RBI + DPDP Act 2023 + GDPR Art 44-49. Searchable. No hallucinations. Source of truth for all future agents.
All data relating to payment systems must be stored in India only. No copy outside India.
Applies to: Payment data, transactions
Allowed: IN
Govt may notify that personal data cannot be transferred outside India. Transfer needs consent.
Applies to: Aadhaar, PAN, financial data
Allowed: IN, Conditional
Transfer outside EU only with adequacy decision or SCCs / BCRs.
Applies to: EU personal data
Allowed: EU, Adequate, With SCCs
No entity other than issuer can store actual card data. Must tokenise.
Applies to: Card data
Allowed: IN Token Vault
Data fiduciary must protect personal data and ensure processor has safeguards.
Applies to: All personal data processing
Allowed: IN
Collect only what is necessary for specified purpose.
Applies to: EU data
Allowed: EU
Banks must have audit trail, access logs for all data access.
Applies to: Bank systems
Allowed: IN
Consent artifact must be maintained, withdrawable.
Applies to: Personal data
Allowed: IN
Notify DPA within 72 hours of breach awareness.
Applies to: EU data breaches
Allowed: EU
All AI models using PII must have model risk register, evals, and approval.
Applies to: AI models in banks
Allowed: Governance Required