RBI's New Data Governance Framework Meets DPDP: What Banks and NBFCs Must Build

On 15 July 2026, the Reserve Bank of India released a draft Guidance on Regulatory Expectations for Data Governance, open for public comment until 17 August 2026. The draft is not another cybersecurity guideline or privacy regulation. It asks banks and NBFCs a broader question: can they prove that their data is accurate, governed, traceable, and trusted across the enterprise? For banks and NBFCs already preparing for DPDP compliance, the RBI draft introduces an additional regulatory direction built on many of the same data-governance foundations. DPDP governs personal data, consent, and Data Principal rights. The RBI draft governs how a regulated entity manages consent, purpose, and security across the data lifecycle. Both demand the same underlying capability, and both land on roughly the same clock. 

This is also not the first major regulatory signal this month. On 1 July 2026, the Ministry of Electronics and Information Technology (MeitY) released the Business Requirements Document (BRD) for Consent Management under the DPDP Act, outlining how consent should be collected, managed, and operationalised. Just two weeks later, on 15 July 2026, the RBI followed with its draft Data Governance Framework. Read together, the direction is clear: regulators are increasingly expecting financial institutions to build a trusted data foundation that supports privacy, governance, accountability, and resilience rather than treating each requirement as a standalone compliance exercise.

Who It Applies To, and Why Now

The draft applies to eleven categories of RBI-regulated entities, including commercial banks, small finance banks, payments banks, local area banks, regional rural banks, urban and rural co-operative banks, All India Financial Institutions, NBFCs, Asset Reconstruction Companies, and Credit Information Companies.

The release also comes ahead of the Expected Credit Loss (ECL) framework, scheduled to take effect on 1 April 2027, increasing the importance of accurate, traceable, and reliable data across financial institutions. It also arrives during the same implementation window in which substantive DPDP obligations are expected to take effect around 13 May 2027, making a strong data governance foundation increasingly important for regulatory readiness.

A Governance Framework, Not Just New Roles

The draft is not simply about introducing new governance roles. RBI expects every regulated entity to establish an enterprise-wide Data Governance Framework that defines policies, standards, ownership, controls, architecture, lifecycle management, and governance processes across the organisation. Rather than treating data governance as an IT initiative, the framework makes it an enterprise-wide operating model that integrates business, risk, compliance, and security technology functions under common accountability.

The framework also expects regulated entities to periodically review and strengthen these governance controls through internal and external audits, ensuring that policies, processes, governance mechanisms, and accountability remain effective as business operations and data ecosystems evolve.

More importantly, the framework signals a broader shift. Privacy governance and data governance are no longer separate initiatives; they form a common foundation for enterprise trust. When organisations know what data they hold, how it is classified, where it flows, who owns it, what purpose it serves, and the risks associated with it, they create a trusted data foundation. That same foundation supports cyber resilience, AI governance, enterprise risk management, operational resilience, customer trust, and continuous regulatory compliance.

The Structure RBI Wants

The draft asks each entity to formalise data ownership rather than leave it informal. It proposes Board-level oversight through a dedicated Data Governance Committee (or an appropriately mandated existing Board committee), supported by a senior Data Function and clearly defined responsibilities for Data Owners, Data Stewards, and Data Custodians. The Data Function should be headed by an executive of no less than Chief General Manager rank, coordinating across business, risk, and technology.

Under that function are three roles new to many institutions. A Data Owner is accountable for a data domain: defining, classifying, and governing its data, designating the Single Source of Truth, and approving sharing rules. A Data Steward runs day-to-day implementation and monitors data flows. A Data Custodian handles the technical layer: access controls, metadata and lineage systems, security, retention, and business continuity.

This maps closely onto DPDP's own logic. A data fiduciary under DPDP is accountable for how personal data is processed and shared. RBI now names the internal roles that make that accountability real, so the two regimes reinforce each other rather than pulling in different directions.

SSOT, Metadata, and Data Lineage: The Shared Foundation

Three technical capabilities sit at the centre of the RBI draft: a Single Source of Truth, metadata and data lineage. While DPDP does not expressly prescribe these architectures, they can provide the visibility needed to operationalise purpose limitation, consent withdrawal, erasure and processor accountability at scale.

A Single Source of Truth means nominating the authoritative record for each data domain, ensuring that data remains consistent across business, risk, compliance, and other functions, with every decision tracing back to the same trusted source. Metadata documents what each data element is and where it comes from. Data lineage traces how data moves and transforms across systems.

None of this is paperwork. An SSOT is impossible to designate if the entity cannot first see every place a data element lives, which is why data visibility comes before compliance. Lineage cannot be captured on unmapped data. This is the same discovery-and-classification foundation organisations need to locate personal data, fulfil erasure requests, and apply appropriate controls based on business and regulatory risk. Build the map once, and it serves both regimes.

