Consider the following statements : The Reserve Bank of India’s recent directives relating to ‘Storage of Payment System Data’, popularly known as data diktat, command the payment system providers that I. They shall ensure that entire data relating to payment systems operated by them are stored in a system only in India II. They shall ensure that the systems are owned and operated by public sector enterprises III. They shall submit the consolidated system audit report to the comptroller and Auditor General of India by the end of the calendar year Which of the statements given above is/are correct ?

The correct answer is A. Only statement I is right.

Statement I is correct. The RBI circular of April 2018 on Storage of Payment System Data requires every payment system operator to store the entire end-to-end data of payment transactions only in a system located in India. This is data localisation. The purpose is supervisory access to data and protection of customer information, so that RBI can examine transactions in India without depending on foreign records.

Statement II is wrong. The directive does not require that payment systems be owned or operated by public sector enterprises. Private payment operators are equally covered. The rule concerns where the data is stored, not who owns the infrastructure.

Statement III is wrong. The consolidated system audit report is submitted to the Reserve Bank, not to the CAG. The audit is conducted by CERT-In empanelled auditors, and the report goes to RBI by the end of the calendar year.

Core concept: data localisation as a regulatory tool. This links to GS-3 on fintech, cyber security and data protection, and to the debate on balancing innovation with privacy and sovereignty.

Trap: candidates often pick B because public sector ownership sounds like a safe regulatory condition, or they assume the CAG audits all RBI-regulated systems. Check each statement against the actual circular.