What is the RBI Draft Guidance on Data Governance?

The Reserve Bank of India released the Draft Guidance on Regulatory Expectations for Data Governance in July 2026 through the Connect 2 Regulate portal. Stakeholder comments are open until 17 August 2026. It applies to commercial banks, small finance banks, payments banks, regional rural banks, cooperative banks, all-layer NBFCs, all-India financial institutions, asset reconstruction companies, and credit information companies.

Who does the RBI Data Governance Framework apply to?

Every RBI Regulated Entity in the financial sector: SCBs, SFBs, PBs, RRBs, urban and state cooperative banks, all layers of NBFCs (base, middle, upper, top), AIFIs, ARCs and CICs. Fintechs that act as agents or lending service providers to Regulated Entities are reached indirectly through third-party accountability rules.

What must a Regulated Entity do under the draft?

Establish a board-approved Data Governance Framework aligned with the enterprise risk management framework and with the DPDP Act 2023 and DPDP Rules 2025. Constitute a Board Data Governance Committee and an Executive Data Governance Committee. Appoint a Data Function head not below the rank of Chief General Manager or equivalent. Assign Data Owner, Data Steward and Data Custodian per data domain. Designate a Single Source of Truth for each data element. Implement metadata management with tagging at the point of origination, data lineage, classification and data quality monitoring. Harden third-party arrangements with CERT-In empanelled audits, cascading accountability and auto-deletion attestations.

When does the RBI Data Governance Framework take effect?

The Guidance is currently a draft for consultation. Comments close 17 August 2026 on the RBI Connect 2 Regulate portal. The final Guidance is expected to be notified as a Master Direction or Notification with a phased effective date, likely a shorter runway for governance structures and a longer runway for architectural asks such as SSOT and lineage.

How does dcomply help me comply?

dcomply provides the operating tool for the Framework. The RBI Data Governance module ships with a policy generator, Board and Executive Committee registers, Data Owner/Steward/Custodian RACI per data domain, Single Source of Truth register, third-party arrangement register with CERT-In audit tracking, a live readiness scorecard against seven weighted checks mapped to the draft, and a board-ready PDF report. Starter templates for NBFCs, banks and cooperative banks let you skip the from-scratch phase.

Does the framework overlap with DPDPA?

Yes, extensively. The RBI Guidance operationalises DPDPA for the financial sector. Sections 5 and 6 (notice, consent), Section 8 (accuracy, security, retention, erasure), Section 10 (Significant Data Fiduciary), Section 12 (rights), and Rule 12 (DPIA, algorithmic diligence) all map into the DGF as operating expectations. dcomply auto-links your existing DPDP evidence (SDF, DPIA, consent, cross-border) to the DGF register so you produce one BFSI evidence bundle, not two parallel programmes.

How is this different from RBI Cybersecurity Framework?

The RBI Cybersecurity Framework covers technical controls, incident reporting and cyber resilience. The Data Governance Framework covers data as an asset: ownership, quality, classification, sharing rules and lineage. They complement each other. dcomply covers both through separate modules that share the same tenant, evidence store and reporting.

Can I try it before the RBI final Guidance?

Yes. The dcomply RBI Data Governance module is available today. Activating it early lets you complete a gap assessment, appoint roles, constitute committees and populate your Single Source of Truth register before the compliance clock starts. The board pack PDF you generate now stays valid for the first governance-structures deadline once the final Guidance lands.

What does the readiness score measure?

Seven weighted checks totalling 100 points: board-approved Data Governance Framework (20), Board and Executive DG Committees (15), Data Function head named (10), at least three data domains with full Owner/Steward/Custodian assignment (20), at least one Single Source of Truth designated (10), data classification applied across domains (10), third-party arrangements with CERT-In audit and cascading accountability (15). Result renders in the app dashboard and in the downloadable PDF board pack.

Is there a training course for my team?

Yes. The DPDP Act 2023 course on dcomply Academy includes Module 8 Lesson 7 on the RBI Data Governance Framework for BFSI. It maps every clause of the draft to DPDPA obligations, walks through a mid-sized NBFC worked example, and issues a certificate. Free with any DPDP course enrolment.

RBI Data Governance door. BFSI-only. New for July 2026.

RBI July 2026 Draft Data Governance, operationalised in one module.

The Reserve Bank of India's Draft Guidance on Regulatory Expectations for Data Governance (July 2026, comments to RBI open until 17 August 2026) makes data governance a Board-level obligation for every bank, NBFC and cooperative bank. dcomply ships the operating tool: policy generator, Board and Executive committee registers, Data Owner / Steward / Custodian RACI, Single Source of Truth register, third-party arrangements with CERT-In audit tracking, and a live readiness scorecard exportable as a Board-ready PDF.

Book a BFSI Walkthrough Read Academy Lesson 8.7

72%
DGF Readiness Score — In Progress
✓ Board-approved DGF
✓ Board + Executive Committees
✓ Data Function head named
✓ 4 domains with full RACI
⚠ SSOT designated for 2 of 4
⚠ Third-party CERT-In audits: 1 pending
Last assessed: Today

Live RBI DGF readiness scorecard, board-ready PDF export

Sound familiar?

If any of this sounds familiar, you're in the right place.

These are the exact sentences we hear on first calls. If two or three of them ring true, dcomply is the workspace you have been trying to build in a spreadsheet.

You read the draft and realised your existing IT Governance framework does not fit the new asks — SSOT, lineage, tagging-at-origination.

