RBI pushes banks, NBFCs to own data risks across third parties

MUMBAI: The Reserve Bank of India (RBI) has proposed stricter governance standards for data shared with third-party service providers, requiring regulated entities to ensure that access to data is granted strictly on a “need-to-know” basis and that non-disclosure agreements are embedded in all third-party contracts.

In the draft guidance on data governance issued on Wednesday, the regulator also said data sharing should not result in unauthorised reuse, sharing or duplication.

The RBI has sought comments from the public by August 17 on its draft proposals titled ‘Guidance on Regulatory Expectations for Data Governance.’ These seek to strengthen controls over the growing use of external service providers, technology vendors and group entities by banks and other regulated financial institutions.

Softer inflation trips rate hike forecasts, RBI hold more likely

Under the proposed framework, regulated entities will remain accountable for all data shared with third parties and must ensure such sharing is restricted to defined and approved purposes by designated personnel.

India raises windfall tax on diesel, ATF exports; cuts levy on petrol exports

The draft further requires regulated entities to classify data based on criticality, sensitivity, confidentiality and regulatory relevance, while implementing data quality metrics and remediation processes to ensure data used for decision-making, risk management and regulatory reporting remains reliable.