India: Views of Industry Experts on Reserve Bank of India notification regarding Storage of Payment System Data-Corporate Newsletter

April 24, 2018
ISSUE No. 17
April 24, 2018

India: Views of Industry Experts on Reserve Bank of India notification regarding Storage of Payment System Data

The Reserve Bank of India, abbreviated as RBI



India is aiming towards being a paperless economy. For the past one year, digitization has taken India by storm. Everything today is shifting on to the digital world. From booking a restaurant to booking a house, from opening a bank account to paying the bills, from lending money to getting a loan everything can happen in just a click. This has become possible because of the robust online payment ecosystem of the country. These online payment systems share and store the data digitally. The amount of information shared on the internet is immeasurable. The information shared includes personal information and sensitive personal information of an individual. Thus, in the fast-moving technological world today, everything about data protection, data security and data storage is significant.


Reserve Bank of India (hereinafter referred as ‘RBI’) on March 6, 2018 issued notification regarding Storage of Payment System Data[1] . The said notification has directed all the payment system operators to ensure within a period of 6 months, i.e. by October 15, 2018 that the data related to payment systems operated by them are stored on servers located in India. With the increasing number of data breach incidents, the guidelines are a step to ensure the safety and security of the data, thereby, reducing the risk of data breach and catalyzing the growth of online payment ecosystem.

According to the RBI, there are very few payment system operators (and their outsourcing partners) who store data on servers located within India, either partly or completely. The director of RBI was quoted saying ‘the directive is aimed at having unfettered access to all payment data for supervisory purposes.’[2]


The notification has caused a split opinion among the different online payment systems within the industry. On one side companies like PayPal, Paytm and PayU have supported the move of RBI, whereas on the other hand companies like Google, Facebook, and the fin-tech startups within the country have shown concerns.

Our systems are within the country and they are getting audited regularly, but if global players do not have their servers in India, how can the regulator ensure the safety of the consumer data,” said a founder of a Bengaluru-based payments company.[3] Also, Subho Ray, president of Internet and Mobile Association of India (IAMAI) said that ‘What RBI is doing is heavy-handedness. A regulator should not bring about such fundamental changes without consultation with a cross section of affected parties.[4]

Amrish Rau, chief executive officer of PayU India, said that ‘Most countries require transaction data to remain within the country. This is different from situations where the regulator allows no data to leave the country. The RBI step is welcome and we adhere to it today.[5]

PayPal has become the first country that has responded publicly to RBI. It has agreed to store its transaction data in India after the RBI issued a mandate asking all the payment firms to comply to above-mentioned requirement within six months. The Chief Technology Officer of PayPal, in an interview said that the major competitive advantage of the company lies in fact that they look at compliance and regulations, and work with local the government. The company aims to work with regulators and comply as closely and as best possible. [6]

Kiran Vasireddy, chief operating officer of Paytm, supported the move and said that ‘The directive to process and store data only in India will help curb the potential misuse and enable active regulatory monitoring. It will definitely boost customers’ confidence in moving to digital payments without worrying about the security of their personal data’


The requirement mandated by the RBI is aimed at ensuring that the personal data of data subjects – Indian residents is protected with greater certainty. This move can be viewed in consonance with the General Data Protection Regulation set to be implemented for the protection of the personal data of European residents in the European Union on May 25, 2018 . However, it should be noted that the practical implementation of such a mandate comes with its own roadblocks like installation of adequate servers for storing of information/ data.

Further, this is move is also set to improve the quality of data management by Indian players as well, whether such function is currently being outsourced by major payment system operators or not. This move can also be viewed as a positive towards protection of sensitive personal data or information (SPDI) of Indian citizens in the light of already existing Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.

[1] Available at:


[2] Available at:


[3] Available at:



[4] Available at:



[5] Available at:



[6] Available at:


[7] Available at:



[8] For more information read ‘Getting Ready For General Personal Data Protection Regulation (GDPR)’ available at:

Personal Data Protection Regulation GDPR



India: Food Regulator FSSAI proposes to ban advertisement of HFSS for children

food safety and regulation in India



India’s Food regulator, the Food Safety and Standards Authority of India (hereinafter referred to as “FSSAI”) has issued a notice on April 11, 2018, wherein it has called for suggestions on the draft Food Safety and Standards (Labelling and Display) Regulations, 2018 (hereinafter referred to as “Draft Regulations”)[9] . The Regulations seek to prescribe the labelling requirements of pre-packaged foods and display of essential information on premises where food is manufactured, processed, served and stored.

