Follow Data Localisation Framework Before Payments Launch, NPCI Tells WhatsApp

National Payments Corporation of India (NPCI), which was approached by WhatsApp to seek clearance for launching its unified payments interface (UPI) payment platform WhatsApp Payments, has given its verdict. NPCI asked the Facebook-owned instant messaging app to make changes in its policy to get the final approval.

Following the submission of the WhatsApp’s report, which was prepared by Deloitte, NPCI asked has asked the instant messaging app to make changes in its data-compliance framework that prohibits storing of payment data outside of India.

WhatsApp is yet to respond to the suggestions.

RBI on Data System Storage

The Reserve Bank of India (RBI) has asked the payment service providers and third-party payments app to store key payment data only in India. “The entire payment data shall be stored in systems located only in India,” RBI said in reference to its ‘Storage of Payment System Data’ directive issued on April 6, 2018. The guidelines also elaborated that if the data is processed abroad, then it should be deleted from the system abroad and brought back to India within 24 hours.

The RBI’s UPI Payments instructions are an attempt to “safeguard the interests of the customers and users” and to ensure that any transaction through these online payment modes was duly accounted for by parties involved — Payee, third parties and the application.

As RBI is pushing for strict data localisation policies, the government of India is yet to take a concrete stand on it. The commerce and industry ministry has called for strict data localisation norms in its draft ecommerce policy and supports RBI’s policy. Meanwhile, the electronics and information technology ministry is still working on the Personal Data Protection Bill and has become an important agency for all data-related matters.

In August this year, the Supreme Court (SC) asked RBI to review WhatsApp Payments reports and confirm if the yet-to-launch platform is in compliance with the data localisation policy. The SC had given a six weeks deadline to the central bank.

Note: We at Inc42 take our ethics very seriously. More information about it can be found here.