Consider the following statements:
The Reserve Bank of India's recent directives relating to 'Storage of Payment System Data', popularly known as data diktat, command the payment system providers that
1. they shall ensure that entire data relating to payment systems operated by them are stored in a system only in India
2. they shall ensure that the systems are owned and operated by public sector enterprises
3. they shall submit the consolidated system audit report to the Comptroller and Auditor General of India by the end of the calendar year

Which of the statements given above is/are correct?

1 only

1 and 2 only

3 only

1, 2 and 3

APEDIA

UPSC Prelims

2019 • 02 Jun, 2019 • Paper-1

Consider the following statements:
The Reserve Bank of India's recent directives relating to 'Storage of Payment System Data', popularly known as data diktat, command the payment system providers that
1. they shall ensure that entire data relating to payment systems operated by them are stored in a system only in India
2. they shall ensure that the systems are owned and operated by public sector enterprises
3. they shall submit the consolidated system audit report to the Comptroller and Auditor General of India by the end of the calendar year

Which of the statements given above is/are correct?

Correct Answer

1 only

Statement 1 Analysis: This is perfectly accurate. The RBI's landmark data localization mandate strictly and unequivocally requires all foreign and domestic paym......

💡 Analysis & Explanation

Statement 1 Analysis ▼

This is perfectly accurate. The RBI's landmark data localization mandate strictly and unequivocally requires all foreign and domestic payment system providers (like Visa, Mastercard, Google Pay) to comprehensively store the end-to-end transaction data exclusively on secure servers physically located within the sovereign territorial jurisdiction of India.

Statement 2 Analysis ▼

This is incorrect. The RBI's regulatory directive solely governs where the generated data is to be stored geographically; it absolutely does not mandate or dictate that the underlying global payment networks or hardware infrastructure must be forcibly owned, nationalized, or operated by government/public sector enterprises.

Statement 3 Analysis ▼

This is incorrect. The regulatory framework mandates that private companies must submit critical compliance audit reports—conducted strictly by CERT-In empanelled cybersecurity auditors—directly to the RBI itself, not to the constitutional office of the Comptroller and Auditor General (CAG) of India.

Conclusion ▼

Only the core localization clause detailed in statement 1 is factually true.

Choose Language

See you soon!