Prohibition on advertisement of HFSS food

An important provision of the Draft Regulations is that food products containing high levels of fat, sugar and salt shall not be advertised to children. The Draft Regulations have defined HFSS food or High Fat, Sugar, Salt to be “processed food product which has high levels of total fat or trans-fat or total sugar or salt[10] , and states that HFSS food products shall not be advertised to children in any form.


Popular and largely consumed foods like chips, cold drinks, etc., contain high fat, sugar and salt. These items comprise of a huge chunk of advertisement in India, and therefore, many advertising companies and companies selling, or manufacturing such foods will be restrained from advertising these products to children. However, the Draft Regulations do not provide any guidelines or enforcement mechanism to ensure ban on such advertising. Moreover, it is not clear as to how advertisements, being available on public forums like television channels, billboards etc., will be prevented from being specifically advertised to children. The question arises whether to adhere to this provision, companies will have to ban all advertisements of HFSS food.

[9] Available at 

[10] Section 2(9) of the Draft Regulations



India: Bio-Medical Waste Management Rules Amended

Ministry of Environment (Government ministry)



The Ministry of Environment, Forest and Climate Change has amended the Bio-Medical Waste Management Rules, 2016 (hereinafter referred to as “Parent Rules”) and brought into force the Bio-Medical Waste Management (Amendment) Rules, 2018 (hereinafter referred to as “Amendment Rules)[11]. The Amendment Rules seek to improve compliance and strengthen the implementation of environmentally sound management of biomedical waste in India.

About the Parent Rules

The Parent Rules were notified on March 28, 2016, to improve the collection, segregation, treatment and disposal of bio-medical wastes in an environmentally sound manner. These Parent Rules apply to all persons who generate, collect, receive, store, transport, treat, dispose, or handle bio medical waste in any form. Further, establishments generating bio-medical wastes and common bio-medical waste treatment facility have to obtain authorization from the State Pollution Control Board and adhere to the compliances as mentioned in the Parent Rules.

Phasing out of chlorinated plastic bags

The Amendment Regulations have extended the date of phasing out use of chlorinated plastic bags (excluding blood bags) and gloves by establishments handling bio medical wastes by one year, i.e., March 27, 2019. The Parent Rules had provided the last date of phasing out use of chlorinated plastic bags, gloves and blood bags to be March 27, 2018.

Establishment of Bar Code System

The last date for establishments generating bio-medical wastes to establish a bar-code system for bags or containers containing such wastes to be sent out of premises for further treatment has been extended to March 27, 2019, as against the previous date of March 27, 2017 as mentioned in the Parent Rules.

Establishment of Global Positioning System

The last date for operators of common bio-medical waste treatment and disposal facility to establish bar-code system and global positioning system for handling bio-medical wastes has been extended to March 27, 2019, as against the previous date of March 27, 2017 as mentioned in the Parent Rules.

Pre-treatment of laboratory waste

Establishments handling bio medical wastes are under obligation to pre-treat the laboratory waste, microbiological waste, blood samples and blood bags through disinfection or sterilisation on-site in the manner as prescribed by the World Health Organization (WHO) guidelines on Safe management of wastes from health care activities and WHO Blue Book, 2014 before sending to waste treatment facilities. The Parent Rules required such wastes to be treated in the manner prescribed by the World Health Organization or National AIDs Control Organization.


[11] Available at



India: Challenges and Opportunities in Consumer Matters for In-house Counsels

expense of litigation

The role of an in-house Counsel, is rapidly evolving to keep pace with the changing needs of the businesses that they support. In modern times, the scope of work of an in-house Legal Counsels/Legal Manager has shifted from a general advisor and managing compliance obligations to a much wider scope. They now have to handle all kinds of matters that affects the business of their Company. Handling bulk cons umer litigation all over the country is one aspect of their work. A few challenges faced by the in-house Counsels in India, along with a few possible solutions are:

