Face template protection is of great interest nowadays due to the increasing concerns on privacy and security of the face templates stored in the databases. There were many attempts to develop plausible face template protection schemes that can satisfy four design criteria of biometric template protection, namely noninvertibility, cancellability, non-linkability and performance. In this paper, a cancellable face template scheme, namely random permutation maxout (RPM) transform is proposed. The RPM transforms a real-valued face feature vector (template) into a discrete index code as a means of protected form of face template. Such a transform offers two major merits: 1) robustness to noises in numeric values of original face template; and 2) nonlinear embedding based on the implicit order of the data. The former promotes accuracy performance preservation while the latter offers strong non-invertible transformation that leads to hardness in inversion attack. Several experiments based on the AR face database are conducted to observe the RPM transform performance with respect to its various parameters. The analyses justify its resilience to inversion attack as well as satisfy the revocability and non-linkability criteria of cancellable biometrics.