Consider the following statements : The Reserve Bank of India's recent directives relating to 'Storage of Payment System Data', popularly known as data diktat, command the payment system providers that 1. they shall ensure that entire data relating to payment systems operated by them are stored in a system only in India 2. they shall ensure that the systems are owned and operated by public sector enterprises 3. they shall submit the consolidated system audit report to the Comptroller and Auditor General of India by the end of the calendar year Which of the statements given above is/are correct?

Statement 1 is correct because the RBI’s 2018 directive mandates that all payment system providers store the entire data relating to payment systems exclusively in systems located in India to ensure unfettered supervisory access. Statements 2 and 3 are incorrect because the rules apply to all providers (including private firms like Visa/Mastercard), and the mandatory system audit report must be submitted to the RBI—not the CAG—after being conducted by CERT-In empaneled auditors. The core concept tested is **Data Localization**, which focuses on the regulatory oversight of digital financial data within national borders.