NPCI starts auditing data localization norms for digital payment firms
NPCI starts auditing data localization norms for digital payment firms – Retail payments organisation National Payments Corporation of India (NPCI), which operates various payment instruments including Unified Payments Interface (UPI), has asked all its digital payment platform members to supply a system audit report on ‘Storage of Payment System Data in India’, as per a letter dated 6 May.
The letter, citing indicative guidelines for a system audit from NPCI, however, comes almost two years after the RBI issued a directive during this regard, many data localisation norms strictly for a few international players and needs to extend the audits for even domestic UPI operators. this is often clearly late and perhaps NPCI is acting as an indirect auditing body on behalf of RBI for products it operates. Or this might even be read as precautionary measures which NPCI is taking before any localization norms is flouted by a player,” said an industry expert, conscious of the rules .
The RBI had released the FAQs on the above mentioned data localisation circular clarifying the implementation issues in June, 2019, the NPCI guidelines mentioned.
A copy of the NPCI letter has been reviewed by Mint. The auditing of knowledge localisation norms is critical because it allows safeguarding, security and governance of payments data of Indian consumers.
Although NPCI has stated that these guidelines are supported interactions with various stakeholders within the UPI ecosystem, payment platforms, Mint spoke to, confirmed that this auditing practice has been delayed.
However, the NPCI auditing initiative comes at a time when digital payment firms are looking to revive their businesses from the COVID-19 impact on their revenues.
“This is really a delayed ‘System Audit Report’ on Data Localisation. It looks like NPCI has visibly colluded with international UPI players and is performing unfairly to perform its duty to make sure and implement the RBI directive of knowledge localisation, only now, as a number of them are going live. This delay further mitigates the danger of privacy and safety of UPI user data,” said an executive of a digital payments firm, who didn’t want to be named.
Interestingly, messaging major WhatsApp is expecting a full roll-out of its UPI-based payment service, which initially faced regulatory hurdles from the Federal Reserve Bank of India, in 2018, over data localisation norms.
Read more News & trends on India Frontline.