Overview
- The Reserve Bank of India published a draft titled Guidance on Regulatory Expectations for Data Governance and invited public comments through August 17, with the document first released on Wednesday.
- The draft would require every regulated entity to set up a central Data Function led by a senior officer and to appoint specific roles called Data Owners, Data Stewards and Data Custodians to assign clear accountability for data.
- Regulated entities must adopt a lifecycle approach that covers data from creation to deletion, maintain a single source of truth for each data element, and implement data classification, quality metrics and remediation processes.
- The guidance tightens controls on third-party access by requiring need-to-know permissions, mandatory non-disclosure terms in contracts, traceability and audit mechanisms while keeping the regulated entity accountable for outsourced data handling.
- If finalised, the rules would force changes to board oversight, IT architecture, vendor contracts and compliance workstreams and must be aligned with the Digital Personal Data Protection Act as the RBI moves from consultation to supervisory implementation.