All Sensitive Data Be Stored Locally: GoI

As per the directive of Reserve Bank of India (RBI) has said all data related to payment transactions must be stored in the country and that such information, if processed abroad, will have to be brought back within 24 hours. The entire payment data shall be stored in systems located only in India.

RBI clarified on the frequently asked question (FAQ) section, by responding to certain issues raised by payment system operators. “The data should be deleted from the systems abroad and brought back to India not later than one business day or 24 hours from the payment processing, whichever is earlier.

Government will insist on all “critically sensitive” electronic data be stored in servers within the country while other data may be allowed to be stored abroad. In some cases, however, mirror sites within the country will be insisted upon.  Officials said that in a legislation which may come before the Parliament soon, the government would insist that only this category of data, including data on financial transactions within the country, health, social orientation, etc., be stored locally since they are “critically sensitive” and be made available to the state if the need arises.

“Other data such as whether you like buying mobile phones or eating burgers could be stored abroad… that data storage decision would be a commercial one for the company which has the data. Many firms prefer to store data where costs and taxes are relatively lower. India has been in talks with US authorities over its data storage rules ever since the RBI mandated that data on Indian financial transactions have to be stored locally.

Officials said the whole issue first arose when, after the November 26, 2008 terror attack on Mumbai, India’s intelligence agencies sought certain data pertaining to Indian citizens from internet-based social media firms, who were extremely reluctant to share it. However, after initially toying with the idea of forcing firms dealing with data on Indians to store it locally, the government has realized that having encryption keys which allow them to monitor such data was more important.