Data localisation is a critical requirement for financial sector organizations using Software as a Service (SaaS) solutions. SEBI, in coordination with CERT-In, has emphasized that critical data must remain within the legal and jurisdictional boundaries of India. This article provides a comprehensive technical analysis of the data localisation requirement.
Regulatory Basis
SEBI/CERT-In Advisory
The SEBI advisory on SaaS-based solutions emphasizes that critical data must be kept within the legal boundary of India. This is to ensure data sovereignty and minimize risks associated with cross-border data transfers.
CSCRF Framework
The CSCRF framework requires that all financial data, including logs from data centers and disaster recovery systems, must be stored and processed within the geographical boundaries of India.
Why Data Localisation is Required
1. Data Sovereignty
Data sovereignty means that data is subject to the laws of the country where it is located. Keeping data within India ensures that Indian laws apply.
2. Regulatory Compliance
SEBI and RBI require financial data to be stored within India.
3. Security
Keeping data within India reduces the risk of unauthorized access by foreign entities.
4. Control
Data localisation enables better control over data access and usage.
5. Jurisdictional Clarity
Data localisation provides clarity on which laws apply to the data.
What Data Must Be Localised
1. Financial Data
- Credit Risk Data
- Liquidity Risk Data
- Market Risk Data
- All financial transaction data
2. Regulatory Data
- Regulatory filings
- Compliance data
- Audit data
3. System Data
- System configuration data
- Network topography data
- System vulnerability information
4. Client Data
- Client KYC data
- Client transaction data
- Client personal information
5. Logs
- Data center logs
- Disaster recovery logs
- Security logs
Data Localisation Requirements
1. Storage
All financial data must be stored within India.
2. Processing
All data processing must occur within India.
3. Encryption Keys
Data encryption keys must remain within Indian jurisdiction.
4. Routing
Routing through foreign servers may breach data localization requirements.
5. Subcontractors
REs are accountable for ensuring subcontractors of Cloud Service Providers comply with data localization requirements.
Exemptions
SEBI granted an exemption for IT and cybersecurity data that REs send to international Security Operations Centers (SOCs) or SaaS-based cybersecurity solutions.
Compliance Requirements
1. Data Mapping
Map all data flows to identify data that leaves India.
2. Data Localisation
Ensure all critical data is stored and processed within India.
3. Vendor Compliance
Ensure SaaS vendors comply with data localisation requirements.
4. Monitoring
Monitor data flows to ensure compliance.
5. Reporting
Report compliance to SEBI.
Common Compliance Gaps
1. Data Stored Outside India
Some RAs store critical data outside India.
Solution: Ensure all critical data is stored within India.
2. Routing Through Foreign Servers
Some RAs route data through foreign servers.
Solution: Ensure routing does not breach data localisation requirements.
3. Vendor Non-Compliance
Some SaaS vendors do not comply with data localisation.
Solution: Ensure vendors comply.
4. No Data Mapping
Some RAs do not map data flows.
Solution: Conduct data mapping.
Conclusion and How Anuj Desai & Associates Can Help
Data localisation is a critical compliance requirement for RAs using SaaS solutions.
Anuj Desai & Associates offers specialized services to help RAs comply with data localisation requirements:
- Data mapping and assessment
- Vendor compliance review
- Data localisation implementation
- Compliance reporting
- Compliance audit and advisory
Contact us today to ensure your data localisation practices comply with SEBI requirements. Our team will guide you through the process.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers are advised to consult qualified professionals for legal and compliance matters. Anuj Desai & Associates is a SEBI compliance consulting firm based in India.