1. Definitions

• Data Sovereignty: Data is subject to laws of the country where it is stored / collected. If stored in US, US CLOUD Act applies even if customer is Indian.
• Data Localisation: Mandate that a copy or entire data must be stored only in India.
• In Banking, RBI uses Strict Localisation, not Mirroring.

2. RBI Framework - 4 Layers

A. Storage of Payment System Data Circular, April 6, 2018 (Most Important)

All Payment System Operators (PSOs) - Visa, Mastercard, Amex, Paytm, WhatsApp Pay, Google Pay, NPCI - shall ensure entire data relating to payment systems operated by them is stored in a system only in India.

What data?

• Full end-to-end transaction details - customer identifier, payment instrument, merchant identifier, amount, timestamp, transaction reference
• Info collected / carried / processed as part of payment message / instruction

Clarification June 26, 2019:

• Processing may be done abroad for fraud, risk, etc but data must be deleted from abroad and brought back to India within 24 hours or 1 business day, whichever earlier, and stored only in India.
• Audit report by CERT-In empaneled auditor by Dec 31, 2018.

B. Cloud Outsourcing Guidelines - Master Direction on Outsourcing of IT Services, 2023

• Bank must have data localization / sovereignty clauses in cloud contract.
• Right to audit, unfettered supervisory access to RBI.
• No CLOUD Act exposure - If you use AWS/ Azure/GCP India region, parent is still US entity which can be compelled under US CLOUD Act to disclose data stored anywhere. RBI expects mitigation - encryption keys held in India, data residency clause, and Indian vendor option like NxtGen.
• Data must remain accessible even if provider insolvency.

C. Digital Lending + DPDP Act 2023 + Draft DPDP Rules 2025

• Cross-border transfer allowed only to government-notified countries, with consent.
• Significant Data Fiduciaries must keep data in India for critical personal data.

D. Data Centre and DR:

• RBI mandates that primary and DR data centres for critical banking systems be in India.

3. Why Localisation in Banking?

1. Supervisory Access: RBI needs unfettered access without Mutual Legal Assistance Treaty delay.
2. Law Enforcement: No foreign blocking statute.
3. Customer Protection: After breach, recovery under Indian law.
4. Financial Stability: Prevents foreign sanction risk.

4. Architecture Model for Compliant Cloud Banking

Compliant Pattern:

• Use India Availability Zones (e.g. ap-south-1 Mumbai, Central India)
• Bring Your Own Key (BYOK) - keys stored in India HSM, not with CSP global KMS
• Contract: No data egress, no sub-processing abroad without consent
• Logs, backups, replicas also in India
• Exit: Secure purge abroad within 24 hours

Non-Compliant: Storing payment data in Singapore / US and keeping only a copy in India.

5. Case Laws / Enforcement Actions

India - RBI Enforcement (Most Cited as Case Law)

1. Mastercard Asia/Pacific - RBI ban from onboarding new customers from July 22, 2021
Reason: Failed to comply with Storage of Payment System Data directions. RBI barred from issuing new debit, credit, prepaid cards. Existing customers not impacted. Lifted after compliance in 2022 after storing data only in India and submitting audit.

2. American Express Banking Corp and Diners Club International - Ban from May 1, 2021
Same reason - non-compliance with data storage rules. Amex had paltry market share but was only international issuer yet to comply. Ban lifted after satisfactory compliance demonstrated.

3. WhatsApp Pay - Affidavit in Supreme Court (2019)
RBI revealed in affidavit in SC that WhatsApp had not complied with data localisation norms. WhatsApp Pay launch delayed. SC issued notice to government, RBI, Google, Amazon, FB over UPI data security on petition seeking to disallow tech majors from operating UPI before ensuring security and compliance with localisation parameters. Good Governance Chambers petition pending.

4. Puttaswamy vs Union of India (2017) - Right to Privacy
SC 9-judge bench held personal data collected by bank or e-commerce for specific purpose cannot be made public without consent. Privacy not lost after parting with data. Foundation for localisation - state has legitimate interest to keep citizen data sovereign.

5. Aadhaar - Section 57 struck down (2018)
SC held allowing private commercial collection of Aadhaar for any purpose violates privacy. Result: private banks cannot force Aadhaar as condition - reinforces sovereignty over identity data.

US vs India Conflict - CLOUD Act Risk

6. US CLOUD Act vs RBI Localisation
US-headquartered cloud providers (AWS, Azure, GCP) are subject to US CLOUD Act, which can compel disclosure of data stored anywhere globally. RBI indirectly addresses this by requiring structural sovereignty - use Indian company or ensure legal carve-out. This is why banks prefer Sify, NxtGen, CtrlS for CBS DR.

EU Parallel

7. Schrems II (CJEU, 2020) - Data Sovereignty case
CJEU invalidated EU-US Privacy Shield because US surveillance laws conflict with EU sovereignty. Banks in EU cannot store EU customer data in US without SCCs. Same logic applied by RBI - Indian payment data cannot be subject to foreign law.

6. Penalty Matrix

• Non-compliance: RBI can ban onboarding (as done for Amex, Mastercard, Diners), cancel PA/PG licence, impose audit restrictions.
• Under DPDP Act: Failure to safeguard + cross-border violation = up to Rs 250 Crore.
• Under PSS Act Sec 26: Penalty for violation of RBI directions.

7. Exam Answer Structure

For your paper, write:

Data Sovereignty = Legal Jurisdiction, Data Localisation = Physical Location. RBI follows Full Localisation Model (not mirror). Circular 6 Apr 2018 + Clarification 26 Jun 2019 mandates payment system data stored only in India, processing abroad allowed but delete and bring back within 24 hrs. Master Direction 2023 mandates audit, encryption key in India, no CLOUD Act exposure. Non-compliance led to ban on Mastercard, Amex, Diners Club (2021) and SC notices to WhatsApp, Google Pay.