India proposes new e-commerce regulations focusing on data rules

Authors: Aditya Kalra and Sankalp Phartiyal

NEW DELHI/MUMBAI (Reuters) – India on Saturday unveiled a new draft policy for its growing e-commerce sector, focusing on data localization, improved privacy protections and measures to combat the sale of counterfeit products.

The proposed amendment, which would likely increase the sector’s operating costs, comes two months after the country modified rules governing foreign direct investment in e-commerce.

This has forced retail giants Amazon.com Inc and Walmart-owned Flipkart to restructure their operations in India, and the latest reforms spell further upheaval.

“Economic activity in the future is likely to follow data,” said the widely anticipated draft strategy paper. “It is therefore important that we maintain control over data to ensure job creation in India.”

The new rules require locating more data centers and server farms amid a broader push for data localization from the South Asian country, which is one of the world’s fastest-growing internet markets.

India’s central bank in 2018 forced payment service providers such as Mastercard and Visa Inc to store Indian users’ data locally.

“Steps will be taken to enhance data storage capacity in India,” the draft e-commerce regulations said. “A period of three years would be granted for the industry to comply with data retention requirements.”

Flipkart and Amazon said they are reviewing the draft regulations and will share their comments with the government.

The proposed rules also aim to create a “legal and technological framework” that could help impose restrictions on the cross-border flow of user-generated data, which could impact not only e-commerce platforms but also social media companies such as Alphabet Inc, Google and rival Facebook Inc.

India also plans to make it mandatory for all e-commerce companies to provide access to their data stored abroad in the event of an official request. The rules, which come into force as New Delhi works on a broader data privacy law, also prohibit companies from sharing data stored overseas with other companies, even with user consent.

Other proposals include requiring all e-commerce websites and applications operating in India to have a locally registered business entity and increasing the responsibility of e-commerce entities to ensure that products sold on their platforms are not counterfeit or pirated.

“Many issues raised, bold decisions,” said the All India Online Vendors Association, which represents over 3,500 online sellers, in a tweet.

New Delhi has asked for comments on the proposed rules by March 9, after which they are likely to be formalized.

(Reporting by Aditya Kalra and Sankalp Phartiyal; Editing by Euan Rocha)