Data Localization

Data localization is the requirement, imposed by law or regulation, that specified categories of data be kept within the borders of the country where they originate. In its strictest form the data may be stored and processed only on domestic servers and may not leave the country. Milder forms require that a copy be kept locally while allowing transfer abroad, or permit foreign processing on condition that the data is returned and deleted elsewhere.

Payment data is one of the categories most often covered, together with personal data, health records, telecommunications data and government information. For card networks, processors and cross-border payment companies that run on centralized global platforms, localization rules can require building or renting infrastructure in each country concerned. The term is related to data residency, which describes where data is kept, whether by legal obligation or by choice.

• Supervisory access. Regulators want to be able to inspect records and obtain data quickly without relying on foreign courts or the cooperation of a foreign parent company.
• Law enforcement and security. Domestic storage puts data within reach of local warrants and beyond the easy reach of foreign governments.
• Privacy. Some governments argue that personal data is safer under domestic law than under the law of the country to which it would be sent.
• Resilience. Keeping processing onshore is intended to ensure that domestic payments continue if foreign providers withdraw or are cut off by sanctions.
• Industrial policy. Local data centre investment, jobs and an advantage for domestic firms are frequent, if less openly stated, motives.

Laws differ on what must stay and how strictly. A hard requirement confines both storage and processing to the country. A mirroring requirement demands that a copy be held locally but leaves companies free to process abroad. A conditional regime allows export only after a regulator's security assessment, the individual's consent or a finding that the destination offers adequate protection. Requirements may be general, applying to all personal data, or sectoral, applying to payments, banking records, credit information or telecommunications.

Rules of general data protection that restrict transfers, such as the European Union's General Data Protection Regulation, are usually not classed as localization, because they do not require local storage; they attach conditions to sending personal data abroad.

India is the most cited case. In April 2018 the Reserve Bank of India directed all payment system providers to store the full data relating to payment systems they operate only in India, with a compliance deadline six months later. Later clarifications allowed a transaction to be processed abroad provided that the data was deleted from foreign systems and brought back to India within a short period. In 2021 the central bank barred American Express, Diners Club and Mastercard from issuing new cards in India for not complying; the restrictions were lifted over the following year once the networks satisfied the regulator.

Russia required from 2015 that personal data of its citizens be recorded and stored in databases on Russian territory. Separately, after international card networks suspended services to some sanctioned Russian banks in 2014, a law required domestic card transactions to be processed inside the country through a national switch. As a result, cards issued by Russian banks continued to work domestically when the international networks withdrew from the country in 2022.

China's Cybersecurity Law of 2017 and later data laws require operators of critical information infrastructure to store personal and important data gathered in China within the country and to pass an assessment before exporting it. Indonesia, Vietnam, Turkey, Nigeria and other countries have rules requiring domestic processing or storage of some payment or financial data.

Compliance usually means deploying systems in a local data centre or a local region of a cloud computing provider, and redesigning applications so that data from the country can be separated from the rest. This has costs beyond hardware. Global fraud detection models work best when they can see patterns across countries, and a card stolen in one market is often tested in another. Transaction monitoring for money laundering and sanctions is typically run centrally for the same reason. Splitting data by country can weaken both unless models are trained locally or only anonymized signals are shared.

Localization tends to favour a domestic card scheme and local processors, which already operate onshore. India's RuPay and Russia's Mir are examples of domestic networks whose position was strengthened by such policies. Smaller foreign entrants may decide that a market is not worth the fixed cost, which reduces competition. Regulated firms that outsource to global vendors must also show, as part of outsourcing oversight, that those vendors meet the storage rules.

Critics, including many trade bodies and some economists, describe localization as a barrier to digital trade that raises costs, fragments the internet and offers little real security, since data kept in many small facilities may be less well protected than data in a few large ones, and since encryption and contractual access rights can meet supervisors' needs. Several trade agreements include commitments against such requirements, often with exceptions for financial services. Supporters reply that access to data in a crisis cannot depend on a foreign jurisdiction's goodwill, and point to sanctions episodes as evidence that reliance on offshore processing is a strategic risk.