It allows transfers abroad unless the government restricts a country [3]. But that list can change, sectoral regulators have their own rules [4], and foreign laws can reach data held by foreign-owned providers wherever it sits [8]. Our conclusion is that for most Indian employers, an HR system that stores and processes data in India, on infrastructure answerable to Indian law, is the lower-risk and more future-ready choice. This is what we mean by sovereignty in HR tech: employee data that is stored, processed and governed under Indian law, on infrastructure that does not depend on anyone else.

This is the third paper in our series on the future of HR. In the second, HR in the Age of AI: What Really Changes, we looked at how AI is reshaping HR's work and argued that trust and governance now sit at the centre of the HR agenda. This paper takes that thread further and asks a practical question every Indian employer will face: where should HR data live, and why does it matter?

Under the DPDP Act, an employer is a data fiduciary for everything it holds about its people. HR is usually the biggest single holder of that data, from candidate CVs and offer letters to payroll, attendance, appraisals and exit interviews.

The Rules were notified in November 2025, with an 18-month phased compliance timeline [1]. Among the obligations are reasonable security safeguards and the reporting of personal data breaches, including to the Data Protection Board within 72 hours [18]. Full compliance applies from May 2027 [2], and the Act sets a penalty of up to ₹250 crore for failing to take reasonable security safeguards [17].

Sources: [1][2].

It is equally important to be clear about what the Act does not say. It does not require all personal data to be stored in India. Section 16 follows a negative-list approach: data may be transferred to any country unless the central government notifies it as restricted [3]. That power itself takes effect only in May 2027, and as of September 2026 no country had been restricted [3]. Sectoral regulators such as RBI, SEBI and IRDAI, however, can and do impose stricter rules, and these continue to apply alongside the DPDP Act [4].

So the honest answer is this: Indian law does not force an HR system to sit in India today. The rest of this paper explains why, in our view, it should anyway.

If the law allows transfers abroad, why should an Indian employer care where its HR software keeps data? From what we see across client engagements, there are five practical reasons [13].

1. The rules can tighten, and HR data is a likely target

The negative list under Section 16 is a moving part. The government can restrict a country at any time once the provision is in force [3]. Employee data, with its mix of financial, identity and health details, is exactly the kind of information policymakers tend to protect first. An HR system already hosted in India does not need to be re-architected if the rules change. One hosted abroad might.

2. Sectoral rules already apply to many employers

Banks, NBFCs, insurers, payment companies, brokers and telecom operators all work under their own data rules, and these sit on top of the DPDP Act [4]. For employers in these sectors, HR data often travels with other regulated data through shared systems and integrations. Keeping it in India removes one more question from every audit.

3. Location and jurisdiction are not the same thing

A server in Mumbai does not on its own guarantee that data is answerable only to Indian law. Under the US CLOUD Act, American authorities can compel US-based providers to hand over data in their possession, custody or control, regardless of where it is stored [8][19]. India does not have an executive agreement with the US under this law [8]. For HR data, the question to ask is therefore not just "where is the server?" but also "who owns and operates it, and whose courts can reach it?"

The same question applies to the physical infrastructure. Between 2020 and April 2025, India attracted $14.7 billion in data centre investment, and foreign institutional investors put in nearly 86 per cent of it [16].

Source: Colliers [16].

Foreign capital has built much of the capacity India now relies on, and that is no bad thing. It does mean, however, that "the server is in India" is where due diligence on HR data should start, not where it ends.

4. AI multiplies the places data goes

When an HR system adds AI features, employee data is often sent to a separate model provider for processing. Each such step is one more place where data is stored or seen, sometimes outside India and outside the main contract. We cover this in more detail in the next section.

5. Trust is easier to earn when the answer is simple

Employees are becoming more aware of their data rights, and the DPDP Act gives them clear rights to access, correct and erase their data [3]. Being able to say, plainly, that their payslips, ID documents and appraisals stay in India is a simple and credible answer. In our experience, simple answers build more trust than long privacy policies. Guarding trust and fairness is one of the five areas of HR work we set out in Future HR Mandates: Who Carries Them, and where data lives is now very much part of it.

India has taken to AI faster than most countries. 92 per cent of Indian knowledge workers use AI at work, compared with 75 per cent globally, and 91 per cent of Indian leaders say their company needs AI to stay competitive [5]. Yet 54 per cent of those leaders worry their organisation has no plan for it [5], and 72 per cent of employees bring their own AI tools to work [6].

For HR, this creates a quiet problem. The most useful AI features in HR software, such as summarising appraisal comments, screening CVs, answering policy questions or flagging attrition risk, all need employee data to work. If the HR system sends that data to an outside AI provider, the company now has employee data sitting with a party it may not have assessed, possibly outside India, under terms it did not negotiate.

