Data Sovereignty - Banking Infrastructure Requirement

Data Sovereignty means Data is subject to the laws of the country where it is collected and where it is stored. For Banks, it means you cannot just put Indian customer's payment data on a US server and claim US CLOUD Act will protect it. The sovereign state wants unfettered supervisory access.

There are 2 models:

• Hard Localization: Data must be stored ONLY in India (India Payment Data, Russia, China)
• Soft Localization: Copy must be stored locally, processing can be abroad (EU GDPR adequacy + SCC)

Part 1: India - The Strictest Payment Data Sovereignty in World

A. RBI Circular 6 April 2018 - Storage of Payment System Data

Circular No. DPSS.CO.OD.No 2785/06.08.005/2017-18 dated April 06, 2018

Mandate:

All system providers shall ensure that the entire data relating to payment systems operated by them is stored in a system only in India. This data should include the full end-to-end transaction details / information collected / carried / processed as part of the message / payment instruction.

What is Payment Data?

• Full end-to-end transaction details
• Customer information (Name, Mobile, PAN, Card number)
• Beneficiary details
• Payment instruction, session logs, system logs
• For foreign leg of transaction, if any, data can also be stored in foreign country, if required, but primary copy must be in India.

Compliance Required:

• Board-approved System Audit Report (SAR) by CERT-In auditor submitted to RBI annually
• Report compliance to RBI within 6 months (original deadline 15 Oct 2018)

B. DPDP Act, 2023 - Sec 16 - Cross Border Restriction

India does NOT have blanket localization under DPDP Act. It has Blacklist Model:

• Sec 16(1) - Central Government may notify countries where data cannot be transferred. As of Sept 2026, no country notified.
• But sectoral regulators override: RBI, SEBI, IRDAI mandates still prevail. So for banking, RBI 2018 circular is still hard law, even if DPDP allows transfer.

This is called India's Twin Track: General law permissive, Financial law restrictive.

C. Other Regulators

• SEBI: Mandates financial and securities data residency in India
• IRDAI: Insurance data residency
• MeitY: Swaraj Cloud push - 100% data residency within country using Indian data centers governed under Indian jurisdiction to meet DPDP Act + RBI residency.

Part 2: Switzerland - Data Sovereignty via FINMA Outsourcing Rules

Switzerland does not have hard payment localization like India, but has Operational Sovereignty.

FINMA Circular 2018/3 - Outsourcing and Cloud:

• When Swiss bank outsources significant function to cloud, it must ensure access to information necessary for restructuring and winding up must be possible in Switzerland at all times.
• FINMA understands it differently from banks: Data must be stored on Swiss soil, together with everything necessary for its use, not just online access.
• For Bank Client Data (data with banking secrecy relevance), processing abroad allowed only if client data protected equivalent to Swiss standards, and bank can audit.

FINMA Circular 2023/1 - Operational Risks and Resilience (effective 1 Jan 2024):

• Banks must identify critical functions, set tolerances for disruption and map supporting resources including third parties
• Maintain ICT asset inventory recording storage locations for critical data alongside dependencies
• Identify critical data stored outside Switzerland or accessible from abroad
• 1 in 5 Swiss banks/insurers already outsourcing to public cloud as of 2024 - FINMA is tightening.

Swiss Bankers Association Cloud Guidelines 2019:

• Non-binding but focuses on processing of all data with relevance for banking secrecy - "bank client data"
• Requires customer-managed encryption so vendor cannot access client financial information.

Part 3: Case Laws - Enforcement of Sovereignty

CASE 1: Mastercard Ban - Landmark Indian Sovereignty Enforcement

RBI vs Mastercard Asia/Pacific Pte Ltd - Order dated 22 July 2021

RBI imposed restrictions on Mastercard from adding new domestic customers (debit, credit, prepaid) from 22 July 2021 for failure to comply with Storage of Payment System Data directions.

Facts: Mastercard was storing Indian payment data in US, offered to store copy in India. RBI said NO - "stored in a system only in India" means primary must be in India, not copy.