Your Board is asking whether you need a new committee or whether the IT Strategy Committee can absorb Data Governance.

Four new roles (Owner, Steward, Custodian, Function head) need naming per domain. You have never done a Data RACI at this granularity.

The 17 August 2026 consultation window is short. Your compliance team is not sure whether to comment on the draft, or just build against it.

Related: the RBI Compliance door covers the RBI Cybersecurity Framework, outsourcing register, and STR / CTR filings. The two modules share the same tenant and evidence store.

Your regulator stack

Here's what sits above the foundation.

The RBI Draft Guidance sits on top of DPDP and alongside the RBI Cybersecurity Framework. dcomply ships modules for each layer, so evidence produced once is reused across all three.

DPDP Act 2023 + DPDP Rules 2025

The horizontal privacy law. Notice, consent, SDF, DPIA, rights, cross-border transfers, processor obligations. The DGF operationalises these for BFSI.

RBI Cybersecurity Framework

Technical controls, cyber resilience, incident reporting. Separate module in dcomply, integrates via CERT-In audits shared with the DGF third-party register.

RBI Data Governance Framework (this door)

Board-approved DGF, Board + Executive Committees, Data Owner / Steward / Custodian RACI, SSOT, lineage, third-party controls with CERT-In audits and cascading accountability.

The Problem

The Draft Is Directional. Building Against It Is Not.

Most BFSI compliance teams are still reading the draft. The teams that start now will have a defensible programme by the time the final Guidance lands.

Data RACI at scale

Four formal roles across every data domain (customer, transaction, KYC, HR, marketing). No template. No prior discipline.

SSOT with parallel systems

Customer master lives in three systems, KYC lives in two. Designating one authoritative source needs reconciliation, not a decision memo.

Third-party accountability

Every vendor arrangement needs CERT-In empanelled audit, cascading accountability language, and auto-deletion attestation. Your contracts do not have it today.

Capabilities

Everything You Need for RBI Data Governance

Board-approved DGF policy

Applicability picker for your RE type (SCB, SFB, PB, RRB, cooperative, all NBFC layers, AIFI, ARC, CIC). Board-approval workflow with dates and status. Scope statement.

Board + Executive Committees

Committee register with type (Board / Executive), charter summary, chair, secretary, members list, cadence, last meeting, next meeting. Quarterly PDF board pack.

Data Owner / Steward / Custodian RACI

Per-domain assignment of the four RBI-defined roles. Data Function head (CGM-equivalent) named at framework level. Named individuals, not titles.

Single Source of Truth register

Domain → data element → authoritative system → reconciliation notes. One row per domain. No parallel SSOTs.

Classification + consent basis

Four-tier classification (public / internal / confidential / restricted) per domain, aligned with your DPDP Rule 6 security posture. Consent basis per domain (Section 6 or Section 7 limb).

Third-party CERT-In tracker

Vendor register with need-to-know scope, CERT-In audit status and certificate upload, encryption in transit and at rest, auto-deletion attestation, cascading accountability sign-off, NDA in place.

Readiness scorecard, live

Seven weighted checks totalling 100, mapped 1:1 to the draft. Ready / In Progress / Early / Not Started band. Refreshes automatically as you populate the registers.

Board-ready PDF pack

One-click export. Cover, readiness scorecard, framework summary, domain register, committee register, third-party register. Take to the next Board Data Governance Committee meeting.

Starter templates for BFSI

One command loads a framework, four canonical BFSI data domains (Customer Master, Loan & Transaction, KYC & AML, Marketing & Analytics), and Board and Executive committees. Edit, don't start from scratch.

Academy Lesson 8.7 — free with DPDP course

A 12-minute deep dive on the RBI DGF, mapped clause-by-clause to DPDPA. Includes a mid-sized NBFC worked example. Included in the DPDP Act 2023 course, no extra charge.

FAQ

Questions BFSI compliance leads are asking

Yes. The draft applies to all layers of NBFCs (base, middle, upper, top). Mid-layer NBFCs have the same board-level obligation as banks, though the scale of Data Function may be smaller. dcomply's applicability picker adapts the framework to your layer.

Not separately. RBI expects the role to sit at or above CGM equivalent. A CDO reporting to CIO or CRO typically qualifies, provided the CDO chairs the Executive Data Governance Committee and reports to the Board Data Governance Committee. dcomply lets you name the individual and record the designation.

Yes, if the Board expressly delegates the Data Governance mandate to it. The dcomply committee register lets you record either a new standalone committee or an existing committee with a delegated mandate. Charter language matters — the module has a template.

Cleanly. RBI DGF is DPDPA operationalised for BFSI. Existing DPIA outputs become inputs to the Board Data Governance Committee data-risk pack. Existing consent records provide the consent basis attribute per domain. dcomply auto-links where your DPDP evidence already exists in the platform.

The substantive asks (governance structures, RACI, SSOT, classification, lineage, third-party controls) are directional enough that they will not change materially. What may change is applicability thresholds and phased timelines. Build the substance now; adjust the specifics when the final text lands. dcomply will version the framework template.

Yes, through a separate RBI Compliance module that covers the Cybersecurity Framework, outsourcing register, STR / CTR filings and CERT-In incident reporting. Both modules share the same tenant, so a CERT-In empanelled audit uploaded once satisfies both.

Comments to RBI close 17 August 2026.

Start the gap assessment now. Ship the framework before the final Guidance lands.

Book a BFSI Walkthrough