This is not a hypothetical risk. In an August 2025 survey of 1,003 employed adults in the US, 59 per cent said they use AI tools their employer has not approved, and three-quarters of those, or 44 per cent of everyone surveyed, said they may have shared sensitive information, such as employee data, with these tools [15]. With 72 per cent of Indian knowledge workers bringing their own AI tools to work [6], there is little reason to think the picture in India is very different.

Sources: Microsoft and LinkedIn, India [6]; Cybernews, US [15].

India's infrastructure is catching up quickly with this demand. Data centre capacity is expected to grow from 2.2 GW in 2025 to 12 GW by 2030, and capacity built for AI is set to rise nearly 24-fold over the same period [7]. Running AI on Indian soil is becoming practical, not just possible.

Source: Wood Mackenzie [7]; shares calculated by Interloop.

Put another way, AI is expected to grow from about one-eighth of India's data centre capacity to more than half within five years [7]. Much of the AI that HR teams will use is going to run on Indian soil anyway; the choice is whether employee data runs alongside it.

In our view, the principle for HR is straightforward. The AI should come to the data, not the data to the AI. An HR system whose AI runs on the same infrastructure, in the same country, as the employee records gives the company one data boundary to manage instead of several.

Putting the last three sections together, we see six qualities that HR software serving Indian employers will increasingly need. We have kept these vendor-neutral on purpose; any provider can be measured against them.

To show what these qualities look like in practice, we have taken Zoho as an example. Its HRIS, Zoho People, is one we often come across in client environments [13]. It covers core HR, attendance, leave and performance management, and works alongside Zoho Payroll. Zoho's HR software is a useful case here because the company's approach to infrastructure is quite different from most providers.

Data in India. Zoho's published data centre information lists Mumbai as the primary and Chennai as the secondary data centre for its Indian customers, with ISO 27001 and SOC 2 Type II among the certifications listed for Mumbai [14]. Zoho's founder has also stated publicly that Indian customer data is hosted in India, at facilities in Mumbai, Delhi and Chennai with another planned in Odisha, and that the company runs more than 18 data centres worldwide, keeping each region's data in that region [9].

Its own infrastructure. Most software providers rent servers from large public cloud companies. According to Zoho, its products are not hosted on AWS, Azure or Google Cloud; third-party cloud services are used only for routing traffic, and no customer data is stored on them [9]. Zoho's product documentation describes this as infrastructure that Zoho owns and operates [10]. Its data centre page also refers to co-location facilities, so the precise description is that Zoho runs its own servers and software stack inside data centre facilities, rather than renting public cloud capacity [14].

AI that stays inside. In 2025, Zoho launched Zia LLM, a large language model built in-house and deployed in its own data centres in the US, India and Europe, so that customers can use AI without sending their data to outside AI providers [11]. The company has said one reason for building its own model was to avoid becoming dependent on outside LLM providers [12]. According to its documentation, AI processing runs within the same regional infrastructure as the customer's data [10].

Independence. Zoho is headquartered in Chennai, where its products are developed [9], and it runs its own infrastructure and AI models rather than depending on a public cloud or an outside AI provider for its core service [10][11].

Measured against the six qualities in the previous section, this combination of Indian hosting, self-run infrastructure and in-house AI places Zoho People in a strong position for Indian employers preparing for the DPDP regime. For companies already using Zoho for HR, it also means that adding AI to HR management does not have to mean sending employee data somewhere new. Other providers also offer Indian hosting, and we would encourage every HR leader to test any shortlisted vendor against the same questions.

Disclosure: Interloop is a Zoho Authorized Partner.

Whether you are choosing a new HRMS or reviewing the one you have, these questions will tell you a great deal in a single conversation.

This is the third paper in our research series on the future of HR, following Future HR Mandates: Who Carries Them and HR in the Age of AI: What Really Changes. The views here are Interloop's own, shaped by our client engagements and internal discussions among our practitioners [13]. This paper is for general information and is not legal advice; employers should take legal counsel on their specific DPDP obligations.

Method. This paper combines published research, primary legal texts and Interloop's practitioner view. Between September and October 2026, we checked each statistic against its original publisher's report or release, and each legal point against the text of the Digital Personal Data Protection Act, 2023, official Government of India releases and the US statute. Where a point rests on legal commentary or a secondary report, the reference says so. Statements about Zoho are taken from Zoho's own published material or public statements by its leadership, and are attributed accordingly.

Limitations. This paper is not legal advice. Some statistics come from US surveys and are labelled as such. Regulatory positions are correct as of October 2026 and may change, particularly once Section 16 of the DPDP Act takes effect.

Interloop Research Team