RBI's Draft Data Governance Framework & DPDP: What Banks and Fintechs Need to Do Now

Financial data governance is entering a new phase in India. Banks and NBFCs are managing intricate data relationships with fintechs, technology providers, lending platforms, and other third parties while preparing for a broader set of privacy and regulatory obligations.

The RBI's draft Guidance on Regulatory Expectations for Data Governance, issued on July 15, 2026, brings this challenge into sharper focus. The proposal places greater emphasis on data ownership, quality, lineage, governance structures, and accountability across regulated entities.

Moreover, the RBI Draft Data Governance Framework sits alongside the country's broader digital privacy regime, including the DPDP Act and Rules. For banks and fintechs, the important question is how these expectations translate into everyday data management, partnerships, and compliance.

Why Is the RBI Draft Data Governance Framework Released Now

The timing of the RBI data governance guidelines is closely connected to how financial institutions now create, process, exchange, and rely on data.

Digital banking, embedded finance, digital lending, automated decision-making, analytics, cloud infrastructure, and third-party technology services have created increasingly connected data environments. A customer's information may move through a bank, lending platform, KYC provider, analytics service, cloud environment, and other vendors before supporting a single business process.

The RBI's draft recognizes this growing complexity. It states that weaknesses in data governance can create financial, operational, compliance, and reputational risks. It therefore proposes a structured approach covering governance, data roles, architecture, metadata, lineage, quality, lifecycle management, and third-party arrangements.

The timing also matters because regulated entities are preparing for other major data and risk requirements. The expected credit loss framework is scheduled to take effect from April 1, 2027, increasing the importance of reliable data infrastructure for credit and risk processes. At the same time, organizations are preparing for the phased implementation of the DPDP Rules, 2025, which were notified on November 14, 2025.

The RBI Draft Data Governance Framework therefore allows banks to address data governance as an enterprise discipline rather than as a narrow IT exercise.

Who Needs to Comply with RBI Data Governance Guidelines

The draft applies directly to a broad group of RBI-regulated entities. The scope includes:

• Commercial banks
• Small finance banks
• Payments banks
• Local area banks
• Regional rural banks
• Urban and rural cooperative banks
• All India Financial Institutions
• Non-Banking Financial Companies
• Asset Reconstruction Companies
• Credit Information Companies

The RBI's draft consultation explicitly lists these 11 categories of regulated entities.

Fintech companies are not automatically subject to the draft simply because they operate in financial services. However, they can be materially affected when they provide technology, lending, analytics, KYC, payment, cloud, or other services to regulated entities.

This makes the RBI data governance guidelines relevant to fintech operating models, contracts, data flows, audit arrangements, and security controls even where the fintech itself is not the regulated entity.

For banks and NBFCs, the immediate responsibility is clear: third-party dependence cannot create a blind spot in the institution's data governance framework.

RBI's Draft vs. the DPDP Act: What's the Difference

The RBI Draft Data Governance Framework and the DPDP framework address different problems, although they intersect around personal data and accountability.

The RBI proposal is primarily concerned with how a regulated entity governs data as an organizational asset. It addresses ownership, data quality, architecture, metadata, lineage, lifecycle controls, and third-party data arrangements.

The DPDP Act focuses specifically on the processing of digital personal data and the rights and obligations that arise from that processing. Its framework addresses concepts such as consent, legitimate uses, notice, individual rights, security safeguards, and accountability for personal data processing. The notified DPDP Rules, 2025 provide additional operational requirements and a phased commencement framework.

For financial institutions, these frameworks should not be treated as separate compliance projects. A data field containing customer information may need to satisfy RBI expectations for accuracy and lineage while also being processed in accordance with applicable privacy requirements.

RBI Draft vs. DPDP Act at a Glance

This is why DPDP compliance for banks cannot be handled only by the privacy or legal team. Data governance decisions made by technology, risk, business, security, and procurement teams can directly affect privacy compliance.

The same principle applies to DPDP compliance for banks working with fintech providers. The bank needs sufficient visibility into relevant processing activities, data flows, contractual responsibilities, and controls to demonstrate accountability.

What the RBI Draft Data Governance Framework Requires

The draft moves data governance from broad policy language toward defined organizational mechanisms. The central idea is simple: data needs accountable ownership, consistent definitions, traceable movement, and measurable quality.

