New Delhi: The Reserve Bank of India (RBI) has released comprehensive draft guidelines aimed at strengthening customer data protection and data governance across banks, non-banking financial companies (NBFCs), and other regulated financial institutions. Under the proposed framework, every piece of customer information will be assigned a unique Digital Tag, enabling institutions to record when the data was collected, the purpose for which it was obtained, when customer consent was received, where the information was used, with whom it was shared, and when it is scheduled for deletion. The RBI has invited comments and suggestions from stakeholders on the draft framework until August 17.
According to the proposal, regulated entities will be required to maintain a complete data lifecycle for every customer record. Each dataset will carry a digital tag containing key information, including the customer’s identity, the purpose for which the data was collected, its sensitivity classification, authorised usage permissions, the retention period, and the scheduled disposal timeline. The objective is to improve transparency in the handling of personal information and ensure that customer data is processed only for approved and legitimate purposes.
The draft framework also proposes that whenever customer information is shared with an affiliated entity, fintech company, service provider, or any other authorised third party, the associated digital tag must accompany the data. This would create a comprehensive data trail, making it easier to determine where customer information is stored, how it has been used, and which organisations have accessed it. The RBI believes this mechanism will significantly strengthen data governance, accountability, and regulatory compliance throughout the financial ecosystem.
As part of the proposed framework, all regulated entities would be required to establish a Board-level Data Governance Committee responsible for approving data management policies and periodically reviewing data quality, security, privacy, and regulatory compliance. In addition, every institution would be expected to create a dedicated Data Management Unit responsible for overseeing data maintenance, classification, protection, governance, and risk management activities.
The RBI has also made it clear that the ultimate responsibility for protecting customer information will continue to rest with the regulated financial institution, even when data is shared with fintech partners, cloud service providers, or other external vendors. Before any such data sharing takes place, institutions will be expected to implement appropriate legal agreements, strong encryption standards, cybersecurity safeguards, and risk management controls to ensure that customer privacy and information security are not compromised through third-party arrangements.
Another significant feature of the proposed framework is its alignment with the Digital Personal Data Protection (DPDP) Act, which is intended to provide customers with greater control over their personal information. If a customer withdraws consent or requests the deletion of personal data, the digital tagging system would enable institutions to quickly identify every system, server, or third-party organisation where the information resides. This is expected to make data deletion requests more transparent, efficient, and easier to implement while improving compliance with privacy regulations.
According to experts at the Future Crime Research Foundation, centralised data governance, digital tagging, and enhanced oversight represent important advances in protecting customer privacy and strengthening cybersecurity across the financial sector. They note that maintaining clear records of customer consent, ensuring complete traceability of data usage, implementing strong encryption standards, conducting regular security audits, and establishing board-level governance can significantly reduce the risks of data misuse and unauthorised access. Experts believe that effective implementation of the proposed guidelines would improve accountability in data management while strengthening public confidence in India’s digital banking and financial ecosystem.
