India proposes new e-commerce regulations with focus on data rules

India also plans to mandate all e-commerce firms to provide access to their data stored abroad

​New Delhi: India outlined a new draft policy for its burgeoning e-commerce sector on Saturday, focusing on data localisation, improved privacy safeguards and measures to combat the sale of counterfeit products.

The proposed overhaul, which would likely increase operating costs for the sector, comes two months after the country modified regulations governing foreign direct investment in e-commerce.

That forced retail giants Amazon.com Inc and Walmart-owned Flipkart to restructure their Indian operations, and the latest reforms spell further upheaval.

“In the future, economic activity is likely to follow data,” the widely expected draft policy document said. “It is hence vital that we retain control of data to ensure job creation within India”.

The new rules call for the housing of more data centres and server farms locally, amid a broader push for data localisation by the South Asian nation, which is one of the world’s fastest-growing online markets.

India’s central bank in 2018 forced payments providers such as Mastercard and Visa Inc to store Indian users’ data locally.

“Steps will be taken to develop capacity for data storage in India,” the draft e-commerce rules said. “A period of three years would be given to allow industry to adjust to the data storage requirement.”

Flipkart and Amazon said they were going through the draft rules and will share their inputs with the government.

The proposed rules also seek the creation of a “legal and technological framework” that can help impose restrictions on the cross-border flow of data generated by users, moves that may affect not just e-commerce platforms but also social media firms such as Alphabet Inc’s Google and rival Facebook Inc.

India also plans to mandate all e-commerce firms to provide access to their data stored abroad whenever official requests are made. The rules, which come at a time New Delhi is working on a broader data privacy law, also forbid companies from sharing data stored abroad with other businesses even with user consent.

Other proposals include mandating all e-commerce websites or apps operating in India to have a locally registered business entity, and increasing liability of e-commerce players to ensure products sold on their platforms are not counterfeit or pirated.

“Lot of issues covered, bold decisions,” the All India Online Vendors Association, which represents more than 3,500 online sellers, said in a tweet.

New Delhi has invited comments on the proposed rules by March 9, after which the rules are likely to be formalised.