India. Data localisation / cross-border. Directive / circular
RBI data localisationRBI Directive on Storage of Payment System Data (RBI/2017-18/153, DPSS.CO.OD No.2785/06.08.005/2017-2018)
In force
§1Summary
- Synopsis
Requires all payment system providers authorised in India to store the entire data relating to payment systems they operate only in systems located in India. Data on the foreign leg of a cross-border transaction may also be held abroad.
- Key themes
- Unique features
Strict full-copy localisation of payment data rather than a mirror requirement.
- SaaS relevance
Caught where the SaaS is or supports an authorised payment system operator (payment aggregators, gateways, PPIs) handling Indian payment data.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None in this circular
- DPO
- No
- Cross-border transfers
- Strict localisation: payment system data stored only in India (foreign leg may also be stored abroad)
- Maximum penalty
- Sanctions under Payment and Settlement Systems Act 2007
§3Dates
- Key dates
- Adopted
- In force
- Issued 2018-04-06; compliance deadline 2018-10-15; board-approved CERT-In empanelled system audit report due 2018-12-31; clarified by RBI FAQs (2019).
§4Text and authority
- Text
- Authoritative text rbi.org.in
- Authority
- Reserve Bank of India (RBI)
§5Where it applies
- Domestic law of
- India
§6Sources and verification
- Sources consulted
- Verification
High confidence.
2019 FAQs allow processing abroad if data is brought back to India within 24 hours (from general knowledge, not re-verified).