Statement 1 is Correct (Data storage in India): This is the core requirement of the directive. It mandates that the entire payment system data be stored in systems located only in India. This aims to improve data security and regulatory oversight.

Statement 2 is Incorrect (Public sector ownership): The directive doesn't specify ownership requirements for the data storage systems. Private companies can also store data as long as the systems are located within India.

Statement 3 is Incorrect (Audit report submission): The directive des not have reporting requirements for system audits to the Comptroller and Auditor General of India (CAG) which typically audits government entities.