3 ms·

Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

by bserge 5y ago

kyrra 5y ago
Yes, it is. You either need to entirely fork your operation to have it operate entirely within India, or be extremely careful with how you store your data, and store the data only in India, but process it in other data centers without ever having it touched disk. Which I believed means you can never even log the data.
- ntrz 5y ago
  The rule[0] says that you can process the data abroad, including storing it on disk temporarily for purposes of processing, as long as it is deleted within 24 hours. So it's not quite as strict as requiring it be kept in memory the whole time without ever writing to disk, but it does sound like you probably couldn't keep detailed logs. [0] https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=2995 https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id...
  - KineticLensman 5y ago
    > but it does sound like you probably couldn't keep detailed logs. Or backups.
    - toomuchtodo 5y ago
      Backups for India can be kept in India. It is a big country.
- BitwiseFool 5y ago
  As difficult as this will be to implement, I suspect it will be a boon for the Indian IT industry. I suspect MasterCard and others will comply with the new law in due time simply because the Indian market is so vast and full of revenue potential.
- captn3m0 5y ago
  The original RBI circular was in 2018[1] with a audit date set for December 2018. That wasn't met as most companies requested for an extension, which the RBI gave multiple times. So yes, it is difficult - but it has been years since MasterCard knew about this. [1]: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11244&Mode=0 https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=1124...
- passivate 5y ago
  How long do you think it will take to do it?
vishnugupta 5y ago
The physical hosting while not trivial is not a big challenge. They need to find a reliable hosting provider in India and there are many. Where it gets really hairy is routing. Example - handling payments of Indian international travellers; or card details entered on websites that are hosted outside of India. I worked on a similar project but 1/10th of scale and even then it was extremely tricky to cover all the edge cases.

Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

by bserge 5y ago

Is this hard to implement for MasterCard? Otherwise, it seems reasonable to me, but I'm not that knowledgeable in this area.

kyrra 5y ago

Yes, it is. You either need to entirely fork your operation to have it operate entirely within India, or be extremely careful with how you store your data, and store the data only in India, but process it in other data centers without ever having it touched disk. Which I believed means you can never even log the data.

ntrz 5y ago
The rule[0] says that you can process the data abroad, including storing it on disk temporarily for purposes of processing, as long as it is deleted within 24 hours. So it's not quite as strict as requiring it be kept in memory the whole time without ever writing to disk, but it does sound like you probably couldn't keep detailed logs. [0] https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id=2995 https://rbi.org.in/CommonPerson/english/Scripts/FAQs.aspx?Id...
- KineticLensman 5y ago
  > but it does sound like you probably couldn't keep detailed logs. Or backups.
  - toomuchtodo 5y ago
    Backups for India can be kept in India. It is a big country.
BitwiseFool 5y ago
As difficult as this will be to implement, I suspect it will be a boon for the Indian IT industry. I suspect MasterCard and others will comply with the new law in due time simply because the Indian market is so vast and full of revenue potential.
captn3m0 5y ago
The original RBI circular was in 2018[1] with a audit date set for December 2018. That wasn't met as most companies requested for an extension, which the RBI gave multiple times. So yes, it is difficult - but it has been years since MasterCard knew about this. [1]: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11244&Mode=0 https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=1124...
passivate 5y ago
How long do you think it will take to do it?

vishnugupta 5y ago

The physical hosting while not trivial is not a big challenge. They need to find a reliable hosting provider in India and there are many. Where it gets really hairy is routing. Example - handling payments of Indian international travellers; or card details entered on websites that are hosted outside of India. I worked on a similar project but 1/10th of scale and even then it was extremely tricky to cover all the edge cases.