Author: Amarja Sandeep Narwadkar.
College: Bharati Vidhyapeeth New Law College, Pune
LinkedIn Profile: https://www.linkedin.com/in/amarja-narwadkar-676a90426?utm_source=share_via&utm_content=profile&utm_medium=member_ios
The rapid growth of digital payments has transformed the way financial transactions are carried out in India. The Unified Payments Interface (UPI) has become an important part of this transformation and is increasingly being connected with payment systems in other countries. While cross-border payment connectivity can make international transactions faster, easier and more affordable, it also raises concerns relating to data privacy, cybersecurity, financial regulation and national security.
Recent concerns surrounding a proposed UPI-Alipay+ linkage have brought these issues into focus. Reports indicated concerns regarding customer-data handling, national security, money laundering and cyber fraud. This development raises an important question: how can India expand UPI internationally while ensuring that the personal and financial information of its citizens remains protected?
This article examines the legal framework governing cross-border payment data in India, with reference to the constitutional right to privacy, the Digital Personal Data Protection Act, 2023 and the regulatory role of the Reserve Bank of India. It also discusses relevant judicial decisions and argues that privacy and national security should not be treated as competing interests. A balanced approach based on necessity, proportionality, transparency and accountability is required for the future of cross-border digital payments.
Keywords:
UPI, Cross-Border Payments, Data Privacy, National Security, RBI, Digital Personal Data Protection Act, Financial Data, Cybersecurity, Data Localisation.
India’s payment system has changed significantly with the growth of digital technology. Digital payments have become a part of everyday life, from purchasing basic goods to transferring money between bank accounts. The Unified Payments Interface (UPI) has played an important role in this transformation by allowing users to make quick and convenient payments through their mobile devices.
The development of UPI is no longer limited to domestic transactions. India is increasingly exploring international connectivity for UPI so that Indian users can make payments in other countries. Such connectivity can benefit tourists, students, businesses and individuals making international transactions. It can also strengthen India’s position in the global digital-payment sector.
However, international payment connectivity also creates legal concerns. A domestic UPI transaction generally operates within India’s regulatory framework. A cross-border transaction may involve banks, payment service providers and technology companies situated in different countries. This creates questions about where transaction data is stored, who can access it, which country’s laws apply and who is responsible if the information is misused.
The issue has gained attention following reports concerning a proposed UPI-Alipay+ linkage. The proposal reportedly faced concerns relating to national security, customer-data handling, money laundering and cyber fraud. The development demonstrates that technological convenience cannot be separated from questions of privacy and security.
Therefore, the central question is not whether India should encourage cross-border digital payments. The real question is how such systems can be developed while protecting individual privacy and India’s financial security.
UPI, Cross-Border Payments, Data Privacy, National Security, Digital Personal Data Protection Act, 2023, Reserve Bank of India, Financial Data, Cybersecurity, Data Localisation, FinTech.
Data Localisation: Requirements concerning the storage or processing of data within a particular country’s territory.
Cross-Border Data Transfer: Movement or processing of personal data outside the country where it was originally collected.
Personal Data: Information relating to an identifiable individual.
Data Fiduciary: An individual or organisation that determines the purpose and means of processing personal data.
Data Minimisation: The principle of collecting and processing only the information necessary for a particular purpose.
Purpose Limitation: The principle that personal information should be collected and used for a specific and legitimate purpose.
Financial Privacy: Protection of information relating to a person’s banking activities and financial transactions.
Right to Privacy under Article 21
The constitutional foundation of data privacy in India can be found in Article 21 of the Constitution, which protects life and personal liberty.
In Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court recognised privacy as a fundamental right. The Court connected privacy with dignity, liberty and individual autonomy.
This principle is highly relevant to digital payments. A person’s transaction history can reveal information about their financial activities, spending patterns and other aspects of their personal life. Therefore, financial information cannot simply be treated as ordinary commercial data.
Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 provides an important statutory framework for processing digital personal data in India.
The Act establishes obligations relating to the processing of personal data and provides rights and protections to individuals. It also provides a framework concerning cross-border transfer of personal data, subject to restrictions that may be imposed by the Central Government.
The legislation is significant for digital payment systems because payment transactions involve the processing of personal information by banks, payment service providers and other entities.
The Reserve Bank of India plays a major role in regulating India’s payment ecosystem. RBI’s framework concerning payment-system data has emphasised the importance of storing payment data in India.
Such requirements help Indian regulators maintain access to important payment information and exercise effective regulatory supervision. They become particularly important when Indian payment infrastructure is connected with foreign payment networks.
The internationalisation of UPI provides significant economic and technological benefits. However, it also creates a difficult balance between innovation, privacy and national security.
