India Mandates Five-Year Data Saving for Crypto Exchanges, Concerned Experts Foresee Corporate Upheaval

CERT-In's new law also instructs crypto, VPN, and Cloud companies to report any threat or compromise to security networks within six hours.

By Radhika Parashar | Updated: 2 May 2022 17:14 IST

India Mandates Five-Year Data Saving for Crypto Exchanges, Concerned Experts Foresee Corporate Upheaval

Photo Credit: Pixabay/ Darshak Pandya

CERT-In's new law to come into effect after 60 days

Highlights

CERT-In monitors India’s overall cyber security arrangements
Crypto exchanges, VPN, Cloud players hit by new law
Relevant firms could have to change working, hiring models

India has mandated a five-year data storage period for crypto exchanges operating in the nation. All virtual asset service providers will essentially have to store customer information they get via their KYC identification forms for Indian users. The rule also applies to all firms providing Virtual Private Network (VPN) services to Indians. The law has been brought in by India's Computer Emergency Response Team (CERT-In). It also instructs concerned companies to report any threat or compromise to security networks within six hours of identifying.

“To address the identified gaps and issues so as to facilitate incident response measures, CERT-In has issued directions relating to information security practices, procedure, prevention, response and reporting of cyber incidents” the government-backed agency said in a statement.

India has witnessed a healthy growth in crypto adoption. Last year, Tracxn data claimed that India already has close to 400 crypto-startups and 12 non-fungible token (NFT) players in the country.

Samsung Wins Patent for a Tri-Fold Smartphone With Specialised Barrier Layer for Improved Durability

Industry insiders have expressed concerns about the slew of corporate changes that are foreseeable because of this new law, at this point where the crypto ecosystem is still in its early establishment stages in India.

“I think this request from the government of India is extraordinary when it comes to the preservation of data for long, five years. So, I believe they have to completely change their business models if they want to comply with the new rules,” Anshul Dhir, Co-founder and Chief Operating Officer (COO) of EasyFi Network told Gadgets 360. India-founded EasyFi is a Layer 2 DeFi Lending protocol for digital assets powered by Polygon blockchain.

Sensitive data such as IP addresses with timestamps and time zones, transaction IDs, public keys, and wallet addresses have been named by the CERT-In in the list of information that digital assets firms need to store for five years.

Yuga Labs 'Otherdeed' Metaverse Land Sale Rakes in $320 Million

Additional tracking data such as the nature and date of transaction along with details on the amount transferred have also been listed to be maintained and saved.

The CERT-In has justified its decision citing national security and cyber safety reasons.

This rule, seeking sensitive user information, could lead to a largescale departure of customers from affected services, Kazim Rizvi, the Founding Director of Indian think tank ‘The Dialogue' told Gadgets 360.

“The customer information sought under this requirement is sensitive and could deter consumers from availing the affected VPN, crypto, and Cloud services,” Riavi said.

Many companies use VPNs to secure their systems and operations and additional burden on VPN players. As per Rizvi, a lawyer by degree, this law could deter them from operating in India, thus impacting the security of businesses and privacy of users in the nation.

The public policy entrepreneur has suggested the Indian government to refrain from “burdening” crypto, VPN, and Cloud players in the country.

“It is imperative that we refrain from placing additional burdens which may not help CERT-In achieve its objectives, while at the same time might affect the growth of relevant sectors in India. We believe the additional data collection may not be necessary for achieving the cyber security objectives. Also, for validation for customers, all service providers will have to develop additional infrastructure, which will increase costs of operation,” Rizvi added.

The EasiFi chief had also seconded Rizvi in predicting that the CERT-In rule could be detrimental to the ongoing growth trajectory of the impacted sectors.

As per the Indian government, these directions will become effective after 60 days.

Along with crypto exchanges, custodian wallet providers have also been included on the list of virtual asset industry players that will be impacted by this rule.

India has been introducing new rules in order to keep transactions of virtual digital assets, traceable. The government aims to curb potential misuses of digital assets for money laundering and terror financing.

The tax rules on digital asset transactions went live in India last month.

Days later, research firm Crebaco reported that the volume of cryptocurrency trading in India nosedived by upto 70 percent since the tax laws came into effect.

The country is not looking to give any tax relaxations or incentives to crypto players setting up the industry ecosystem. In March, industry experts had raised concerned on India's restricted approach to the virtual assets industry.

Xiaomi 12 Pro is littered with features, but is that enough? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Further reading: Cryptocurrency, India, CERT In, Tax Crypto Tax

Radhika Parashar

Email Radhika

Radhika Parashar is a senior correspondent for Gadgets 360. She has been reporting on tech and telecom for the last three years now and will be focussing on writing about all things crypto. Besides this, she is a major sitcom nerd and often replies in Chandler Bing and Michael Scott references. For tips or queries you could reach out to her at RadhikaP@ndtv.com. More