I think the point they are making hinges on the fact that the data just has to be _stored_ there. You can do the processing outside of India, so a company can store the encrypted data in India but process the decrypted data elsewhere.