India proposes new e-commerce regulations with focus on data rules

India outlined a new draft policy for its rapidly growing e-commerce sector on Saturday. The focus in this policy lays on data localisation, improved privacy safeguards and measures to combat the sale of falsified products.

The proposed overhaul, which would likely increase operating costs for the sector, comes two months after the country modified regulations governing foreign direct investment in e-commerce. These recent amendments in the regulations forced retail giants Amazon.com Inc and Walmart-owned Flipkart to restructure their Indian operations, and the latest reforms predict further turmoil.

The widely expected draft policy stated that in the future, economic activity is likely to follow data and that therefore it is vital that control of data is retained to ensure job creation within India. The new rules call for the housing of more data centres and server farms locally. The regulations also call for a broader push for data localisation by the South Asian nation. At this point, South Asia is one of the world’s fastest-growing online markets. India’s central bank in 2018 forced payments providers such as Mastercard and Visa Inc to store Indian users’ data locally.

"Steps will be taken to develop capacity for data storage in India,” the draft e-commerce policy said. “A period of three years would be given to allow the industry to adjust to the data storage requirement.”

Flipkart and Amazon said they were going through the draft rules and will share their inputs with the government.

The proposed rules also seek the creation of a legal and technological framework that can help impose restrictions on the cross-border flow of data generated by users. These restrictions may affect not just e-commerce platforms but also social media firms such as Google and Facebook.

India also plans to mandate all e-commerce firms to provide access to their data stored abroad whenever official requests are made. The rules, which come at a time New Delhi is working on a broader data privacy law, also forbid companies from sharing data stored abroad with other businesses even with user consent.

Other proposals include mandating all e-commerce websites or apps operating in India to have a locally registered business entity and increasing liability of e-commerce players to ensure products sold on their platforms are not counterfeit or pirated.

“Lot of issues covered, bold decisions,” was recently tweeted by the All India Online Vendors Association as a response to the draft policy. The All India Online Vendors Association represents more than 3,500 online sellers.

New Delhi has invited comments on the proposed rules by March 9, after which the rules are likely to be formalised.