Although data privacy regulation justifiably garners the most attention, potentially as impactful—indeed, disruptive—to the entire payments industry ecosystem is data localization.
Payment industry participants with cross-border or global aspirations that fail to thoughtfully consider both existing and prospective data localization restrictions do so at peril to their business models, operating architecture and expansion plans.
Data localization provisions restrict to varying degrees the storage, processing, and/or transfer of data outside a country. Often data localization takes the form of storage and processing restrictions that do not prohibit the cross-border transfer of data (e.g., sending a transaction cross-border for authorization) as long as a copy of the data is stored locally or the data is first processed locally before being processed further in another country.
Conversely, a transfer restriction, the most stringent form of data localization, prohibits a company from accessing, storing, or processing data outside a country: Everything must be done locally, in country, and data cannot leave.
Further, there are data localization laws specifically targeted at payments. India provides a very real and recent example: on April 6, 2018, the Reserve Bank of India mandated that all data related to payment systems be stored and processed in a system only in India. This new requirement was communicated in a one-page circular with payment companies having a mere six months to comply.
Data localization and its restrictions on data flows have grown rapidly over the past decade, resulting in higher infrastructure and compliance costs for payment companies. As countries continue to build digital walls through data localization, industries such as the payments industry that rely heavily on cloud-based services will have to decentralize their systems and develop strategies to rein in the seamless architecture of the Internet, perhaps arresting the speed of global payments expansion and innovation.
And some of the countries driving the market for mobile payments and other innovative payment methods—China and India—are notably also the countries with the toughest data localization regimes.
Payment innovators have prospered by being quick to market with their design, deployment and implementation. As the payment industry continues to innovate and expand across borders, it increasingly will need to be mindful of data regulations requiring data localization that multiply the complexities and cost of creating a seamless data flow and user experience.
