At the moment, you need to see IT act 2000 (duly amended) to see if you are in violation with the laws. I dont think we have strict localisation laws at this time other than for sensitive industries like banks, payment gateways, insurance, etc.
However, with the implementation of DPDPA, this will definitely be a problem and could result in fines of up to ₹ 250 crores. So it is a practice that should be stopped as soon as possible.