Context
- The Reserve Bank of India (RBI) recently issued a draft document titled ‘Guidance on Regulatory Expectations for Data Governance’ for banks and other Regulated Entities (REs).
Objective
The framework aims to strengthen data governance across the banking system, improving data quality, accountability, risk management, and security while ensuring strict compliance with the Digital Personal Data Protection (DPDP) Act, 2023.
Key Pillars of the Data Governance Framework (DGF)
- Mandatory Establishment: All Regulated Entities (REs) are directed to establish a comprehensive DGF that aligns seamlessly with their overall risk management framework.
- Proportionate Application: The framework must be customized and proportionate to the size, complexity, business model, and technology infrastructure of each specific bank.
- Core Components: It spans the entire data lifecycle, specifically addressing:
- Organizational structure and accountability
- Clear data policies and processes
- Advanced technological systems
- Robust internal audit mechanisms
- Periodic Review: RBI mandates that banks must review this framework annually or more frequently if operational requirements dictate.
Significance
1. Managing the “3Vs” of Data
- Volume, Variety, and Velocity: Rapid banking digitalization makes data a critical asset.
- Core Goal: Managing these three aspects ensures data stays accurate, secure, consistent, and useful across systems.
2. Risk Mitigation
- Beyond IT: Poor data management impacts the entire bank, not just the tech team.
- Systemic Safety: Strong governance prevents wider financial, operational, compliance, and reputational risks.
Data Governance Framework (DGF) vs DPDP Act, 2023
| Feature | RBI Data Governance Framework (DGF) | Digital Personal Data Protection (DPDP) Act, 2023 |
| Nature | Sector-specific regulatory guidance (Draft). | Umbrella central legislation passed by Parliament. |
| Primary Focus | Institutional data management, data lifecycle quality, risk management, and operational security in banking. | Protection of personal data of digital citizens (Digital Nagriks) and processing obligations. |
| Applicability | Restricted to RBI-regulated entities (Banks, NBFCs, etc.). | Broadly applicable to all data fiduciaries processing personal data within or linked to India. |
| Core Regulator | Reserve Bank of India (RBI). | Data Protection Board of India (DPBI). |
With reference to the ‘Guidance on Regulatory Expectations for Data Governance’ recently issued by the RBI, consider the following statements:
1. The framework mandates a uniform, identical data governance structure for all Regulated Entities irrespective of their size or business model.
2. It aims to harmonize data management practices in banks with the provisions of the Digital Personal Data Protection (DPDP) Act, 2023.
3. Regulated Entities are required to review their established Data Governance Framework at least once every three years.
Which of the statements given above is/are correct?
(a) 1 and 2 only
(b) 2 only
© 2 and 3 only
(d) 1, 2 and 3
Answer: (b) 2 only
Explanation:
• Statement 1 is incorrect: The framework explicitly states that it needs to be proportionate to the size, complexity, business model, and technology infrastructure of each bank, rather than enforcing a one-size-fits-all uniform structure.
• Statement 2 is correct: One of the core objectives of the guidance is ensuring compliance with the Digital Personal Data Protection (DPDP) Act, 2023, alongside other applicable laws.
• Statement 3 is incorrect: The RBI has mandated that banks must review the framework annually (every year) or more frequently whenever required, not every three years.