RBI’s Data Localisation Mandate: A Critical Evaluation and Call for Review

Key Takeaways:

1. Lack of Consultation: The RBI’s data localisation mandate was issued without extensive consultation with stakeholders, missing an opportunity to explore alternative solutions and understand the potential impact on various stakeholders.

2. Impact on Stakeholders: The mandate exposes Indian financial service providers to reciprocal measures in the countries they operate in or plan to enter, potentially leading to similar data localisation mandates being imposed on Indian firms in other jurisdictions.

3. Regulatory Uncertainty: The mandate creates regulatory uncertainty and may deter investment flows from the global venture capital industry into India’s financial technology/services industry.

4. Incongruity with Government Priorities: The mandate contradicts the government’s recent pivot towards enabling autonomy for data management under the draft Digital Personal Data Protection Bill, 2022, potentially inhibiting investments.

The Reserve Bank of India’s (RBI) data localisation mandate and argues that it should be reviewed due to various reasons. The mandate requires payment system operators (PSOs) to store domestic payments data exclusively in India. The article highlights several concerns regarding the mandate, including the lack of consultation with stakeholders, potential impact on Indian financial service providers operating abroad, and incongruity with the government’s recent pivot towards enabling autonomy for data management under the draft Digital Personal Data Protection Bill, 2022.

The key points and concerns raised in the article:

1. Lack of Consultation: The article emphasizes that the RBI’s data localisation mandate was issued without extensive consultation with stakeholders. It suggests that the mandate should have been prefaced with a consultative process, including discussions with industry stakeholders and civil society. The absence of such consultation is seen as a missed opportunity to explore alternative solutions and understand the potential impact on various stakeholders.

2. Regulatory Access and Supervision: The article questions the necessity of the data localisation mandate in light of existing powers granted to the RBI under the Payment and Settlement Systems Act (PSSA), 2007. It argues that the RBI already had the power to access payments data regardless of its location and conduct audits and inspections. Therefore, it raises concerns about the specific supervision bottlenecks that the localisation mandate aims to address.

3. Impact on Stakeholders: The article highlights the potential risks and obstacles faced by Indian financial service providers operating abroad due to the data localisation mandate. It suggests that the mandate exposes these providers to reciprocal measures in the countries they operate in or plan to enter, potentially leading to similar data localisation mandates being imposed on Indian firms in other jurisdictions.

4. Global Expansion and Regulatory Uncertainty: The article discusses the impact of the mandate on the global expansion of Indian financial entities, such as the National Payments Corporation of India (NPCI), Indian banks, and fintech startups. It argues that the mandate creates regulatory uncertainty and may deter investment flows from the global venture capital industry into India’s financial technology/services industry.

5. Incongruity with Government Priorities: The article points out the incongruity between the RBI’s data localisation mandate and the government’s recent pivot towards enabling autonomy for data management under the draft Digital Personal Data Protection Bill, 2022. It suggests that the mandate contradicts the government’s priorities and creates regulatory uncertainty, potentially inhibiting investments.

6. Recommendations for the Future: The article concludes with recommendations for the future regulatory framework, including the repeal of the mandate in favor of more moderate means of securing regulatory access to payments data, data storage autonomy for financial intermediaries operating in India in countries not on a ‘negative list’, and the primacy of permissive data storage policies available under the Digital Personal Data Protection Act over insular sectoral regulations.

In summary, the article presents a critical analysis of the RBI’s data localisation mandate, highlighting concerns about the lack of consultation, potential impact on stakeholders, and incongruity with the government’s priorities. It also offers recommendations for the future regulatory framework.

FAQ

Q1: What are the primary concerns raised about RBI’s data localisation mandate?

A1: The concerns primarily revolve around the lack of consultation, potential impact on stakeholders, regulatory uncertainty, and incongruity with the government’s priorities.

Q2: What recommendations are proposed for the future regulatory framework?

A2: The article recommends the repeal of the mandate in favor of more moderate means of securing regulatory access to payments data, data storage autonomy for financial intermediaries operating in India in countries not on a ‘negative list’, and the primacy of permissive data storage policies available under the Digital Personal Data Protection Act over insular sectoral regulations.