Answer By law4u team
Platforms and e-commerce businesses that offer recurring transactions - such as subscription services, memberships, or automatic bill payments often need to store users' credit card or bank account details to facilitate these payments. While this can provide convenience for users, storing sensitive financial data comes with significant legal and security obligations. In India, businesses must adhere to various data protection laws, including the Information Technology Act, 2000 (IT Act), and the Personal Data Protection Bill, 2019 (PDPB), to ensure compliance and safeguard users' financial information.
Legal Framework Governing the Storage of Payment Details
Information Technology Act, 2000 (IT Act)
The IT Act, 2000, provides the primary framework for cybersecurity and data protection in India. Under the Act, businesses handling sensitive data, such as credit card or bank account details, must implement adequate security practices and privacy protections. The IT Act specifically covers the following:
- Section 43A: This section mandates that businesses implement reasonable security practices to protect sensitive personal data from unauthorized access or breach.
- Section 72A: This provision criminalizes the disclosure of personal data without consent, highlighting the importance of protecting customer data when it is stored for recurring payments.
Personal Data Protection Bill, 2019 (PDPB)
The PDPB, which is in the process of becoming law, is designed to protect personal data in India. Once enacted, the Bill will impose strict requirements on businesses that store sensitive financial data like credit card or bank details:
- Consent: Businesses must obtain explicit consent from users before collecting and storing their financial details.
- Data Minimization: Data collection should be limited to only what is necessary for the transaction, meaning businesses must avoid storing excessive data.
- Data Protection: Businesses must ensure that the stored data is protected through encryption, tokenization, and other security measures.
- Data Deletion: Users must have the right to request deletion of their data after the transaction is completed or if they wish to cancel the service.
Payment Card Industry Data Security Standard (PCI DSS)
While PCI DSS is a global standard, it is highly relevant to businesses operating in India that process credit card transactions. PCI DSS provides guidelines for handling, storing, and transmitting cardholder data in a secure manner. Businesses must ensure compliance with these standards if they store, process, or transmit credit card information for recurring payments. Key requirements include:
- Encryption: Card details must be encrypted during transmission and while stored.
- Tokenization: Platforms should tokenize sensitive card information. This means converting actual card details into a random token that is useless to attackers if intercepted.
- Access Control: Only authorized personnel should have access to sensitive financial data.
- Regular Audits: Businesses must conduct security audits to ensure compliance with PCI DSS.
RBI Guidelines on Card Data Storage
The Reserve Bank of India (RBI) has issued guidelines on storing card details for recurring transactions. Under the RBI’s tokenization framework, businesses are required to tokenize card details instead of storing them in their systems directly. This ensures that even if the platform is compromised, actual card details are not exposed, thus reducing the risk of fraud.
- As of 2022, RBI requires that card details for recurring transactions be tokenized and stored by the payment gateway or authorized entities, not directly by merchants.
- Tokenized card details are not stored on the merchant’s system and cannot be accessed by the merchant itself, ensuring enhanced security.
Requirements for Storing Payment Details for Recurring Transactions
Explicit User Consent
Before storing sensitive financial data, platforms must obtain explicit consent from users. The user should be informed of:
- The purpose of storing their financial data (e.g., for recurring payments).
- The security measures in place to protect their data.
- Their right to withdraw consent and request the deletion of their data at any time.
Data Encryption and Tokenization
Platforms that store credit card or bank account details must ensure that these details are encrypted both in transit (when being sent to the server) and at rest (when stored on the server). Additionally, tokenization should be used, where actual card details are replaced with randomly generated tokens, ensuring that sensitive data is not stored in its raw form.
Access Controls and Security Measures
Businesses must implement access controls to ensure that only authorized personnel can access the stored financial data. This may include:
- Multi-factor authentication for accessing sensitive information.
- Security audits to verify that the platform complies with industry security standards like PCI DSS.
Right to Data Deletion
Users must be given the right to delete their payment details if they choose to stop the recurring transaction or cancel the service. The platform should have a clear process for users to request data deletion and ensure that the data is completely removed from its systems.
Retention Limits
Platforms should have a clear data retention policy that specifies how long payment details will be stored. Once the data is no longer needed (for example, after the subscription or recurring payment is canceled), it should be deleted or securely destroyed.
Example Scenario:
Suppose a user subscribes to a monthly subscription service on an e-commerce platform, and the platform needs to store the user’s credit card details for automatic billing. Here’s what the platform must do to ensure compliance with Indian law:
Obtain Explicit Consent:
The platform must ask the user for explicit consent before storing their credit card information. This can be done through a pop-up or checkbox, where the user agrees to the terms, including data storage for recurring payments.
Tokenization:
The platform uses a payment gateway to tokenize the card details, meaning the actual card information is replaced with a secure token. This token is stored on the platform, not the actual card details.
Encryption:
The tokenized data is encrypted both during transmission and when stored in the platform’s database.
Regular Audits and Compliance:
The platform conducts regular security audits to ensure compliance with PCI DSS standards.
Data Deletion Rights:
If the user cancels the subscription or opts out of recurring payments, they can request that their payment details be deleted from the system.
Security Measures:
The platform implements multi-factor authentication for any employee or system accessing the tokenized payment data.
Summary:
Platforms can store credit card or bank details for recurring transactions in India, but they must comply with strict data protection and security standards. This includes obtaining explicit user consent, tokenizing sensitive payment data, encrypting it both in transit and at rest, and adhering to guidelines such as PCI DSS and the RBI’s tokenization framework. Platforms must also provide users with the right to data deletion and ensure compliance with Indian laws, including the Information Technology Act and the Personal Data Protection Bill.