Impact: 5 private sector banks including Axis, Yes, IndusInd could not issue new Mastercard cards for 11 months. Lifted only after Mastercard submitted SAR audit showing full compliance and deletion of data from foreign servers.

This is most important sovereignty case in India.

CASE 2: American Express and Diners Club Ban

RBI vs American Express Banking Corp and Diners Club International Ltd - April 2021

Same grounds. Barred from onboarding new customers from May 1, 2021. Amex complied and ban lifted in Aug 2022 after proving data purging from US servers.

Legal Principle: RBI's supervisory access must be unfettered - if data stored abroad, US government can block access via CLOUD Act. Sovereignty requires physical control.

CASE 3: SWIFT Affair - Swiss Sovereignty Case

Swiss FDPIC Report October 2006 - SWIFT Data Transfer to US Treasury

Swiss banks using SWIFT transferred transaction data to US. US Treasury subpoenaed SWIFT (Belgian company with US server) for terrorism data.

FDPIC Held: Banks failed to provide appropriate information, duty to inform applies even if there is merely a possibility that a third party may gain access to SWIFT data.

Modern Relevance: This is why Swiss banks now have clause in privacy notice: "Personal data may be disclosed to US authorities under US CLOUD Act if stored in US". India learned from this and made hard localization.

CASE 4: Around 15 Payment Firms Under Monitoring

RBI Monitoring 2020 Report - Moneycontrol

Around 15 major data and payments service providers that failed to meet RBI data localisation norms were monitored. Includes Visa, Amazon Pay, PayPal. They requested more time saying fraud detection systems cannot be redesigned quickly to work in India alone, offered to store copies in India.

RBI rejected copy model, insisted primary storage in India.

Case law on Extraterritoriality: In this context, Indian Payment and Settlement Systems Act Sec 10(2) and 18 gives RBI power to direct storage only in India.

CASE 5: Schrems II Impact on Swiss and Indian Banks

CJEU Case C-311/18 Data Protection Commissioner vs Facebook Ireland (Schrems II) - 16 July 2020

CJEU invalidated EU-US Privacy Shield. Held US surveillance does not provide adequate protection.

Impact on India/Switzerland:

• FDPIC Policy paper on transfer to USA - says transfer to USA lacking adequate level of protection within meaning of Art 6(1) Swiss DPA
• Indian banks using AWS US-East for payment processing now in violation of RBI circular - must move to Mumbai / Hyderabad region.

Part 4: Compliance Framework for Bank/Fintech

If you are Bank/Fintech handling Indian payment data:

1. Infrastructure: Must have primary DC and DR both in India, different seismic zones. Data must be stored in system only in India. Foreign leg can be stored abroad but only if copy remains in India within 24 hours and original deleted abroad after processing.
2. Audit: Annual System Audit by CERT-In empanelled auditor, Board-approved SAR submitted to RBI DPSS.
3. Contract: With cloud provider (AWS, Azure, GCP), ensure clause: Data will not be transferred outside India without prior RBI approval, and provider will not disclose to foreign government without informing bank.
4. Consumer Claim Defense: If customer data leaked due to foreign server, you cannot claim safe harbour. You are liable under CPA 2019 Sec 2(11) + DPDP Sec 8(5) + IT Act Sec 43A. NCDRC will hold you liable as in SBI hacking case (Rs.1.99 lakh refund).

If you are Swiss Bank using cloud:

1. Ensure customer-managed encryption - cloud provider cannot access bank client data
2. Ensure data necessary for resolution stored on Swiss soil
3. Maintain FINMA ICT asset inventory under Circular 2023/1
4. Conduct risk assessment before outsourcing - include US CLOUD Act risk

For Consumer - How to file complaint for Sovereignty Violation:

If you discover your bank stores payment data outside India (check privacy policy or ask under RTI):

• File complaint to RBI Ombudsman under RB-IOS 2021 - Ground: Non-adherence to RBI circular on data storage
• File consumer complaint under CPA 2019 - Deficiency + Risk to data security
• Cite Mastercard ban case - if RBI can ban Mastercard for sovereignty violation, bank also liable for same.