On June 26, 2019, the Reserve Bank of India issued clarifications to its fairly controversial data localisation order that required all data relating to payment systems to be stored in India (“Data Localisation Order” or “Order”). While the Data Localisation Order regulated entities that fell within the RBI’s ambit, the clarifications go a step further: the Order would now also apply to service providers, intermediaries, payment gateways, third party vendors and other entities in the payment ecosystem who are retained or engaged by regulated entities for providing payment services.

In a nutshell, the clarifications would require almost all participants in the payments sector to comply with data localisation norms. This would mean ensuring servers containing the details of payment transactions – for example, customer data, payment credentials, and transaction data – are located only in India, with no payment or financial data stored abroad.

The clarifications also address the treatment of data related to foreign transactions and transactions with both, foreign and domestic components:

• In the case of cross-border transactions with a foreign leg and a domestic leg, entities are permitted to store a copy of the domestic leg abroad, provided that a copy is retained in India.

• Payment transactions may be processed abroad. However, post this processing, all data in relation to the processing should be stored only in India. The timeline for complying with such storage requirement – and ensuring such data is deleted from systems abroad – is the earlier of 24 hours or one business day from the payment processing. All related processing activities (say, chargebacks) post the settlement of the processing should be undertaken with respect to the data stored in India, and any subsequent data would have to comply with storage requirements in India as well.

• Under the Order, foreign banks were permitted to store their data abroad. Now, these banks will be required to store data related to domestic transactions, and in the case of cross-border transactions, data relating to the domestic components, in India alone.

For any comments or queries, do reach out to us