RBI - Storage of Payment System Data (Circular, 6 April 2018)
AI / PRIVACY / CYBER RELEVANCE
India's principal data-localisation mandate for payments data; it applies alongside, and is not displaced by, the DPDP Act's cross-border transfer rule.
AI: ContextualPrivacy: Very HighCybersecurity: High
READ FIRST
- Para 2(i) - entire payment system data stored only in India, with the foreign-leg exception
- Para 2(ii) - six-month compliance window and report by 15 October 2018
- Para 2(iii) - System Audit Report by a CERT-In empanelled auditor
- Para 3 - legal basis under the PSS Act, 2007
PURVIEW
Requires every payment system provider to store the entire data relating to the payment systems it operates in a system only in India. This covers full end-to-end transaction details and information collected, carried or processed as part of the payment message or instruction. For the foreign leg of a transaction, data may also be stored abroad if required. The stated aim is unfettered supervisory access to payment data held by system providers and by their service providers, intermediaries and third-party vendors. Providers had six months to comply, reporting to RBI by 15 October 2018, and had to file a Board-approved System Audit Report by a CERT-In empanelled auditor by 31 December 2018.
Classification and legal status. Circular RBI/2017-18/153, DPSS.CO.OD No. 2785/06.08.005/2017-2018 dated 6 April 2018 to all authorised payment systems and banks, issued under Section 10(2) read with Section 18 of the PSS Act, 2007.