The Reserve Bank of India has mandated that regulated entities (REs) such as commercial banks, cooperative banks and NBFCs must implement a data governance framework (DGF) proportionate to their size, complexity, business model and Information Technology (IT) and Information Security (IS) setup, as reported by The Hindu BusinessLine and Mint. This framework is aimed at supporting REs in strengthening their DGF and promoting sound practices relating to data management across the data lifecycle. The central bank emphasizes that data has emerged as a critical organisational asset for REs, underpinning business operations, customer service, financial reporting, regulatory compliance, risk management and strategic decision-making. The framework comes as the RBI noted that supervisory assessments and stakeholder engagements with REs indicated that while REs have progressively strengthened their information and data management capabilities, there are still certain weaknesses which need to be addressed else it may lead to operational, compliance, and financial risks. According to the latest RBI draft guidelines, regulated entities would be required to identify data attributes, structure, sources, quality and classification to assess, monitor and manage data-related risks. The draft framework will apply to commercial banks, small finance banks, payments banks, cooperative banks, regional rural banks, NBFCs, all-India financial institutions, asset reconstruction companies (ARCs) and credit information companies, as reported by The Economic Times.
According to the RBI guidance, data has emerged as a critical asset for regulated entities (REs) in the increasingly digitalized financial sector. As reported by The Hindu BusinessLine and Mint, the rapid growth in digital financial services, interconnected technology ecosystems, third-party arrangements, advanced analytics, and automated decision-making processes has significantly expanded the volume, velocity and complexity of data being generated, processed, shared and stored by REs. The guidance emphasizes that the ability of REs to ensure the accuracy, availability, confidentiality, consistency, integrity and traceability of data across systems and business functions has assumed heightened importance. The framework should cover all material aspects of data governance, including its lifecycle, quality, classification, metadata (data about data), lineage, and third-party arrangements. The RBI warns that with the financial sector becoming increasingly digital and technology-driven business models gaining traction, data has emerged as a critical asset for regulated entities, the RBI said, as the volume, variety and velocity of data continue to grow, effective governance is essential to ensure data remains accurate, consistent, secure and fit for purpose across functions and systems. According to The Economic Times, the RBI noted that weaknesses in data governance and its management could expose regulated entities to financial, operational, compliance and reputational risks.
The RBI has proposed stricter governance standards for data shared with third-party service providers, requiring regulated entities to ensure that access to data is granted strictly on a 'need-to-know' basis and that non-disclosure agreements are embedded in all third-party contracts, as reported by The Economic Times. Under the proposed framework, regulated entities will remain accountable for all data shared with third parties and must ensure such sharing is restricted to defined and approved purposes by designated personnel. The draft guidance emphasizes that data sharing should not result in unauthorised reuse, sharing or duplication, with the regulator seeking to strengthen controls over the growing use of external service providers, technology vendors and group entities by banks and other regulated financial institutions. The framework requires that data shared with third parties remains traceable to the designated SSOT (single source of truth), and metadata and lineage capture the extent of such sharing, with data sharing not permitted to result in unauthorized reuse, sharing or duplication. The RBI has further proposed that every regulated entity maintain a 'single source of truth' for each data element to ensure that downstream systems, models and business processes rely on one authoritative source, as reported by The Economic Times.
The draft norms propose that regulated entities should put in place a data governance framework (DGF) applicable to all data and align it with their risk management framework, ensuring the framework is proportionate to their size, complexity, business model, and information technology (IT) and information security (IS) setup. According to The Hindu BusinessLine and Mint, the framework should be comprehensive and cover all aspects of data governance, including organisational structure, policies and processes, risk management including data privacy and security, technological infrastructure, and audit mechanisms across the data lifecycle. The RBI has proposed that the board oversee the framework, with each regulated entity either constituting a dedicated board-level data governance committee or assigning the responsibility to an existing board committee. As reported by The Economic Times, the designated committee would be responsible for approving data governance policies, overseeing implementation, reviewing material breaches and reporting key issues to the board. The DGF should be reviewed annually or more frequently as required, with the framework complying with the Digital Personal Data Protection (DPDP) Act, 2023, the DPDP Rules, 2025, and all other applicable laws and rules, as amended from time to time. The Board-level Data Governance Committee (DGC) or assigned board committee should oversee the implementation of the DGF and formulate policies for data governance, including the scope of data governance, data architecture, and management of data risk.
The RBI has also proposed a lifecycle-based approach to data governance, requiring regulated entities to manage data consistently from its creation or acquisition through to deletion. As reported by The Hindu BusinessLine and Mint, the framework aims to ensure risks are identified and mitigated at every stage of the data lifecycle. The draft guidelines state that data should be created or acquired only for defined and legitimate purposes aligned with an entity's approved business, risk, legal and regulatory objectives. The framework requires that regulated entities must classify data based on criticality, sensitivity, confidentiality and regulatory relevance, while implementing data quality metrics and remediation processes to ensure data used for decision-making, risk management and regulatory reporting remains reliable. According to The Economic Times, the proposed framework lays down regulatory expectations on data governance, including governance structures, roles and responsibilities, data architecture, metadata and lineage, data quality, and third-party data-sharing arrangements. The RBI has also proposed setting up an executive-level Data Governance Committee, or assigning the responsibility to an existing executive committee, with representation from the data function, information technology, information security, relevant business verticals, risk management and compliance.
The draft norms establish clear organizational requirements for effective data governance implementation. According to The Hindu BusinessLine and Mint, REs should establish a Data Function headed by a sufficiently Senior officer not below the rank of Chief General Manager or equivalent having adequate authority and with necessary competence/ skills for implementation of DGF. The Data Function should act as the central point of coordination to ensure consistent interpretation and implementation of the DGF and related policies thereunder across business, risk, technology, and other relevant functions. Additionally, there should be a designated Data Owner for each data domain, accountable and responsible for ensuring that data within the domain is defined, classified and used in a manner consistent with the DGF, along with a designated Data Custodian responsible for enforcing access controls and user entitlements in line with data classification and approved usage. The framework also requires a data steward, mapped to specific data domain under a data owner, and positioned within the business function or unit of the data owner should be designated by the RE, with the data steward responsible for functions such as enforcing access controls and maintaining system capabilities to support effective implementation of DGF. As reported by The Economic Times, the RBI has proposed that regulated entities should establish a data governance framework covering the entire data lifecycle.
The draft guidance is now available for public comments, representing the RBI's commitment to inclusive regulatory development. As reported by The Hindu BusinessLine and Mint, comments on the draft Guidance are invited from regulated entities, members of public and other stakeholders by August 17, 2026. The framework also requires REs to establish data quality management processes proportionate to the criticality, sensitivity and classification of data, and ensure that data is fit for its intended use, with material issues identified and remedied in a timely manner. The DGF should be reviewed annually or more frequently as required, with the framework complying with the Digital Personal Data Protection (DPDP) Act, 2023, the DPDP Rules, 2025, and all other applicable laws and rules. The Board-level Data Governance Committee (DGC) or assigned board committee should oversee the implementation of the DGF and formulate policies for data governance, including the scope of data governance, data architecture, and management of data risk. According to The Economic Times, the central bank has invited public comments on the draft till August 17.