Data Quality: Trust Is Part of Governance

Discovery alone is not enough. RBI expects regulated entities to continuously measure and improve the quality of their data across dimensions such as accuracy, completeness, consistency, timeliness, and reliability. Governance is not just about knowing where data exists, but ensuring regulatory reporting, credit models, AI systems, and business decisions are built on information that can be trusted. A Single Source of Truth only works if the underlying data remains reliable over time. Reliable data also depends on appropriate security controls. Governance is not only about organising information but ensuring it remains protected against unauthorised access, misuse, and compromise throughout its lifecycle. Strong security, together with high-quality data, strengthens regulatory reporting, operational resilience, and customer trust. For institutions already investing in DPDP readiness, improving data quality becomes another shared capability that strengthens both privacy compliance and regulatory confidence.

Third-Party Data Sharing: Where RBI and DPDP Materially Overlap

Third-party governance is where the RBI draft most clearly converges with DPDP. Gartner estimates that large enterprises work with around 250 third parties on average, while some large banks manage relationships with over 1,000 vendors. RBI therefore expects regulated entities to control access to, use of, and deletion of data shared with third parties, taking into account data classification, sensitivity, and, where customer data is involved, applicable consent requirements. Data shared externally must remain traceable back to the Single Source of Truth (SSOT), with lineage capturing how far it has travelled to prevent unauthorised reuse or duplication.

DPDP approaches the same issue from the personal data perspective. Processing by third parties must remain within the applicable purpose and lawful basis, while the Data Fiduciary remains accountable for processing carried out on its behalf. Together, the two frameworks point to the same operational controls: one vendor inventory, one classification framework, one consent validation process, and one lineage trail. For banks mapping this, the earlier RBI and DPDP guide for banks and NBFCs is the companion read.

Run Them as One Programme

These are not two projects. DPDP wants you to find, classify, and control personal data, honour consent, and fulfil data principal rights. The RBI draft wants an SSOT, metadata, lineage, data quality, defined ownership, and controlled sharing across all data. The shared core is discovery, classification, ownership, data quality, mapping, lineage, and controlled data sharing.

The map that answers a DPDP erasure request is the same map that designates an SSOT and traces third-party sharing for RBI. Rather than building separate compliance initiatives, financial institutions should treat data and privacy governance as one enterprise capability. Once established, that foundation supports not only RBI and DPDP compliance, but also security, AI governance, enterprise risk management, and future regulatory requirements. The common denominator across all these disciplines is visibility. An organisation cannot govern, classify, protect, or prove compliance for data it cannot first discover.

How Privy by IDfy Fits

Privy by IDfy has been recognised by MeitY and NeGD as the winner of the DPDP Innovation Challenge for building privacy technologies aligned with India's digital privacy ecosystem. That India-first approach is reflected in how the platform helps regulated entities operationalise both DPDP compliance and RBI's emerging data governance expectations through a common data foundation.

Privy by IDfy was built for this convergence. Data Compass discovers and classifies data across structured, unstructured, cloud, on-premise, and vendor systems, then maps it and maintains lineage, the raw material for an SSOT, the metadata record, and the lineage capture RBI asks for. It connects to consent and third-party governance on the Privy by IDfy platform, so RBI's traceability and DPDP's consent run on one system with one audit trail. Both regulators now ask entities to prove control over their data, and that proof comes from a living map of where data lives and how it moves.

Conclusion

The RBI draft turns data governance into a board-level expectation for the whole financial sector, in the same window as DPDP. Institutions that build the discovery, classification, lineage, and single-source-of-truth foundation once will meet both. Those who approach them as separate initiatives risk duplicating effort, increasing operational complexity, and still struggling to demonstrate control when regulators ask for evidence. Institutions that build a common governance foundation today will not only be better prepared for RBI and DPDP, but will also strengthen AI governance, regulatory reporting, operational resilience, and enterprise-wide trust in data.

Book a demo to see how Privy by IDfy helps banks and NBFCs operationalise RBI's Data Governance Framework alongside DPDP compliance. To schedule a personalised walkthrough, contact shivani@idfy.com.

Reference

 https://www.rbi.org.in/Scripts/bs_viewcontent.aspx?Id=5114

FAQ’s

What is the RBI draft Guidance on Data Governance? 

A draft released on 15 July 2026, open for comment until 17 August 2026, setting expectations for how regulated entities govern data across its lifecycle: roles, SSOT, metadata, lineage, quality, and third-party sharing. It is a draft, not yet in force.

How does it relate to DPDP compliance?

 They converge. DPDP governs personal data, consent, and rights; the RBI draft governs data governance and lineage across all data. Both rest on discovery, classification, mapping, and lineage, so they are best built as one programme.

Who does it apply to? 

Eleven categories, including commercial banks, small finance banks, payments banks, NBFCs, All India Financial Institutions, ARCs, and Credit Information Companies.

Why did the RBI issue it now?

 It precedes the Expected Credit Loss framework (1 April 2027), which needs clean, traceable data, and lands alongside DPDP enforcement expected around 13 May 2027.