Privacy versus National Security
Privacy and national security are often presented as competing interests, but they can work together. Strong data-protection measures can contribute to national security by reducing the risk of cybercrime, financial fraud and unauthorised access to sensitive information.
At the same time, national security should not become a blanket justification for unrestricted collection or sharing of personal data. Any restriction on privacy should have a legal basis and should be necessary and proportionate to the objective being pursued.
Risks of Cross-Border Payment Data
Cross-border payment systems may involve multiple entities operating under different legal systems. This creates uncertainty regarding access to transaction data and responsibility for data breaches.
For example, if an individual’s financial information is improperly accessed by an entity outside India, questions may arise regarding which regulator should investigate the matter and what remedies are available to the affected person.
Financial information can also reveal sensitive details about an individual’s lifestyle and economic behaviour. Therefore, unnecessary collection and sharing of payment data should be avoided.
Data Localisation Is Not Enough
Data localisation can help Indian regulators maintain control over payment information, but storing data in India alone cannot guarantee privacy.
Proper protection also requires encryption, access controls, limited data collection, security audits and effective mechanisms for responding to data breaches.
The principle should therefore be simple: collect only what is necessary, protect what is collected and do not use it for unrelated purposes.
UPI and Alipay+: A Recent Development
The proposed UPI-Alipay+ linkage provides a useful example of the challenges involved in international payment connectivity.
The proposal was intended to make digital payments more convenient for Indian users travelling abroad. However, reports in September 2026 indicated that the proposal had been stalled amid concerns relating to national security and customer-data handling. Concerns were also reported regarding money laundering and cyber fraud.
The development highlights two important objectives. India wants UPI to become more internationally accessible, but it also has a responsibility to protect its financial infrastructure and the information of Indian users.
The solution should not necessarily be to reject international payment partnerships. Instead, such partnerships should operate under clear legal and regulatory conditions dealing with data storage, processing, access, security and accountability.
This approach would allow India to continue developing UPI internationally without ignoring legitimate privacy and security concerns.
Justice K.S. Puttaswamy (Retd.) v. Union of India
Citation: (2017) 10 SCC 1
In this landmark judgment, the Supreme Court unanimously recognised privacy as a fundamental right under the Constitution.
The Court connected privacy with dignity, liberty and individual autonomy. The judgment provides the constitutional foundation for protecting personal information in the digital age.
In relation to UPI, the case is important because payment records can reveal significant information about an individual’s private and financial life. Therefore, the collection and sharing of such information should respect constitutional privacy principles.
District Registrar and Collector, Hyderabad v. Canara Bank
Citation: (2005) 1 SCC 496
In this case, the Supreme Court considered issues concerning privacy and access to banking records.
The judgment is relevant because it demonstrates that banking information has a privacy dimension even though the case predates modern digital-payment systems.
Its principles remain useful in understanding why financial information should not be subject to unrestricted access or interference.
The international expansion of UPI is an important development for India’s digital economy. Cross-border payment connectivity can make international transactions faster and more convenient and can strengthen India’s position in the global payment ecosystem.
However, the concerns surrounding the proposed UPI-Alipay+ linkage demonstrate that technological development must be accompanied by appropriate legal safeguards. Financial data is sensitive, and its movement across borders raises questions concerning privacy, cybersecurity, regulatory control and national security.
India therefore needs a balanced approach. International payment partnerships should be encouraged, but they should operate under clear rules concerning data storage, access, processing, security and accountability.
Privacy should not prevent technological innovation, and national security should not become a blanket justification for unrestricted access to personal information. Both objectives can be protected through transparent and proportionate regulation.
The future of UPI’s international expansion will depend not only on technological capability but also on the strength of the legal framework surrounding it. Ultimately, cross-border payments may cross national borders, but the protection of an individual’s privacy should not disappear at the border.
UPI stands for Unified Payments Interface. It enables users to transfer money between participating bank accounts through digital payment applications.
What are cross-border payments?
Cross-border payments are transactions involving parties, banks or payment systems located in different countries.
Why does cross-border UPI create privacy concerns?
Cross-border transactions may involve the processing or transfer of personal and financial information through entities operating in different jurisdictions.
Does Indian law completely prohibit cross-border data transfers?
No. India’s data-protection framework permits cross-border transfers subject to applicable legal restrictions and requirements.
Is data localisation the same as data privacy?
No. Data localisation deals primarily with where data is stored or processed, while data privacy concerns how information is collected, used, shared and protected.
Why is the Puttaswamy judgment important in this context?
The judgment recognised privacy as a fundamental right and provides an important constitutional basis for protecting personal and financial information.
What is the main challenge in expanding UPI internationally?
The main challenge is finding a balance between technological innovation and the protection of privacy, cybersecurity, consumer interests, regulatory oversight and national security.
