How to Implement
Guidance
Ensure data privacy.
The Scheme rules align with all data privacy regulations. Data privacy rules ensure that end user data is collected in a transparent manner, with consumers’ knowledge, and is limited to data necessary to operate and enhance the Scheme for end users’ benefit (e.g., confirmed fraud reporting, gender disaggregated data).
Minimize end user identifying data in transactions.
Scheme rules should require DFSPs to annually certify that no personally identifiable end user information is carried in the payment transaction, unless provided by the payee and as required by regulation. Any data that is collected is retained only for the length of time it is required, and in line with relevant regulations.
Leverage APIs to minimize personal information in transactions.
Where personal information is needed, consider using API calls to perform validation of this data so that it does not need to travel with the transaction.
Protect data through data security measures.
The Scheme establishes reasonable data security procedures and controls, in line with relevant regulations, to ensure that all data that passes through the Platform is stored and transmitted in a way that prevents access and use by unauthorized parties. The Scheme requires DFSPs to also establish such procedures and controls.
Plan what should happen when something goes wrong.
Scheme rules should specify the circumstances (and process for) DFSPs to report potential disclosure of end user data due to security breaches along with any mandatory actions to be taken if a data leak occurs.
Why It Matters
This helps ensure that end users’ data is collected and used for the agreed upon purpose only and that the data is protected by DFSPs and the Scheme. These efforts to ensure data privacy and security encourage adoption and use by building trust through a safe Inclusive IPS.
Seeing More Clearly
Select a lens to learn the “why” this practice.
Women’s Inclusion
Low-income women are particularly vulnerable to misuse of their private data that can lead to harassment, incidence of fraud, and other safety concerns and thus benefit from strong data privacy policies and rules. Ensuring that DFSPs minimize data to limited purposes and ones that benefit women and secure the data are essential to building women’s trust in the Inclusive IPS.
Fraud Mitigation
Payment messages often capture and transmit rich data elements including sometimes personally identifiable information on end users. Sharing of that data, even for fraud mitigation, requires controls to protect end user privacy and DFSP data confidentiality.
Tools
Market Illustrations
Learn from design choices in action.
Global Approaches to Alias Addressing
Country
Multiple
Challenge
Not all users are comfortable with or have access to any given alias type, and women are more likely to encounter limitations because of privacy concerns and technology access.
Outcome
As a result of Inclusive IPS supporting multiple alias options, end users can use the alias they feel most comfortable with.
Pix Randomized Key Alias
Country
Brazil
Challenge
In designing Pix, the Brazilian central bank recognized the need to offer a variety of alias options
Outcome
The randomized key is the most used alias, with the key representing 49% of total registered aliases
Related Resources
From the Community
Helpful resources from other organizations on implementing this practice.
Explore more practices
Review other L1P practices and learn more about how to apply them to your IPS.
