Visa, MasterCard, Amex Breach RBI’s Data Localisation Deadline

Global payments companies are facing a challenge in storing transaction data for all Indians within the country.

Image used for representational purposes.

(Photo: iStock)

Global credit card and payments companies like American Express, Visa and MasterCard are facing a challenge in meeting a requirement to store transaction data for all Indian customers within the country.

A new rule took effect on Tuesday, 16 October, that directs payment companies to store all transaction data on computers inside the country.

Enacted in April by the Reserve Bank of India (RBI), the law gave payment companies six months to ensure transaction data of Indian customers was kept within the country to "ensure better monitoring" and "unfettered supervisory access to data."

However, the directive clarified that data for foreign parts of such transactions can be stored outside India.

It was unclear if foreign payment vendors like American Express, Visa and MasterCard had met the deadline or if India's central bank would take any immediate action for non-compliance. Reserve Bank of India officials would not comment.

PTI reported that some global financial technology companies had sought an extension to the deadline, although most have complied.

India has a competitive market for payments and the new rules have been welcomed by domestic companies like Paytm.

A local payments system, called the Unified Payments Interface, accounts for nearly half the value of credit and debit card transactions in the country.

‘New Law Undemocratic’

Regulators are striving to use such tools to help bring more Indian citizens, who traditionally have mostly bought and sold things using cash, into the formal, online economy.

Critics of the new law called it "undemocratic and hastily executed policy matter."

“Such unilateral moves impact the trust in India as a market,” said Nikhil Pahwa, a digital rights activist who has tracked payment industry for over a decade in India.

"Data localisation is essentially a move to enable government surveillance in a country that doesn't have data protection law or surveillance law. This is terrible for consumers," said Pahwa, who is also founder of a portal that covers technology and social media policy.