For security and protection of rights on the digital landscape, and plugging in the loopholes causing the loss of revenue, data localisation seems a necessary policy for the government. But rushing through with it can be detrimental for firms primarily engaged in the digital economy – such as firms in the fintech sector
The internet has made things truly global by facilitating data accessibility across territorial borders. Free flow of data is imperative for a flourishing digital economy. Fintech sector is one of the greatest beneficiaries of this, allowing it to grow exponentially in the recent years. However, a fast-paced digital revolution has pushed unprepared governments across the globe to increase regulatory efforts for the protection of citizens’ data and rights. This has threatened the growth of fintech and posed manifold challenges to MNCs, local firms, and start-ups. Data localisation is an important policy but before mainstreaming it, the government should ensure the availability of adequate cloud infrastructure in the country and test it in a sandbox to mitigate problems it may cause to the fintech and the digital economy as a whole.
PDP Bill and Data localisation
For the enforcement of the rights of the users, and security of the nation, the flow of data should not be indiscriminate, rather governed by regulatory safeguards. As per the recommendation of the Srikrishna committee, data localisation is made compulsory for all the sensitive personal data under Personal Data Protection Bill 2019 (PDPB). This provision will have a considerable impact on the business models of firms operating in the digital space. This article discusses the effects of data localisation on such firms in one sector – the fintech sector.
What is Fintech?
Fintech refers to firms that employ technology to deliver financial services to consumers and businesses (TheStreet, 2020). In broader terms, fintech deploys internet, mobile devices, software, and cloud services to provide or support delivery of financial services. The major domains in which fintech operates include crowd-funding, block-chain & crypto-currency, mobile payments, insurance, robo-advising, stock-trading, budgeting, etc.
RBI Circular – Dated April 6th, 2018
Financial data under the PDPB has been categorised as ‘sensitive personal data’, prohibiting not only its transfer but also processing outside India. Exceptions to this clause – although very few – are allowed on a case by case request. These provisions make cross-border flows of financial data almost impossible.
However, the fintech sector is not alien to such regulatory restrictions. Even prior to the PDPB’s localisation vision, the Reserve bank of India (RBI) had issued a circular in April 2018, which required all payments-system operators in India to store transaction data of their users within the territory of Indian. The RBI circular had considerably impacted payment-system firms by forcing them to make changes to their business models for storing data locally. But the PDPB’s mandate is wider as it sets out to enforce data localisation for all financial data, as against only transaction data as per the RBI circular.
Data Localisation in Fintech
There are two major goals of the government behind pushing for data localisation, namely: national safety and security, and wealth creation.
National safety & security
As per proponents of localisation, citizens’ data belongs to the country where it is generated and should therefore be stored within the country’s territory.
Enforcement of local laws pertaining to data protection and data principal rights is effectively unachievable, as servers are situated in foreign countries out of the reach from India’s jurisdiction. Situations in which law enforcement agencies need access to such data for investigating rights/duties breaches is rife with layers of permissions which inhibits fast and effective investigation. The infamous Cambridge Analytica scandal is a monumental example of how personal data can be misused, and it is much beyond the privacy of an individual.
Financial data is most critical for the economy of a country, with misuse having the potential to debilitate economies. With the rise of digital economy, security concerns for financial data are real, and India is working to shore up its infrastructure to safeguard it. Data localisation facilitates monitoring real time financial transactions, conduct adequate audits, and enforce local regulations.
National Wealth Creation
If “data is the new oil”, then “payments data is the new gold mine”. Financial data provides precious information for customer profiling needed for targeted advertising and marketing campaigns. That is to say, economic gains by fintech firms from user data have been plentiful.
However, multinational fintech firms operating in India have avoided paying fair taxes for long by taking advantage of regulatory loopholes; data localisation aims to plug in those loopholes. Data localisation mandates these firms to store financial data within the country either by building data centres or sourcing these services from local vendors. This will advance economic growth by creating new job opportunities and generating tax revenue. Being one of the fastest-growing digital economy in the world, India provides free access to the largest open internet market – and no firms would want to quit this market. In the long term, it might be a profitable bargain for both the fintechs and the government, but the short-term would impose heavy costs which could be crippling without a corresponding policy for easing the transition into local storage.
Challenges for the MNCs
As explained above, data localisation will increase the cost of cloud services in the country impacting the revenue generation of fintechs. Unlike companies that are producing physical goods, fintechs have advantage of aggregating their systems and data at any remote location while providing services globally. Data localisation will demand a change in this business model and tremendously increase logistical expenditure (The Economic Times, 2018). Firstly, setting up of domestic processing and storage capacity will induce an upfront cost. Secondly, data migration efforts for bringing back processing infrastructure would further impose costs. In addition to extra capital investment, compliance to new regulations may make their business model unprofitable, putting them in a situation where they have to rethink their plan of expansion or quit the Indian market.
Challenges for the Indian firms
Fintechs in India are designed and structured in a manner to act as both technology enablers and service providers offering both B2B and B2C services. Only few fintech firms operate in the space of core financial services, while many provide services at the periphery – supporting traditional financial institutions (Mondaq, 2020). The sustainable growth of these firms is very crucial for the success of India’s bigger plan of financial inclusion for all. The government understands their importance, and various incentive schemes and support programs announced by both state and union governments are an affirmation of this (Live Mint, 2018). But data localisation may prove debilitating as Indian firms presently lack capital and technological know-how to adapt to localisation requirements. The free flow of data allowed them to source cheap cloud services from global players. This will deplete their already thin profit margins as sourcing these services locally is a costly affair.
