On 15 July 2026 the Reserve Bank of India released a draft Guidance on Regulatory Expectations for Data Governance. It asks banks and other regulated entities for a framework that complies with the Act and the Rules.
The Reserve Bank of India released the draft Guidance on Regulatory Expectations for Data Governance for public comment on 15 July 2026, by press release 2026-2027/677. Comments were invited from regulated entities, members of the public and other stakeholders until 17 August 2026. This entry describes the draft as published. A final version, if one is issued, may differ.
The press release lists the regulated entities to which the draft applies: commercial banks, small finance banks, payments banks, local area banks, regional rural banks, urban and rural co-operative banks, all India financial institutions, non-banking financial companies, asset reconstruction companies and credit information companies. The draft defines commercial banks by reference to Section 5 of the Banking Regulation Act, 1949, and includes foreign banks.
Paragraph 6 of the draft asks each regulated entity to put in place a Data Governance Framework applicable to all data, aligned with its risk management framework. Among other things, the framework is to cover risk management including data privacy and security, and to comply with “the Digital Personal Data Protection (DPDP) Act, 2023, the DPDP Rules, 2025”, and other applicable law. The draft also takes its definition of personal data from the Act.
The draft places oversight of the framework with the entity’s board of directors. It asks for a board-level Data Governance Committee, or for that responsibility to be given to an existing board committee, and for an executive-level committee with representation from the data function, information technology, information security, relevant business verticals, risk management and compliance. It asks that the classification of data take account of whether the data comprises personal data.
The Forum’s reading, which is its own and has no legal force, is that the draft does not add to the obligations in the Act. It places them inside governance a bank already maintains: a board that oversees, a board committee, an executive committee and named data roles. If the guidance is issued in this form, a bank’s work under the Act would sit within a framework its board oversees and reviews, alongside the rest of its data governance.
Compiled 25 September 2026. This entry records published documents. It is not an assessment of any organisation and carries no regulatory force. To report an error or ask for a reply to be recorded, see how the Casebook is compiled.
Back to the Casebook, or read the notes on the Act in the Bulletin.