Consider the following statements: The Reserve Bank of India's recent directives relating to 'Storage of Payment System Data', popularly known as data diktat, command the payment system providers that 1. they shall ensure that entire data relating to payment systems operated by them are stored in a system only in India. 2. they shall ensure that the systems are owned and operated by public sector enterprises 3. they shall submit the consolidated system audit report to the Comptroller and Auditor General of India by the end of the calendar year Which of the statements given above is/are correct?

Consider the following statements: The Reserve Bank of India's recent directives relating to 'Storage of Payment System Data', popularly known as data diktat, command the payment system providers that 1. they shall ensure that entire data relating to payment systems operated by them are stored in a system only in India. 2. they shall ensure that the systems are owned and operated by public sector enterprises 3. they shall submit the consolidated system audit report to the Comptroller and Auditor General of India by the end of the calendar year Which of the statements given above is/are correct? Correct Answer 1 only

The correct answer is option 1, i.e 1 only.

  • The RBI has given the following directives relating to Storage of Payment System Data -
    • All system providers shall ensure that the entire data relating to payment systems operated by them are stored in a system only in India (Hence statement 1 is correct).
      • This data should include the full end-to-end transaction details/information collected/carried/processed as part of the message/payment instruction.
      • For the foreign leg of the transaction, if any, the data can also be stored in a foreign country, if required.
    • System providers shall ensure compliance of above rule within a period of six months and report compliance of the same to the Reserve Bank latest by October 15, 2018.
    • System providers shall submit the System Audit Report (SAR) on completion of the requirement.
      • The audit should be conducted by CERT-IN empanelled auditors certifying completion of the activity.
      • The SAR duly approved by the Board of the system providers should be submitted to the Reserve Bank not later than December 31, 2018.
      • CAG is not involved here.

Related Questions

The question given below consists of a statement, followed by three arguments numbered I, II and III. You have to decide which of the arguments is/are ‘strong’ arguments and which is/are ‘weak’ arguments and accordingly choose your answer from the alternatives given below each question. Statement: India’s telecom watchdog has suggested regulation of all entities dealing with consumer data—devices such as iPhones, operating systems such as Android, browsers like Google’s Chrome and apps such as Facebook, Paytm, Uber or Zomato— by bringing them under licence conditions that apply to telecom service providers until a general data protection law is put in place by the government. Which of the following argument weakens the above statement in the best possible manner? Arguments: I. The Telecom Regulatory Authority of India (Trai) said the framework for protection of personal information is ‘not sufficient’ and that the issue of data ownership, privacy, and security is complex and multi-dimensional. It suggested expanding the ambit of licence conditions governing telcos to all entities handling customer information and empowerment of customers to keep their data secure. II. The telecom watchdog further said that individual users owned their data, or personal information, and entities such as devices were ‘mere custodians’ and do not have primary rights over that information. III. Telcos and internet service providers (ISPs) though welcomed recommendations that sought to bring app makers under the same regulations. However, content providers have been opposed to being brought under more regulation. 
In the question below, are given a statement followed by three courses of actions numbered I, II and III. On the basis of the information given, you have to assume everything in the statement to be true, and then decide which of the suggested course of action logically follow (s) for pursuing. Statement: The India Risk Survey 2017 report ranks 'Information & Cyber Insecurity' as the biggest risk facing Indian companies. Indian organizations, both public and private, had witnessed over 27,000 incidents of security threat, from January 2017 till June 2017 alone. Phishing, scanning/probing, website intrusions and defacements, virus/malicious code, ransomware, Denial of Service attacks, and data breaches are some ways in which hackers attack business websites, which can cause operational disruptions and potentially steal sensitive information. Small and medium businesses (SMBs), unfortunately, have been seeing rising incidences of cybercrime. In fact, 70 percent of cyberattacks occur at organizations with lesser than 100 employees  Courses of action: I. Mandate basic security practices and policies for all employees, such as 2-factor authentication, internet use guidelines and create and enforce rules on handling and protecting sensitive data. Conduct frequent training to sensitize employees about opening suspicious emails, encrypting their data, using strong passwords on their devices, installing security apps, and limiting activity over public Wi-Fi. Implement and enforce incident reporting to help ensure that even the smallest breach is report to management as well as the IT teams. II. Basics still matter and are some of the best defenses against viruses, malware, and other online threats. Assess the assets that are most at risk - data, servers, network - and ensure that the systems are updated with the latest security software, web browser, and operating system. Implement firewall security and run antivirus software after each update.  III. Ensure regular backup of all critical data - whether stored in-house or on the cloud. Run scheduled attack drills and stress tests to identify vulnerabilities and ensure that data restoration and business continuity are executed as planned.
In the question below, are given a statement followed by three courses of actions numbered I, II and III. On the basis of the information given, you have to assume everything in the statement to be true, and then decide which of the following suggested courses of actions logically follow(s) for pursuing. Statement: In a bid to find a successor to founder CEO Rana Kapoor, The Yes Bank has formed a five member panel including two members from outside the bank, less than a week after Reserve Bank of India (RBI) cut short his tenure until January 31 2019. In a press release sent to the exchanges late on Tuesday evening, Yes Bank said that the “search and selection committee” would comprise of three members of the bank’s nomination and remuneration committee and also two external members, which the bank did not specify.  Courses of action: I. However, the board has requested the Reserve Bank of India (RBI) to grant an extension to Kapoor up to September 2019 ‘for finalization of audited financial statements for fiscal year ending March 2019 and in order for the statutory AGM process to be completed’. II. The board has also recommended the elevation of senior group presidents Rajat Monga and Pralay Mondal as executive directors ‘to ensure a long term succession plan within Yes Bank, and given the demonstrated track record of these two senior leaders’. All this will be subject to RBI approval.  III. The panel will comprise of five members and will focus on find a successor to Rana Kapoor.
In the question below, are given a statement followed by three courses of actions numbered I, II and III. On the basis of the information given, you have to assume everything in the statement to be true, and then decide which of the following suggested courses of actions logically follow(s) for pursuing. Statement: The Department of Telecommunications (DoT) is set to conduct ‘special audits’ of mobile phone operators from fiscal 2011-12 onwards to check for under-reporting of revenue that might account for a sharp downturn in license fees and spectrum usage charges (SUC). Annual license fees and SUC paid to the government are calculated based on a telco’s revenue. The audit, to be resumed after a gap of three years, comes when license fee and SUC due to the government fell in 2017 by more than 23% on the year and is expected to fall this year too. This is due to the brutal price war, which expedited a bloody consolidation that saw a spate of exits and mergers & acquisitions that dented telecom revenues.  Courses of action: I. All telecom companies will be audited soon and DoT is preparing for this. This will be the third audit and notices will go out soon. II. DoT proposes to conduct audit/special audit of Aircel for the period of seven years for financial years 2011-2012 to 2017-2018. III. Operators fear the new round of audit could lead to a new dues being demanded from the already stressed sector, sparking more litigation and be a drag on time and resources.