Data localisation is a critical compliance requirement for portfolio managers using SaaS tools. This article explains the requirements and why critical data must stay in India.
The Regulatory Framework
Data Localisation Mandate
SEBI's framework for adoption of cloud services requires regulated entities to ensure localization of data within the legal boundaries of India.
Purpose
Data localisation aims to:
- Ensure SEBI's right to access regulated entities' data
- Protect sensitive financial data
- Maintain regulatory oversight
- Safeguard investor interests
Key Requirements
Data Storage Location
All critical data must be stored within the geographical boundaries of India. Data cannot be stored outside India without explicit regulatory approval.
Data Encryption Keys
Data encryption keys must remain within Indian jurisdiction. Routing through foreign servers may breach data localization requirements.
Data Ownership
Regulated entities must retain complete ownership of their data, logs, etc. residing in the cloud.
Subcontractor Compliance
Regulated entities are accountable for ensuring subcontractors of Cloud Service Providers also comply with STQC/MeitY norms.
Why Critical Data Must Stay in India
Regulatory Access
SEBI requires the right to access regulated entities' data and rights of search and seizure. If data is stored outside India, SEBI may not be able to exercise these rights effectively.
Investor Protection
Data localisation ensures that investor data is protected under Indian law. This is particularly important for sensitive financial data.
National Security
Financial data is critical to national security. Keeping data within India helps protect against foreign surveillance and data breaches.
Legal Framework
Indian law provides the legal framework for data protection and regulatory oversight. Data stored outside India may not be subject to the same protections.
Compliance
Data localisation is a regulatory requirement. Non-compliance can result in enforcement action.
What Data Must Be Localised
Client Data
- KYC documents
- Client agreements
- Client portfolio information
- Transaction records
Financial Data
- Investment records
- Trade data
- Account statements
- Fee records
Compliance Data
- Compliance reports
- Audit reports
- Regulatory filings
- Inspection records
Operational Data
- Operational records
- System logs
- Security logs
- Communication records
SaaS Tools and Data Localisation
Cloud Service Providers
When using SaaS tools from cloud service providers, ensure:
- Data is stored in India
- Data encryption keys are in India
- Subcontractors comply with localisation requirements
Data Transfer
Data cannot be transferred outside India without:
- Explicit regulatory approval
- Appropriate safeguards
- Data protection agreements
Vendor Selection
When selecting SaaS providers:
- Verify data localisation capabilities
- Assess compliance with regulatory requirements
- Review data storage locations
Consequences of Non-Compliance
Regulatory Action
Non-compliance with data localisation requirements can result in enforcement action by SEBI.
Data Breach
Data stored outside India may be subject to foreign laws and surveillance.
Reputational Damage
Data localisation non-compliance can damage reputation.
Expert Legal Guidance
Anuj Desai & Associates provides expert legal advisory services on data localisation compliance for portfolio managers. Our securities law experts help clients implement compliant data storage practices, select appropriate SaaS providers, and ensure regulatory compliance. Contact us for guidance on data localisation and other regulatory matters.