RBI's Data Governance Framework to Trigger Investments in Indian Banks

Even as banks continue to ramp up spending on digital transformation, cybersecurity and artificial intelligence , the Reserve Bank of India’s proposed data governance framework is expected to trigger another round of investments, requiring lenders to strengthen governance structures, modernise data architecture and build specialised data management capabilities. The RBI came out with the draft norms on July 15 in order to support regulated entities in strengthening their data governance framework and promote sound practices relating to data management across the data lifecycle. The central bank has invited comments on the same by August 17. Banks have already begun preparing for the proposed framework. Karur Vysya Bank Managing Director and Chief Executive Officer B Ramesh Babu said the bank plans to appoint a Chief Data Officer as part of its preparations. While acknowledging that compliance costs would rise, he said the investment was necessary given the growing importance of data security and governance. Similarly, CSB Bank Managing Director and Chief Executive Officer Pralay Mondal said the framework would require additional investments, including appointing data protection officers and setting up consent management mechanisms. The draft directions mark a significant shift from existing practices by moving data governance beyond technology and compliance functions to the boardroom. Regulated entities would be required to establish board-approved data governance frameworks, designate data owners, stewards and custodians, and maintain a “single source of truth” for critical data. Experts suggest that the cost of compliance in banks is quoted as 5-10% of their operating cost. “The most significant shift is the formalisation of accountability with the board and defined governance requirements across the entire data lifecycle,” said Shilpa Mankar Ahluwalia, Partner and Co-Head (Banking & Finance) at Shardul Amarchand Mangaldas & Co. While banks and non-banking financial companies already have data policies, these have largely been anchored within compliance functions without clearly defined ownership across business lines, she said. However, experts believe the bigger challenge lies in implementing these requirements across legacy technology systems. “When you translate it into technical requirements, it is very, very deep work in rearchitecting the fundamental data architecture,” said Rajat Deshpande, chief executive officer and co-founder of FinBox. Requirements such as maintaining end-to-end data lineage, identifying an authoritative source for every data element and tracking how information moves across systems would require fundamental changes to banks’ data architecture and could take years to implement, he said. Deshpande added that the exercise becomes even more complex when viewed alongside the Digital Personal Data Protection (DPDP) Act, as institutions would not only have to track the movement of data but also ensure that every use of customer information complies with consent requirements. Abhinav Parashar, co-founder and chief executive officer of Digio, said regulated entities would need to invest in capabilities such as data cataloguing, metadata management and data quality monitoring while also creating clearer accountability across business, risk, compliance and technology teams. He said the framework represents a shift from treating data management largely as a compliance function to an enterprise-wide governance model. Biju K, chief data protection officer at Federal Bank said the draft largely formalises governance practices already followed by banks, as institutions already comply with several regulatory and industry standards on information security and privacy. However, he acknowledged that mapping end-to-end data lineage across multiple legacy systems and maintaining metadata at scale would require considerable effort. According to Shweta Jha, Managing Director at Alvarez & Marsal, the framework gives institutions a valuable opportunity to strengthen how they operate. Beyond investments in technology, firms that commit management and board attention to governance, oversight and regulatory reporting will build lasting capabilities — turning data governance into an enduring source of resilience and trust rather than a one-time compliance exercise. Since the framework is still in the draft stage, industry participants are also seeking greater clarity on implementation. Deshpande said the RBI could consider differentiated implementation timelines based on the size and complexity of regulated entities and provide further guidance on the obligations of technology service providers and fintechs that process data on behalf of banks.