Expert · Cloud security and compliance · topic 46 of 50 · 30 min
Compliance in the cloud, with Indian rules
Explanation
What compliance means
Compliance means following the laws, regulations and standards that apply to your business, and being able to prove it with evidence. Security is doing the right things; compliance is showing an auditor or regulator that you did them, consistently. This topic is general information to help you ask the right questions, not legal advice. Always confirm with your company's legal or compliance team.
Shared responsibility for compliance
The shared responsibility model from Module 1 applies to compliance too. AWS, Microsoft and Google are audited for their part: data centres, hardware, the hypervisor and their managed services. Your auditor can rely on those reports for that part (these are called inherited controls). Everything you configure is yours to prove: IAM, encryption settings, logging, network rules, backups and how your app handles personal data. Running on a PCI DSS compliant cloud does not make your app PCI DSS compliant.
The main global frameworks
| Framework | What it covers | Who asks for it |
|---|---|---|
| ISO/IEC 27001 | An information security management system: policies, risk assessment, controls, continual improvement. Certified by an accredited body | Enterprise customers worldwide, many Indian IT services clients |
| SOC 2 | An auditor's report on controls for security, availability, confidentiality and more (Type II covers a period, usually 6 to 12 months) | US and global SaaS customers |
| PCI DSS | Rules for anyone who stores, processes or transmits payment card data | Card networks, banks, payment gateways |
| HIPAA | US law protecting health information | US healthcare clients, common for Indian BPOs and health-tech |
| GDPR | EU law on personal data of people in the EU | Any company serving EU residents |
You download the provider's own audit reports from AWS Artifact, the Microsoft Service Trust Portal, or Google Cloud's compliance reports manager. AWS Artifact also holds agreements such as the HIPAA Business Associate Addendum.
Indian rules you should know
- Digital Personal Data Protection (DPDP) Act, 2023, with rules notified in 2025 and obligations phasing in. The organisation that decides why and how personal data is processed is the data fiduciary; the person is the data principal. Key duties: clear consent, using data only for the stated purpose (purpose limitation), reasonable security safeguards, notifying the Data Protection Board and affected people of a personal data breach, and erasing data when it is no longer needed. Penalties can reach ₹250 crore per breach of certain duties.
- CERT-In directions of 28 April 2022: service providers, data centres, body corporates and government bodies must report specified cyber incidents to CERT-In within 6 hours of noticing them, and keep logs of their ICT systems for a rolling 180 days within India. Clocks must be synchronised with the official NTP time sources.
- RBI directive of April 2018 on storage of payment system data: payment system operators must store the entire data of payment systems only in India. The RBI FAQs describe narrow exceptions, such as the foreign leg of a cross-border transaction and processing abroad with the data brought back to India quickly. Read the circular and FAQs for details.
- MeitY empanelment: government departments generally buy cloud services that the Ministry of Electronics and IT has empanelled after an audit. If you build for government, check that the provider and the specific services are empanelled.
- Sector regulators such as RBI, SEBI and IRDAI also publish outsourcing and cloud guidelines for the entities they regulate.
Data residency through region choice
Data residency means keeping data in a particular country. In the cloud, you get it mostly by choosing regions: AWS Mumbai (ap-south-1) and Hyderabad (ap-south-2), Azure Central India (Pune), South India (Chennai) and West India (Mumbai), and Google Cloud Mumbai (asia-south1) and Delhi (asia-south2). Then make sure nothing copies data out: backups, cross-region replication, logs, analytics exports and support tickets with attached data. An SCP that denies non-Indian regions (from the first topic) turns this into a guardrail.
Evidence and retention
Auditors want evidence that controls work all the time, not on audit day. AWS Config records resource settings and checks them against rules; conformance packs bundle rules for a standard. AWS Audit Manager collects evidence mapped to frameworks. On Azure, Azure Policy assigns rules and shows a compliance score; on Google Cloud, Security Command Center and organisation policies do similar work. Retention is how long you must keep records: 180 days of logs for CERT-In, often years for financial records. S3 lifecycle rules move old logs to cheaper storage classes, and S3 Object Lock makes them unchangeable for the retention period.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Compliance in the cloud, with Indian rules · 1/7
Compliance means following the rules that apply to your data, and proving it with evidence. This is general information, not legal advice.
