With less than a month to go before the Reserve Bank of India’s new data localisation rules kick in, the industry is still awaiting clarity on the final stance taken by the regulator.
In response, the RBI representative said a clarification may be issued soon, showed the minutes. However, there has been no clarification so far.
AP Hota, former chief executive officer of National Payments Corporation of India, noted that data mirroring is a middle-ground. Should that be accepted by the RBI, an extension in the deadline may not be required.
Some companies are still seeking clarity, some want an extension of the deadline, and some are seeking a rectification, Supratim Chakraborty, Associate Partner at law firm Khaitan & Co told BloombergQuint. At this stage, it appears that such discussions, deliberations and lobbying will continue, Chakraborty added.
American Express, Mastercard and Visa declined to comment. The USIBC also said that it would not be commenting on the issue at this point of time. An email sent to the RBI was not answered.
A Two-Sided Debate
There are arguments on both sides of the debate.
Data localisation with the specific policy of ‘only in India’ may not be practical, said Navin Surya, Chairman Emeritus of the Payments Council of India. Entities taking full responsibility for security and privacy of data they store, should do, he added.
Others say that the RBI move maybe a disincentive for global companies to build products for India.
Global technology companies usually look to normalise user experience across the world, said an expert in the space of payments technology, who spoke on condition of anonymity. This person added that should the RBI insist on data storage only in India, global firms would need to decide whether they want to build a local product conforming to those requirements.
Others say the regulator’s concerns are genuine.
Payment applications can create a digital profile of a person in entirety. The RBI is right in its concern about where this data resides and what’s made out of it, says Puneet Bhatia, a fintech expert who formerly worked with a large consulting firm.
Bhatia pointed to the fracas around Cambridge Analytica to highlight this concern.
Imagine the possibilities for misuse of user profiles like we have seen in case of Cambridge Analytica. With data located offshore, what recourse would the RBI then have?Puneet Bhatia, Independent Fintech Expert
The Possible Fallout
Should the RBI hold on to its stance that payments data must be stored only in India, some firms could see temporary disruptions in services while others may see an increase in costs.
Vivek Belgavi, partner at PwC India explained that part of the decision to store data outside India is linked to costs. “As cost of processing falls with higher volume, most international and some Indian operators choose to outsource data processing to centers outside the country,” he explained while adding that eventually data can be moved onshore if required.
Technologically, moving data to Indian servers and data centers is possible. Several such facilities are already in operation in India and operators could choose between setting up their own data center or leasing out an existing facility.Vivek Belgavi, Partner, PwC India
However, the cost to set up a new data center may be significant, added Bhatia. Apart from land, people and uninterrupted supply of electricity, you need top-end cyber security and seamless infrastructure, he explained.
In the event that global card companies are unable to comply with the rules in time, there could be some disruption in services. This, in turn, could lead to another jump in usage of e-wallets by India operators, explained Kalpesh Mehta, financial services expert and Partner at Deloitte.
To avoid a disruption to services, particularly card services, an extension of the deadline may be necessary, said Bhatia. A six month deadline may be unrealistic, he said.
RECOMMENDED FOR YOU
POPULAR