Payments firms seek extension of RBI's October deadline for data localisation

With just two months left to move all their India-relevant data into the country, global data and payment companies have made representations to the Reserve Bank of India (RBI) seeking an extension of the deadline.

The banking regulator's six-month deadline for payment companies to comply with its data localisation rule ends in October.

Companies are also awaiting a clarification from RBI on whether they can continue storing information outside of India beyond October if the process isn’t complete.

The central bank wants the data companies and payment facilitators including Visa, MasterCard, Google and WhatsApp to host India-relevant data within the country by bringing oversight rules on par with what is prevalent in some of the other Asian countries.

RBI reviews

For now, the RBI is taking stock of the progress on a fortnightly basis. But it is yet to issue any extension or clarification on the same.

"They've asked us for fortnightly updates on the progress, which was there as part of the circular itself," said TR Ramachandran, Group Country Manager for India and South Asia, Visa.

Is Visa on track to meet the deadline? “Who knows? These are very very complex projects. As you know, the RBI circular was sometime in April, asking for compliance by October. So I think different companies are at different stages. I can't comment on specifically where we are,” he said.

In April this year, RBI said all payment companies were required to keep data only within India to ensure “unfettered supervisory access to data stored with these system providers.”

Ramachandran said Visa works with the industry on this. “Many companies have told the RBI that they will require more time, given the complexity. Different companies have different technology architectures. I think industry associations have made their presentations."

"The reality is we also have to keep data privacy and security and all those things in mind. There is a complex infrastructure..," he added.

Most of the companies have conveyed their inability to move all their data to India within the stipulated deadline.

Impact on customers and companies

This could also impact the Indian customers of these companies.

A senior private sector banker said, “We have millions of customers using our debit and credit cards facilitated by the payment firms. RBI may have to clarify what happens with our customers and what we need to do.”

Data localisation would come as a strong blow on the costs and additional work for foreign companies operating in India.

“To set up data centres in India from scratch would incur a lot of costs and time. Also, the regulations in our home countries may not permit us because of security reasons,” said one of the officials with a US-based payment firm.

However, the banker quoted above said, “I think it is only fair for the size and the economy that India is. Also, there is so much hue and cry on data globally and how the internet economy is moving cross borders without checks and restrictions. Hence it’s only fair that the transaction data is stored locally. Because the moment it goes outside, there will be little control on how this data will be used or rather misused as in Russia and US. It is only fair to follow the law of the land in any country you operate in.”

The government, however, is open to allowing companies to store their data outside the country while keeping a copy in India.

The government and companies await the green signal from RBI which is the final authority on matters related to payment systems.