RBI Is Telling Bank Boards That Data Is Now A Risk-Class, Not An IT Problem

Regulators are learning to treat data the way they already treat credit risk: a balance-sheet-tier exposure with named owners, written policy, and a standing committee. RBI's draft "Guidance on Regulatory Expectations for Data Governance," open for public comment until 17 Aug 2026, lifts data governance out of the CIO's office and into the boardroom.

The mechanism is governance topology, not privacy theater. Under RBI's draft, every commercial bank, small finance bank, payments bank, cooperative bank, regional rural bank, NBFC, all-India financial institution, asset reconstruction company, and credit information company would need a Data Governance Framework aligned to its risk management apparatus, plus a Board-level Data Governance Committee (new or absorbed) that approves data policy, oversees implementation, reviews material breaches, and escalates key issues to the full board. That is the same apparatus that already governs credit, market, and operational risk. Data is being slotted into the same risk class.

The selection story is structural: peer regulators have already pushed data quality and third-party risk into model-risk management for the same reason. RBI is the latest to formalize it. The causal story is that the volume, variety, and velocity of data now exceeds any single risk officer's ability to oversee it, so the board has to.

The falsifier sits in what RBI's draft does not say. RBI's draft names expectations, committees, and lifecycles, but is silent on penalties for non-compliance, the cadence of supervisory review, and whether breach findings flow into the framework that already disciplines weak banks. Until enforcement teeth land, this is governance architecture without a test: a shape, not a check.