Board Oversight and a Dedicated Data Function

The RBI data governance guidelines propose Board-level oversight of the Data Governance Framework, supported by an appropriate Board committee or existing committee.

At the executive level, the framework proposes a Data Governance Committee with representation from functions such as the Data Function, IT, information security, business, risk, and compliance.

The draft also calls for a dedicated Data Function headed by an officer at the level of Chief General Manager or equivalent. This function acts as a central coordination point for implementation across the organization.

This structure matters because data governance often fails when responsibility is distributed, but accountability is not. A business team may define how information is used, technology may control where it is stored, security may manage access, and compliance may interpret regulatory requirements.

For the RBI Draft Data Governance Framework, governance therefore starts with people and decision rights before it reaches technology.

Who Owns Your Data: Data Owner, Steward, and Custodian

The draft separates important data responsibilities instead of placing them under a single generic "data owner" label.

A Data Owner is accountable for data within a defined domain, including its definition, classification, and appropriate use.

A Data Steward supports the operational governance of that data, helping maintain definitions, quality, metadata, and adherence to established policies.

A Data Custodian is responsible for implementing controls around storage, access, user entitlements, and technical handling.

This separation gives banks a clearer chain of accountability. If customer information is duplicated across systems, for example, the question is not simply which application stores it. The organization needs to know which business function owns the data, who maintains its meaning and quality, and which technical team controls access.

The RBI data governance guidelines make these distinctions particularly important as data moves between internal platforms and external providers.

Single Source of Truth, Metadata, and Data Lineage

A major element of the RBI Draft Data Governance Framework is establishing a Single Source of Truth for each data element.

This does not necessarily mean every organization must maintain one physical database. It means the institution should establish an authoritative reference for important data and understand how that information is replicated, transformed, enriched, or consumed elsewhere.

Metadata provides context about the data, including its definition, source, classification, ownership, and permitted use. Data lineage then connects the points in the journey, showing where information originates and how it moves through systems.

For example, a customer's income information used in a lending decision could originate from an application, pass through validation services, enter a lending platform, and later feed reporting or risk systems. A documented lineage makes those relationships visible.

This also strengthens third-party data governance DPDP practices because organizations can identify where personal data travels and which parties interact with it.

Measuring Data Quality

Reliable governance requires measurable quality, not simply written policies.

The draft expects regulated entities to establish data quality management processes proportionate to the criticality, sensitivity, and classification of the data. Data should be fit for its intended use, while material quality issues should be identified and remediated in a timely manner.

Banks can translate this into measurable controls around accuracy, completeness, consistency, timeliness, uniqueness, and validity.

For example, a bank could define quality thresholds for customer identifiers, loan records, regulatory reports, or credit-risk information. Exceptions can then be routed to accountable owners instead of remaining hidden inside downstream systems.

The RBI Draft Data Governance Framework therefore treats data quality as an operational control that supports business, risk, compliance, and reporting outcomes.

Managing Data Shared with Vendors and Fintech Partners

Third-party data sharing is one of the most important practical implications of the RBI data governance guidelines.

Outsourcing a process does not automatically outsource accountability. When a bank shares customer information with a fintech, cloud provider, KYC service, analytics company, or technology vendor, the bank still needs visibility into how that information is handled.

A useful way to assess the relationship is to follow the data rather than the contract alone:

Collection → Processing → Transformation → Sharing → Storage → Access → Retention → Deletion

At each stage, the institution should know what data is involved, why it is being processed, who can access it, what controls apply, and when it should be deleted.

This is where bank-fintech partnership compliance becomes more than a contractual exercise. Agreements should reflect actual data flows, responsibilities, permitted purposes, security requirements, incident handling, audit rights, retention requirements, and restrictions on secondary use.

For fintech data privacy requirements in India, the same discipline is useful. A fintech should be able to explain what information it receives from a regulated entity, how it processes that information, where it stores it, and what happens when the business relationship ends.

Strong third-party data governance DPDP practices connect these operational controls with privacy obligations, making customer data sharing more transparent and manageable.

What Banks and NBFCs Should Do Now

Banks and NBFCs do not need to wait for the final RBI framework to begin preparing. A practical starting point is to establish a baseline across five areas.

1. Build a data inventory.

Identify critical data domains, sources, systems, owners, vendors, downstream consumers, and major data flows. Include customer, transaction, lending, risk, and regulatory data.

