How does data localisation work?
Rules differ by country in what data they cover, who must comply and whether copies may leave. DLA Piper’s data protection guide says Russia has, since 2015, required operators to store and process personal data of Russian individuals in databases located in Russia, with processing abroad possible if the initial storage and processing happen there. For Kazakhstan, the same guide says personal data should be stored in databases located in Kazakhstan, and that cross-border transfers are limited. Some rules cover payment data rather than personal data: the Reserve Bank of India’s 2018 circular requires payment system providers to store the entire data relating to the payment systems they operate in a system only in India, while allowing the foreign leg of a transaction to be stored abroad too.
Why does it matter for payments?
It limits which providers a merchant can use in a market. A PSP or token vault hosted only abroad may not meet a local rule, so merchants often need a provider with in-country infrastructure. As an illustrative example: a merchant sells 300,000 euros a month in a country with a strict localisation rule. If only two of its five connected PSPs store data in the country, all of that volume has to go through those two, and routing rules must make sure it does.
What are the limits?
Requirements change and have exceptions. DLA Piper lists website blocking and fines of up to 18,000,000 roubles for repeat violations in Russia. Whether a rule reaches a foreign merchant with no local presence is often unclear, so merchants should take local legal advice before entering a market.
Where does Omno use it?
Omno does not give legal advice, and where data must stay depends on the law and the providers involved. Eligibility rules filter providers by country and payment method, so traffic for a market can be limited to providers that meet its rules, and the routing-decision log records which provider processed each payment.