Consider the following statements:
The Reserve Bank of India’s recent directives relating to ‘Storage of Payment System Data’, popularly known as data diktat, command the payment system providers that
1. They shall ensure that entire data relating to payment systems operated by them are store in a system only in India.
2. They shall ensure that the systems are owned and operated by public sector enterprises.
3. They shall submit the consolidated system audit report to the Comptroller and Auditor General of India by the end of the calendar year.
Which of the statements given above is/are correct?

The correct option is 1 only.

Analysis of the Statements:

Statement 1 is correct:
In April 2018, the Reserve Bank of India (RBI) issued directives on 'Storage of Payment System Data' (popularly called the data diktat). Under these directives, all payment system providers in India were mandated to ensure that the entire data relating to payment systems operated by them is stored in a system located only in India. This data includes end-to-end transaction details and information collected/carried/processed as part of the payment message/instruction.

Statement 2 is incorrect:
The RBI directive does not require payment systems to be owned and operated exclusively by public sector enterprises. Private and foreign entities are permitted to operate payment systems in India, provided they comply with the data storage norms and regulatory guidelines.

Statement 3 is incorrect:
Payment system providers are required to submit a System Audit Report (SAR) conducted by an Indian Computer Emergency Response Team (CERT-In) empanelled auditor. However, this report is submitted directly to the Reserve Bank of India (RBI), not to the Comptroller and Auditor General of India (CAG).

Therefore, only Statement 1 is correct.