Challenges for the fintech start-ups
The highest pressure of data localisation is being exerted on start-ups in the fintech sector. The business model of start-ups depends heavily on outsourcing of technological support and cloud services to cheap and competitive service providers. Data localisation requirements prohibit the right of start-ups to choose cost effective cloud service providers from the global supply pool. The other challenge comes from the fact that the data localisation will force them to engage in product re-engineering based on complex regulations, increasing technical and operational costs. This territorial restriction could possibly also curb plans of international expansion. Free flow of data is required for the innovation in start-ups and India has always benefitted from it. Data localisation may erode the cash liquidity by increasing operational cost and reducing revenue.
The way forward
Data localisation in fintechs poses two sets of problems – the first one pertains to migration of processing systems to domestic servers, and unavailability of sufficient data centres; while the second one revolves around compliance with complex regulation and firm adaption to commercially feasible business models. The government must proactively accommodate these concerns for ensuring uninhibited growth of fintechs.
Firstly, it should incentivise setting up of data centres for meeting excessive demand of cloud infrastructure as a result of data localisation. Policy should be drawn to support the creation of auxiliary infrastructure such as large buildings, stable power supply, cooling devices, skilled human resource, and good network bandwidth needed for the development of data centres in India. Solving the problem of cloud services should be prioritised to mitigate the potential risks posed by data localisation on fintechs. PDPB will require moving all financial data and its processing systems from the servers located in foreign countries to domestic servers, creating a sudden spike in demand for data centres. The short supply of cloud infrastructure may prove disastrous for the fintechs that are promising an exponential growth.
Secondly, as per the foregoing – the cost of cloud services available locally will probably spike due to limited supply, and efforts should be made to regulate its pricing.
Thirdly, and perhaps one of the most important things to bear in mind, is that data localisation should not be rushed – rather, the approach should be in an incremental manner leaving enough lag space for fintechs to choose best business models and adapt as per their requirements. A possible way for minimising drawbacks from data localisation is to first live-test it in a sandbox before mainstreaming the policy (Live Mint, 2019). Data localisation can be a game-changer policy for India not only for enforcement of local laws, privacy of user, national security but for generating tax revenue, and creating new job opportunity. However, for protecting fintechs from any negative impact of data localisation the government should address their specific concerns and provide flexibility in the adoption of the regulatory norms.
(Dhirendra Singh is currently pursuing his Masters in Public Policy from NLSIU, Bangalore. He holds a bachelor’s degree in communication design from Nift, New Delhi. Dhirendra has a keen interest in the interplay of technology with policy. He can be reached at firstname.lastname@example.org)
Live Mint. (2018, Dec 23). Live Mint. Retrieved Jun 10, 2020, from Live Mint: https://www.livemint.com/Money/tYjrbOmLlOTmRuT9IYgCVK/2018-roundup-Impact-of-data-localisation-others.html
Live Mint. (2019, Apr 23). Live Mint. Retrieved Jun 10, 2020, from Live Mint: https://www.livemint.com/companies/start-ups/startups-see-rbi-s-fintech-sandbox-as-a-positive-but-wary-of-some-clauses-1555963430870.html
Mondaq. (2020, Mar 20). Mondaq. Retrieved Jun 11, 2020, from Mondaq: https://www.mondaq.com/india/technology/885572/fintech-comparative-guide
PRS India. (2019, Dec 20). PRS India. Retrieved Jun 10, 2020, from PRS Legislative Research: https://www.prsindia.org/node/843845/chapters-at-a-glance
The Economic Times. (2018, Jul 28). ET Rise. Retrieved Jun 11, 2020, from The Economic Times: https://economictimes.indiatimes.com/small-biz/startups/newsbuzz/data-localisation-may-pinch-startups-payments-firms/articleshow/65173964.cms?from=mdr
The Economic Times. (2019, Nov 08). The Economic Times. Retrieved Jun 10, 2020, from The Economic Times: https://bfsi.economictimes.indiatimes.com/news/industry/data-localisation-to-make-things-easy-for-law-enforcement-agencies-brijesh-singh/71964260
The Guardian. (2019, Mar 18). The Guardian. Retrieved Jun 10, 2020, from The Guardian: https://www.theguardian.com/technology/2019/mar/17/the-cambridge-analytica-scandal-changed-the-world-but-it-didnt-change-facebook
The Ken. (2019, Aug 19). The Ken. Retrieved Jun 12, 2020, from The Ken : https://the-ken.com/story/cloudy-with-a-chance-of-data-centres/?searchTerm=data%20localisation
The Quint. (2018, Jul 27). The Quint. Retrieved Jun 06, 2020, from The Quint : https://www.thequint.com/news/india/key-highlights-from-srikrishna-committee-report-on-data-protection
TheStreet. (2020, Feb 11). TheStreet. Retrieved Jun 10, 2020, from TheStreet: https://www.thestreet.com/technology/what-is-fintech-14885154#:~:text=Fintech%20is%20the%20term%20used,services%20to%20businesses%20or%20consumers.