2. Establish governance ownership.

Define the responsibilities of the Board, committees, Data Function, Data Owners, Data Stewards, Custodians, IT, security, risk, compliance, and business teams.

3. Test data quality.

Identify high-value data elements and define measurable quality rules. Prioritize information used for lending, risk decisions, financial reporting, and regulatory submissions.

4. Connect governance with privacy.

Map data governance controls to DPDP Act fintech compliance requirements, including lawful processing, consent where applicable, security safeguards, retention, and rights-related processes.

5. Review third-party arrangements.

Assess contracts and operational controls for fintechs, technology vendors, cloud providers, and other processors. This should include access, purpose restrictions, audit controls, breach response, deletion, and subcontracting.

This approach creates a foundation for financial services data protection while reducing the risk of treating RBI and DPDP requirements as disconnected programs.

What Fintechs Should Do Now

For fintechs, preparation should focus on making data handling demonstrable.

1. Build consent and processing records into product architecture where applicable. APIs should be capable of exposing relevant consent artifacts, processing events, and data-sharing information rather than relying entirely on manual records.
2. Make data lineage visible. A fintech supporting lending or financial services should be able to identify the source of important information, transformations applied to it, systems that consume it, and parties that receive it.
3. Apply privacy by design at ingestion. For digital lending data, this can include minimizing unnecessary fields, applying data masking where appropriate, and restricting sensitive information to approved processing purposes.
4. Prepare for stronger partner scrutiny. Banks may require more detailed evidence around security safeguards, access controls, retention, incident management, subcontractors, and audit rights.
5. Clarify the Data Fiduciary and Data Processor fintech relationship for each service rather than assuming the same role applies across every partnership. The actual role depends on who determines the purpose and means of processing and the nature of the relationship.

For DPDP Act fintech compliance, this role assessment should be documented alongside contracts, processing activities, and technical controls.

Turning the Draft Into a Data Governance Roadmap

The RBI Draft Data Governance Framework signals a shift toward more structured accountability for data across regulated financial institutions. Its expectations around ownership, lineage, quality, lifecycle management, and third-party arrangements are closely connected to the practical demands of DPDP compliance.

For banks and NBFCs, preparation should begin with visibility into critical data and the relationships that govern it. For fintechs, the priority is making processing, sharing, security, and accountability demonstrable.

The RBI data governance guidelines are still in draft form, but the direction is clear: organizations need stronger control over how data is defined, moved, accessed, shared, retained, and governed.

A coordinated approach to RBI data governance, privacy, vendor oversight, and third-party data governance DPDP requirements can help financial institutions build a more defensible data operating model before these expectations become operational requirements.

Frequently Asked Questions

1. Does DPDP apply when banks use fintech providers?

Yes, where the arrangement involves processing digital personal data within the scope of the DPDP framework. Banks and fintechs should determine their respective roles, processing purposes, contractual responsibilities, and applicable safeguards rather than assuming that outsourcing removes the bank's accountability.

2. Who controls customer data in a fintech partnership?

Control depends on the actual arrangement. A bank may determine why customer information is processed while a fintech performs defined processing activities. In other arrangements, the fintech may have independent purposes. The Data Fiduciary and Data Processor fintech distinction should therefore be assessed case by case.

3. What should fintech agreements include?

Agreements should address permitted data uses, security safeguards, access controls, retention and deletion, incident and breach response, subcontracting, audit rights, data location where relevant, and responsibilities for customer requests. Strong bank fintech partnership compliance requires contracts to reflect actual operational data flows.

4. Are fintech providers always Data Processors?

No. A fintech's role depends on the facts of the relationship and who determines the purpose and means of processing. Some arrangements may involve a Data Processor relationship, while others may create independent responsibilities. Organizations should document the assessment instead of applying a blanket classification.

5. How can financial institutions manage third-party privacy risks?

Start by mapping data flows and identifying critical third parties. Then connect contracts with technical controls, access management, retention, monitoring, audits, and incident processes. This provides a practical foundation for financial services data protection and regulatory accountability.

6. What privacy responsibilities do banks and fintechs share under DPDP?

Responsibilities depend on their roles, but both parties should establish clear processing purposes, appropriate safeguards, contractual controls, and accountability mechanisms. Effective fintech data privacy practices in India require privacy requirements to be reflected in product design, data flows, agreements, and operational controls.