Previous Year Question
Consider the following statements:
The Reserve Bank of India’s recent directives relating to ‘Storage of Payment System Data’, popularly known as Data Diktat, command the payment-system providers that:
they shall ensure that the entire data relating to payment systems operated by them are stored in a system only in India.
they shall ensure that the systems are owned and operated by public-sector enterprises.
they shall submit the consolidated system audit report to the Comptroller and Auditor General of India by the end of the calendar year.
Which of the statements given above is/are correct?
1 only
1 and 2 only
3 only
1, 2 and 3
Correct Answer: A
Detailed Solution
On 6 April 2018, the RBI issued its directive on Storage of Payment System Data. It applied to all authorised Payment System Operators conducting payment-system activities in India.
Statement 1 is correct.
The RBI directed payment-system providers to ensure that the entire data relating to the payment systems operated by them was stored only in a system located in India.
The requirement covered:
complete end-to-end transaction details;
information collected, transmitted and processed;
payment or messaging instructions; and
customer and payment information relating to transactions.
For transactions having a foreign component, a copy of the data relating specifically to the foreign component could be stored abroad. The RBI’s subsequent clarification also permitted processing outside India, provided the payment data was brought back to India within the prescribed period and the copy stored abroad was deleted after processing.
Statement 2 is incorrect.
The RBI directive did not require payment systems to be owned or operated exclusively by Public Sector Enterprises.
The direction applied to both public and private authorised Payment System Operators. Its purpose was not to ensure government ownership, but to secure domestic storage of payment data and provide the RBI with effective supervisory access.
Statement 3 is incorrect.
Payment System Operators were required to submit a System Audit Report demonstrating compliance. The audit was to be conducted by auditors empanelled by CERT-In.
The report was required to be submitted to the RBI, not to the Comptroller and Auditor General of India. The CAG primarily audits the accounts of the Union and State Governments and specified public bodies; it was not the designated recipient under this directive.