On 20 October 2025, the Ministry of Communication, Digital Technology, and Innovations opened a consultation on the Data Protection Act, 2025, including data localisation requirements, until 31 October 2025. The Act would require data localisation if personal data is critical to national security, concerns national ID and civil registration systems, or involves children's data, biometric data, health records, and genetic data. While there is no general requirement for localising personal data, controllers would be required to make reasonable efforts to localise data, provided that it does not impair business or operations.
Original source