Common payments system on BRICS agenda. How would it work in tandem with India’s data protection norms
A common cross-border payments system is on the agenda of the 18th BRICS Summit, to be hosted by India on 12–13 September 2026 at Bharat Mandapam, New Delhi.
The proposed mechanism is envisioned as a low-cost, transparent alternative payment rail that reduces dependence on the dollar-denominated SWIFT messaging network, building on the 2025 BRICS Leaders' Declaration commitment to a "fast, low-cost, accessible, efficient, transparent and safe" cross-border payments system.
Any such system will have to operate alongside India's existing data protection and financial-data localisation framework, principally the Digital Personal Data Protection Act, 2023 (DPDP Act) and Reserve Bank of India (RBI) regulations on payment-system data.
Legal experts note that India's regulatory approach balances the DPDP Act's relatively liberal cross-border transfer regime with RBI's stricter, sector-specific data localisation mandate for payment data.
RBI Payment Data Localisation Mandate (2018)
The RBI's circular of 6 April 2018 directed all payment system operators to ensure that the entire data relating to payment systems operated by them is stored only in India, within a six-month compliance window. This was issued under the Payment and Settlement Systems Act, 2007, to enable "unfettered supervisory access" to payment data for regulatory and law-enforcement purposes.
Key Details
- Full end-to-end transaction data (customer details, credentials, transaction logs) must reside exclusively in India.
- Foreign leg data (e.g., overseas merchant/beneficiary details) may be processed abroad but must be deleted from foreign systems within 24 hours of processing and stored only in India.
- The mandate applies to all payment system operators, including foreign players, and is distinct from and predates the DPDP Act.
Any BRICS common payments platform routing Indian transaction data through a shared regional infrastructure would still have to comply with this India-only storage requirement, making data architecture (not just currency settlement) a key design constraint for the initiative.
Digital Personal Data Protection Act, 2023 — Section 16 (Cross-Border Transfer)
The DPDP Act, 2023 is India's first comprehensive personal data protection law, replacing the data-protection provisions of the Information Technology Act, 2000/SPDI Rules, 2011. Section 16 adopts a "negative list" (blacklist) approach: personal data may be transferred to any country or territory outside India except those specifically restricted by the Central Government through notification.
A BRICS payments system built on shared or interoperable rails (linking India's UPI-style systems with Russia's SPFS, China's CIPS, and Brazil's Pix) would need to reconcile DPDP's liberal cross-border stance with RBI's mandatory in-India storage of payment data — the article's central tension.
BRICS Pay / Cross-Border Payments Initiative
BRICS Pay (also called the BRICS Cross-Border Payments Initiative) is a proposed payment messaging and settlement mechanism intended to allow BRICS members to trade using local currencies, built around interoperable national payment systems and central bank digital currency (CBDC) pilots rather than a single centralised platform.
Key Details
- Distinct from the New Development Bank (NDB), which is a project-lending multilateral development bank established in 2014 (Fortaleza Declaration) and headquartered in Shanghai, with founding members Brazil, Russia, India, China and South Africa; NDB membership has since expanded to include Bangladesh, UAE, Egypt and others.
- BRICS Pay is designed as principle-based, respecting national data sovereignty rather than imposing a single centralised data regime — a design choice directly responsive to concerns like India's localisation rules.
- India assumed the BRICS Chairship for 2026 (its fourth term, after 2012, 2016 and 2021).
The "common payments system" referenced in the news is this BRICS Pay/BCBPI initiative, not the NDB; distinguishing the two — a payments messaging network versus a development bank — is a frequent prelims trap.
- 18th BRICS Summit: 12–13 September 2026, Bharat Mandapam, New Delhi; India holds the 2026 BRICS Chairship.
- RBI data localisation circular: issued 6 April 2018 under the Payment and Settlement Systems Act, 2007; six-month compliance deadline.
- DPDP Act, 2023, Section 16: cross-border transfer allowed by default except to government-notified restricted countries (negative-list model).
- New Development Bank: established July 2014 (Fortaleza), operational from July 2015 (Ufa); HQ Shanghai; five founding members (Brazil, Russia, India, China, South Africa), later expanded (Bangladesh, UAE, Egypt, and others).
- National payment systems referenced as potential BRICS Pay building blocks: India's UPI, Russia's SPFS, China's CIPS, Brazil's Pix.