Prefer a video by a teacher? Find free videos on “cloud compliance India DPDP Act CERT-In directions RBI data localisation explained” on YouTube ↗
In real life: A payment aggregator in Pune gets audit-ready
A payment aggregator applying for RBI authorisation runs on AWS in ap-south-1 with disaster recovery in ap-south-2. An SCP blocks all other regions. Card data is handled only through a PCI DSS compliant tokenisation provider, which shrinks the audit scope. CloudTrail, VPC Flow Logs and application logs go to a separate log-archive account with S3 Object Lock set to 400 days, beyond the 180 days CERT-In requires. AWS Config conformance packs check encryption, public access and MFA, and the dashboard is exported monthly as audit evidence. The incident runbook includes the CERT-In reporting contact and a DPDP breach-notice template, reviewed by their lawyer.
Practice (0/3 done)
Where do you download AWS's own SOC 2 and ISO certification reports?
A fintech startup in Mumbai is building a UPI-based bill payment app on AWS and will store UPI transaction data and customer personal data. Write a compliance checklist for its cloud setup: which rules apply, where data lives, what is logged and for how long, how incidents are handled, and what evidence you will keep. (This is a learning exercise, not legal advice.)
Write residency_violations(resources, allowed) for a data-residency check. resources is a list of dicts with "name" and "region"; allowed is a list of permitted regions. Return the names of resources whose region is not allowed, in the given order. Resources whose region is "global" (for example IAM or Route 53) are ignored.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Encryption, keys and secretsCloud security and compliance · same module
- Identity is the new perimeterCloud security and compliance · same module
- India: the DPDP Act 2023 and CERT-In directionsCyber Security: from zero to SOC analyst · Governance, risk and compliance
- GRC and risk managementCyber Security: from zero to SOC analyst · Governance, risk and compliance
- India: CERT-In and the legal landscapeEthical Hacking and Penetration Testing (legal labs) · Bug bounties, disclosure and careers
- The shared responsibility modelCyber Security: from zero to SOC analyst · Cloud security basics
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Under the CERT-In directions of April 2022, how quickly must specified cyber incidents be reported?
Answer: Within 6 hours of noticing them
The directions require reporting within 6 hours of noticing the incident or being told about it.
For how long do the CERT-In directions require ICT system logs to be kept, and where?
Answer: 180 days, within India
Logs must be kept for a rolling 180 days within Indian jurisdiction.
Your app runs on AWS, which is PCI DSS certified. Is your card-payment app automatically PCI DSS compliant?
Answer: No, you must meet and prove the requirements for your own part
Provider certification covers the provider's part. Your configuration and app need their own controls and assessment.
Which statement about the DPDP Act 2023 is correct?
Answer: It requires consent and purpose limitation, and penalties can reach ₹250 crore
The Act places duties on data fiduciaries, including consent, security safeguards and breach notification, with large penalties.
What is the main way to achieve data residency in India on AWS?
Answer: Choosing Indian regions and making sure backups, logs and replicas stay there too
Region choice gives residency; you must also stop copies leaving the country.
How long must ICT system logs be kept under the CERT-In directions?Related
Answer: A rolling 180 days, within India
Logs for 180 days, maintained within Indian jurisdiction.
Restoring files from backup after ransomware is which control type?Related
The safe assumption about CERT-In rules and timelines is that they…Related
Answer: Can change, so check official sources
Always verify the current directions.
Does the provider's ISO 27001 certificate cover your own cloud configuration?Related
Answer: No, it covers the provider's responsibilities only
Your configuration is your responsibility and needs its own controls.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- This is the last topic of “Cloud security and compliance”. The module exam comes next.
- Module 11 exam: Cloud security and compliance · 14 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Certifications and cloud careers. 50 topics left in the course before the final exam.