Where the learner data lives is a procurement question, not a footnote.
Data residency has moved from an infrastructure detail to a contractual requirement — driven by India’s DPDP Act, GDPR transfer rules, and sector regulators with their own views. Here’s how residency works for training data, and the questions worth asking every vendor.
What actually needs to be resident, and why
The first useful step is scoping. A training platform holds employee identity fundamentals, enrollment and requirement state, practice responses, and derived measures. That’s personal data under DPDP and GDPR, so residency and transfer rules apply — but it isn’t the high-sensitivity category buyers often assume, and treating it as such can over-constrain an otherwise straightforward procurement.
The second step is contractual clarity. Residency claims are worth exactly what the agreement says: where primary storage sits, where backups sit, where support staff can access from, and what happens in a failover. Vendors that answer those four questions precisely are the ones whose residency posture will survive your legal review; vendors that answer with a region name are describing a data centre, not a commitment.
Scope the data before scoping the region
Knowing precisely which fields a training platform holds usually simplifies the compliance conversation — and lets your DPO apply proportionate controls rather than maximal ones.
Transfers, handled explicitly
Where any cross-border processing occurs — support access, subprocessors — it belongs in the DPA with the mechanism named. Silence here is the risk, not the transfer itself.
Your exit is part of your posture
Export formats, retention windows and deletion commitments matter as much as hosting location — residency without portability is just a nicer prison.
Data that stays onshore
Primary, replica and backups inside Indian regions, with the processing map your DPO can hand to a regulator.
| Component | Location | Status | Residency |
|---|---|---|---|
| Primary DB | Mumbai region | live | In-country |
| Replica | Hyderabad region | live | In-country |
| Backups | Mumbai region | daily | In-country |
| Support access | Logged + gated | always | Controlled |
Interface shown as an illustration with representative numbers, not a screenshot — the layout is the product’s.
Bring your DPO to the call.
Residency, subprocessors, transfers and deletion — answered specifically for your deployment rather than generically.
The evidence this page stands on
Questions buyers ask
Which regions can you host in?
Hosting options vary by deployment and contract. Rather than publish a claim that may not match your agreement, we’ll confirm precisely what’s available for your requirements — and put it in writing.
Does DPDP require Indian data localisation for training data?
The Act’s transfer provisions are narrower than early drafts suggested, and sector regulators layer their own rules. Your counsel decides your obligation; we’ll meet the configuration it implies where we can, and say so plainly where we can’t.
Who at the vendor can access our learner data?
Access is role-scoped and logged, limited to support and operations personnel with a business need. The specifics — roles, regions, logging — are documented for your review.
What about subprocessors?
A current subprocessor list is provided under the DPA, with notification commitments for changes. Ask for it during evaluation; any vendor reluctant to share one is telling you something.
How is data deleted at contract end?
Per contractual commitment: export first, then deletion within the agreed window across primary and backup systems, with confirmation. Get the window written down.
See it on your own content.
Bring one course. We’ll show you the retention curve your current training leaves behind — and what scheduled review does to it.
- 30 minutes, on your calendar — pick a slot here
- Run on your own content wherever possible, not a canned deck
- You see the dashboards, the learner surface and the evidence exports
- No commitment — and pilot data stays yours either way