Payment firms wait on RBI clarity on data localisation

NEW DELHI | BENGALURU: The Reserve Bank of India (RBI) is expected to clarify its stand on the data localisation mandate for payment companies – given the concerns raised by various industry groups on the issue.

According to a top official source, it could either reiterate its April order maintaining that payment firms have to store data in India within six months by releasing just a FAQ, or it could soften its stand by allowing firms to mirror the data outside the country keeping a copy in India.

“Perhaps, there could be an extension of the deadline of the implementation,” said the official who did not wish to be identified. The clarification is expected anytime soon, added the person, without setting a timeline. Since its notification, the banking regulator has met with multiple industry bodies, lobby groups and even chamber of commerce representatives on the data storage norms, even individual companies like Visa, Mastercard and American Express.


Sources also point out that the Central Bank seemed unlikely to budge from its present position.

The April directive from RBI to store all user data on servers within India, by October, has sharply divided the industry. While local companies such as Paytm and Flipkart-owned PhonePe have welcomed the move, global technology firms have voiced strong concerns over it. Nisha Biswal, President, US-India Business Council said that it “respectfully requests a reversal or an indefinite stay” on the move.

While biggest concern of the opposing side is that the RBI did not consult them before releasing the order, the clause where they the regulator has asked for data to be stored “only” in India is said to be the biggest challenge with majority of industry bodies asking RBI to review or withdraw this condition. A mail sent to RBI seeking comments went unanswered till the time of going to press. Two bankers in the know said that the RBI will not budge on the data storage norms nor extend the six months deadline.

The bankers said since India is a massive country, companies should not have to create a disaster-recovery site outside the country and there are safer geographies where such data can be housed. “For a country like Hong Kong which is a small island nation to have a disaster-recovery site in Singapore makes sense, but for India there are multiple locations available where data can be held safely,” said one of the bankers mentioned above. The banker quoted above said that since India is moving towards digital channels, the risk factor of such large amount of financial data sitting outside the country is getting higher, which justified RBI’s mandate of localisation.