Your Terraform decides where personal data lives. Does anyone check?
DPDPA §16(1) governs personal data leaving India. A cloud resource in the wrong region is a transfer, made in a config file, that no security scanner flags because it is not a vulnerability.
Security scanners check encryption. None of them check the region.
checkov, tfsec and trivy check IAM, public access and secrets. Residency is a policy your company holds, so it has no CVE, so it is not on their list.
In an 88-line Terraform file the state bucket can sit in Oregon, the log group in Virginia, the read replica in Ohio and the backup vault in Canada. Each one looks fine on its own.
The transfer is discovered when someone asks for the data-flow map, months after the resource was created, by reading the console rather than the code.
Four controls, read from the infrastructure code.
Every provider "aws" block whose region is outside ap-south-1 (Mumbai) or ap-south-2 (Hyderabad). Personal data written by that provider lands outside India.
Every resource whose location is outside centralindia, southindia or westindia. Checked per resource, not per subscription, because one module can quietly place a database elsewhere.
Provider aliases, backend state buckets, and regions buried in destination ARNs. A linter that reads one file at a time misses them; the scan resolves them across the repository.
CloudTrail configured for a single region misses every event that happens outside it. Flagged so the audit trail covers what the residency rule is meant to protect.
Every finding cites DPDPA §16(1) and names the resource, the file and the line, so the fix is a one-line change rather than an investigation.
A region is only a problem if personal data goes there.
The same scan traces which personal data the application collects and where it writes it. A misplaced cache of session tokens and a misplaced patient table are not the same finding.
Regions are ranked by the sensitivity of the data the code sends to them, so the resource holding Aadhaar numbers is at the top and the one holding feature flags is not on the list.
The result is a record of every regulated store and its region, generated from the code at a named commit. It is the artifact the residency clause of an audit asks for.