RBI tightens rules for digital payment firms to check rise in data leaks

<p>
The Reserve Bank of India has tightened its supervision norms over digital payment companies storing customer data as instances in cyber-security breaches at Indian tech startups are on the rise. </p>
<p>
The new rules, which kick in from April 1, require all licensed payment system operators (PSOs) to submit detailed compliance certificates to the RBI twice a year confirming adherence to all RBI regulations around security and storage of payment data. The statements will have to be signed by the CEOs or managing directors of the companies as responsibility is being fixed at the highest level.</p>
<p>
These certificates have to be submitted on April 30 and October 31 for the period ending March 31 and September 30, respectively, every year.</p>
<p>
The RBI had earlier in April 2018 asked all PSOs to submit board-approved annual System Audit Report (SAR) by CERT-empanelled auditors which also remain in force.</p>
<p>
The payment companies were then asked to submit a one-time compliance report with data localisation norms which mandate the data relating to payments in India will be stored in a server physically present in the country, by December of 2018.</p>
<p>
<strong>Mobikwik data leak case</strong></p>
<p>
Several payment and tech startups have seen data breaches. Fintech startup Mobikwik is the latest to come in the eye of a storm amid reports that the data of its customers were available on the dark web.</p>
<p>
In what is believed to be one of the worst cases of data leaks, important information of 9.9 crore Mobikwik users has been leaked online. However, the digital payments company has denied the leak.</p>
<p>
The disclosure about the data leak was made by cybersecurity analyst Rajashekhar Rajaharia who has also written to the Reserve Bank of India, Indian computer emergency response team, PCI Standards, and payment technology firms, etc.</p>
<p>
Other companies that have recently been affected are grocery e-tailer Big Basket, educational technology platform Unacademy and payment aggregator JusPay.</p>