The Reserve Bank of India (RBI) has issued draft Guidance on Regulatory Expectations for Data Governance. It directs regulated entities to set up a Data Governance Framework (DGF) with a two-tier organisational structure.
The framework is meant to strengthen data security, accountability and compliance with the Digital Personal Data Protection (DPDP) Act, 2023. It is to be aligned with each entity's Enterprise Risk Management (ERM) framework, cover the entire data lifecycle, and mitigate financial, operational and cyber risks.
At the top, regulated entities must set up a Board-level Data Governance Committee. It is to oversee the implementation of data policies, review data breaches and periodically assess how effective the framework is.
Below the board, banks must create an Executive Data Governance Committee and a dedicated Data Management Function. The function is to be headed by an officer of at least the rank of Chief General Manager (CGM) or equivalent.
The draft also assigns responsibilities to three roles:
The entities must ensure purpose-based data collection, consent management, classification and secure processing. The draft also lists encryption, tokenisation and anonymisation, followed by retention, archival and secure disposal of data.
Banks must establish a Single Source of Truth (SSOT) for critical data. They must also maintain metadata and data lineage records, so that data is consistent, traceable and auditable.
The framework brings data quality, privacy, security, ownership, cross-border data processing and third-party risks into the overall ERM framework. Data risk is thus to be managed alongside the other risks an entity already tracks, and not as a separate technology matter.
On outsourcing, the draft says banks remain fully accountable for data shared with service providers and group entities. This requires access controls, encryption, contractual safeguards, continuous monitoring and periodic audits.
The draft aims to strengthen operational resilience, improve data-driven decision-making and protect customer data in India's digitalising banking sector.
With reference to the draft Guidance on Regulatory Expectations for Data Governance issued by the Reserve Bank of India, consider the following statements:
Which of the statements given above are correct?
Consider the following information:
| Role under the draft guidance | Responsibility | |
|---|---|---|
| 1. | Data Owners | Data quality, classification and governance |
| 2. | Data Stewards | Technical controls, storage, backup, disaster recovery and secure disposal |
| 3. | Data Custodians | Day-to-day implementation of governance |
In how many of the above rows is the given information correctly matched?
Consider the following statements:
Statement-I: Under the RBI's draft guidance, banks remain fully accountable for data shared with service providers and group entities.
Statement-II: The draft requires banks to establish a Single Source of Truth (SSOT) for critical data.
Which one of the following is correct in respect of the above statements?
