Payment Start-ups Welcome RBI's Move to Store Data Within India RBI has asked payment operators to ensure their data is stored in India only within six months

It has been a whirlwind day for the Indian fintech ecosystem, with the Reserve Bank of India's Monetary Policy taking centre stage in the developments for the sector. While the crackdown on cryptocurrency was a major highlight, another move by the RBI was to secure the data of citizens transacting online.

The RBI has asked payment operators to ensure their data is stored in India only. This should be done within six months. While more details are awaited about how the companies will go ahead with the same, Indian payment start-ups are already welcoming the move.

Entrepreneur India spoke to payment operators and experts about how this move will affect the Indian payments ecosystem.

What the RBI said

Over the years, the Indian fintech space has seen a massive growth. Coupled with government interventions like demonetization and the encouragement of digital, there has been a spurt in the growth of payment-based start-ups. From merchants to consumers, everyone has been swiftly making the transition to digital only, with the help of payment apps. RBI has acknowledged the growth of these players. However in order to ensure a "healthy pace of growth in digital payments", the Central Bank deemed it necessary to have continuous monitoring and surveillance to reduce risks from data breaches.

In the release of the bi-monthly monetary policy, the RBI said, "It is observed that at present only certain payment system operators and their outsourcing partners store the payment system data either partly or completely in the country. In order to have unfettered access to all payment data for supervisory purposes, it has been decided that all payment system operators will ensure that data related to payment systems operated by them are stored only inside the country within a period of 6 months. Detailed instructions will be issued in this regard within one week."

Welcome Move

Entrepreneurs dealing in the payments space haven't shied away from acknowledging the RBI's move. In fact, they have welcomed it with open arms. Prabhu Ram, Group CEO & Managing Director, Payswiff, said, "It prevents merchant's data from being misused for any other purposes apart from payment processing. There are many countries which have already adopted this and India is catching up now."

Ram believes that almost all the players keep the data in India only and the RBI's move won't hinder the growth of these companies and in fact, it will increase the speed and security of transactions.

Meanwhile, Harshil Mathur, CEO and Co-Founder, Razorpay, believes that the mandate is necessary for data sovereignty so that we can form local laws around protection and control of individual's information. "Data belongs to the individual first, not only to the payment companies that collect it. It's therefore the government's responsibility to protect it and ensure safety and security of citizen's information. And one way to do that is by keeping it inside India's borders," he said.

With data security being a growing concern all over the world, most entrepreneurs believe that this move will just work in the favour of protecting the data of all their consumers.

Mathur added that once data moves outside the country then India's laws will no longer apply to the data stored in a foreign country. "We want our laws to apply to our data. Also with the recent incidents such as Facebook's data breach where massive amounts of data was misused, data sharing and online privacy have become key concerns for governments worldwide," he said.

Implications of the Policy

Before rushing into decisions, experts point out the fact that it is still unclear at this stage whether the requirement will extend to only licensed entities (such as wallet issuers) or also apply to the payment gateways and intermediaries. Shilpa Mankar Ahluwalia, Partner, Shardul Amarchand Mangaldas said, "A data localization requirement will have significant implications for global payment system players, many of whom are have centralized offshore data storage systems. Detailed rules are expected within a week."

We also reached out to the Payments Council of India and National Payments Corporation of India who didn't wish to comment on the development.