Hacker News Reader

Comment by bserge | Hacker News Reader

Is this hard to implement for MasterCard?

Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

Yes, it is. You either need to entirely fork your operation to have it operate entirely within India, or be extremely careful with how you store your data, and store the data only in India, but process it in other data centers without ever having it touched disk. Which I believed means you can never even log the data.

The rule[0] says that you can process the data abroad, including storing it on disk temporarily for purposes of processing, as long as it is deleted within 24 hours. So it's not quite as strict as requiring it be kept in memory the whole time without ever writing to disk, but it does sound like you probably couldn't keep detailed logs.

[0] https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id...

> but it does sound like you probably couldn't keep detailed logs.

Or backups.

Backups for India can be kept in India. It is a big country.

As difficult as this will be to implement, I suspect it will be a boon for the Indian IT industry. I suspect MasterCard and others will comply with the new law in due time simply because the Indian market is so vast and full of revenue potential.

The original RBI circular was in 2018[1] with a audit date set for December 2018. That wasn't met as most companies requested for an extension, which the RBI gave multiple times.

So yes, it is difficult - but it has been years since MasterCard knew about this.

[1]: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=1124...

How long do you think it will take to do it?

The physical hosting while not trivial is not a big challenge. They need to find a reliable hosting provider in India and there are many.

Where it gets really hairy is routing. Example - handling payments of Indian international travellers; or card details entered on websites that are hosted outside of India.

I worked on a similar project but 1/10th of scale and even then it was extremely tricky to cover all the edge cases.

Reply on news.ycombinator.com