Data Localisation Rules

How rules requiring some data to be stored in India, like the RBI's 2018 payments rule, boost local data centres, and the debate about costs and sovereignty.

Data localisation means requiring data to be stored within a country.

India’s rules

The RBI required payment system data to be stored only in India from 2018.
Some government and sensitive data must stay in India.
The Digital Personal Data Protection Act, 2023 allows the government to restrict transfers to certain countries.

Arguments for

Security and law enforcement access.
Sovereignty over citizens’ data.
Boosting local data centre investment.

Arguments against

Higher costs for global firms.
Fragmentation of the internet.
May not improve security by itself.

Effect on industry

Localisation rules encouraged global firms like Visa, Mastercard and cloud providers to expand Indian data centres. The RBI restricted Mastercard from adding new customers in 2021 for non-compliance, lifting it in 2022.

Global picture

China, Russia and others have strict localisation; the EU uses data protection rules instead.

The payment server

After the RBI rule, a global card network built servers in India to store Indian transaction data locally.

Thinking data can always flow freely across borders

India requires some data, like payments data, to stay in the country.

Key takeaways

Data localisation requires data to be stored locally.
The RBI's 2018 rule covers payments data.
It boosts local data centres but raises costs.
Mastercard was restricted in 2021 for non-compliance.