  • It is a common practice that in case of a grievance, consumers generally file complaint against the then dealer/distributors of the Company and do not implead the Company as a Respondent or mention the address of the dealer/distributors instead of the Company address, which often results in a lack of communication of any fresh matters. Due to this, the court notices are not served upon the Company, which may lead to passing of an ex-parte order, which only comes into their knowledge upon receiving the copy of the judgement or notice in the execution proceedings.
  • Sometimes, the consumers while hunting for huge discounts on the internet, ends up purchasing fake/counterfeit products from unauthorized e-commerce websites, and when they face any post sale warranty issue in the product or with its authenticity, they file a consumer complaint against the manufacturer Company seeking refund and compensation and not against the unauthorized sellers.
  • The limitation period for filing an appeal from the date of order of the District Forum is 30 days as provided under the Consumer Protection Act, 1956 (hereinafter referred as to “Act”). However, the Act is silent about the limitation period for filing an Execution Application. Therefore, such period is governed by Regulation 14 (1) (iv) of the Consumer Protection Regulations, 2005, which says the limitation for filing any application is of 30 days from the date of the cause of action or the date of knowledge. Since the limitation period for both filing an appeal and execution is the same i.e., 30 days, it becomes cumbersome and a strenuous task for the in-house Counsel to take legal opinion of the Counsel and necessary sanctions from management for filing Appeal in the State Commission. Therefore, many a times even before the appeal is filed, the Company receives a notice in the execution proceedings or bailable warrant from Forums, hence, results in harassment of the Senior officers of the Company and multiple litigation between the same parties.
  • Under Section 13 of the Consumer Protection Act, in case the complaint relates to manufacturing defect in a product, which cannot be determined without proper analysis of the product or test of goods, the Consumer Forum has to obtain a sample of the same, seal it and send it to an appropriate laboratory for proper analysis. However, such provision is hardly followed by any Forum, which results in passing of orders, which are often based on mere allegations and assumptions. As a corollary, it causes adverse impact on the interests of the Company. In fact, the Forum declares in its order that the product inspection report of the Technician/Engineer filed by the Company technicians is biased.
  • As per Consumer Protection Act, 1986, if the party against whom the order has been passed, does not comply with the order of the Forum, then the Forum may pass an order of imprisonment of not less than one month not exceeding three years, or fine of upto Rs. 10,000. Therefore, while exercising such powers, sometimes the Forums, while admitting the execution applications, directly issues bailable warrants against the directors of the Company, which causes extreme harassment to the in-house Counsel as well as the management.
  • The information available on the government portal is either incomplete or incorrect. Usually the order sheets are not even uploaded. Therefore, it becomes a task for the in-house Counsels to track the next dates, obtain orders or to do a general search to check if any case is pending against the Company, in which the Company has not even received summons from the Forum.

The solutions in hindsight to the abovementioned problems faced by the in-house Counsels is that the stakeholders may make recommendations to the Government for issuance of guidelines for the following:

  • Mandatory guidelines may be issued to provide registered office address of the Company in the complaint, as per the records of MCA along with its official email address. The Forums should serve the summons/notice of the complaint upon the Company by post as well as by email.
    The free copy of the judgement should also be sent by the Forum to the Respondent Company by email as soon as the order is passed for their information/necessary compliance etc.
  • If the consumer admits purchasing a fake/counterfeit product from an unauthorized source, then the complaint should not be admitted as there is an element of fraud and the cause of action and remedy is beyond the scope of the Act.
  • The Act should contain a similar provision as contained in the CPC, where no execution can be filed unless the statutory period of filing appeal expires.
  • In consumer complaints, where there is a challenge to technical observations of a Company official, the Supreme Court and National Commission has laid down in a catena of cases that the onus of proof should be put on the complainant for rebutting the expert opinion. The onus of proof on Complainant in such cases and the appointment of Technical Expert for his opinion should be made compulsory and also definite criteria/ prerequisite/ qualifications should be in place for appointment of Technical expert under Section 13(1)(c) of Consumer Protection Act.
  • If the Company has remained ex-parte in the complaint and the time for filing appeal is not expired, then while admitting execution applications, the Forums must issue a notice to the Company before passing any harsh orders for issuance of bailable warrants against the directors of the Company. If there is scope for amicable settlement of dispute between the parties, then ADR must be adopted.
  • ThThe website may have an option to conduct a free text search, so that it becomes easier for the in-house Counsels to conduct a periodic search of cases filed against the Company.

Last but not the least, the most primary challenge faced by an in-house Counsel in a Company is to keep a track of the number of consumer cases at different Forum levels, managing hearing dates and deadlines, hunting for local lawyers in multiple jurisdictions, settling their fees, getting the documents translated from the vernacular languages, vetting the drafts prepared by these local lawyers, etc.

For more information please contact us at :