DPDP Act for Banks, NBFCs & Fintech: Compliance Guide
Banks, NBFCs, payment platforms, lending apps and wealth platforms hold identity documents, account details and transaction histories for millions of people. The DPDP Act adds a consent-and-rights framework on top of the sector rules you already follow.
Your regulators (RBI, SEBI, IRDAI) keep their rules. The DPDP Act sits beside them: it governs why you collect data, what you tell customers, how you protect it and how you handle requests. Where a financial law requires you to keep or disclose data, that law is a legitimate ground and also limits erasure.
Who this covers
Banks and NBFCs are Data Fiduciaries for customer, borrower and guarantor data.
Payment aggregators, wallets and UPI apps are fiduciaries for user and merchant data.
Digital lending and BNPL apps process large volumes of personal and device data, often with partner lenders.
Broking, wealth and mutual fund platforms hold KYC and trading data.
Insurers and distributors hold health, financial and family data.
KYC, collection and outsourcing vendors are usually Data Processors.
Personal data you are likely to hold
Key provisions for Fintech & Banking
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
A legal obligation to disclose data to the State, and orders of courts, are legitimate uses.
Itemised notices and separate, withdrawable consent, especially for marketing and cross-selling.
Security safeguards, accuracy where data drives decisions, breach intimation, erasure and processor contracts.
Large banks and payment platforms are likely candidates for Significant Data Fiduciary status.
Erasure gives way where law requires retention.
Transfers abroad are open unless restricted, and stricter sector rules prevail. Section 17 has an exemption for tracing defaulters' assets.
The Act works alongside RBI, SEBI and IRDAI requirements.
01KYC, records and legal obligations
Anti-money-laundering and sector rules require you to collect, verify and keep customer records, often for years after an account closes. Under the DPDP Act:
- Customers give you KYC data voluntarily to open and run an account (Section 7). Section 8 also lets you keep data a law requires you to retain. No separate consent is needed for either.
- Use it only for what the law requires. Do not quietly reuse KYC data for marketing or credit-scoring unrelated products.
- When a customer asks for erasure, Section 12 lets you retain what the law requires, but tell the customer what is kept and why.
- Once a retention period ends, erase the data and ask your processors to do the same.
Disclosures to regulators, tax authorities and law-enforcement agencies under law are covered by the legal-obligation legitimate use.
02Consent, lending apps and marketing
Loan journeys often bundle many things into one tick-box: credit checks, partner sharing, marketing and contact access. The Act expects consent to be specific and limited to the stated purpose.
- Keep marketing consent separate from the consent needed for the loan itself, and make it easy to withdraw.
- Name the partners and bureaus you share data with in the notice.
- RBI's digital lending directions already restrict what data a lending app may access on a phone. DPDP consent does not widen that.
- Account Aggregator consents continue as they do now. A DPDP Consent Manager is a separate registered entity (Rule 4), so do not treat the two as the same.
03Vendors, collection agencies and outsourcing
Banks and NBFCs depend on vendors for KYC, collections, call centres, cloud and analytics. Under Section 8 you stay responsible for what processors do for you.
- Put every vendor under a written contract covering purpose limits, security, sub-processors, breach notice timelines and deletion.
- Make sure collection agents handle only the data needed and contact people only as the rules allow.
- Align contracts with RBI's outsourcing requirements, which continue to apply.
04Security, breaches and reporting
Rule 6 sets baseline safeguards: encryption or masking, access control, logging and monitoring, backups and processor contract terms. Financial firms usually exceed this through RBI and CERT-In requirements, but check your controls cover every system holding personal data, not only core banking.
On a breach, Rule 7 requires intimation to each affected customer and a report to the Board, with a detailed report within 72 hours. CERT-In and RBI timelines run in parallel and can be shorter, so build one incident process that triggers all notifications together.
05Cross-border data and localisation
Section 16 allows transfers abroad unless the Central Government restricts a country, and preserves stricter sector laws. For payments, RBI's rules on storing payment-system data in India continue to apply and prevail where stricter. Map your cloud regions, support centres and group companies, and check each flow against both.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Keep records the law requires for the required period, restrict their use, delete the rest, and reply in writing explaining what was retained.
Treat partner marketing as a separate purpose with its own consent and a notice naming the partners.
You are responsible for the vendor. Limit the data it gets and check the contact is allowed by sector rules and the notice.
Start your breach plan. Notify affected customers and the Board, and run CERT-In and RBI reporting alongside.
Check the purpose in the notice. A new purpose may need fresh notice and consent, and accuracy duties apply to decisions affecting customers.
Compliance checklist
Common mistakes to avoid
Treating every KYC-era record as deletable on request, or as keepable forever.
Bundling marketing, partner sharing and loan consent in one tick-box.
Assuming Account Aggregator consent and DPDP consent are the same.
Leaving collection agencies and call centres outside the privacy programme.
Building separate breach processes for the Board, CERT-In and RBI.
Common questions
Do banks still need consent if the law already requires them to hold the data?
Not for data a customer voluntarily gives you to open and run an account, and not for disclosures to the State that a law requires. Section 8(7) lets you keep what a law requires you to retain. Anything beyond that purpose, such as marketing, needs consent.
Can a customer force us to delete KYC data?
Not where the law requires retention. Section 12 lets you keep what is required, but you should tell the customer what you kept and why.
Does DPDP replace RBI's data rules?
No. Section 38 makes the Act apply in addition to other laws, so you follow both. If a provision of another law truly conflicts with the Act, the Act prevails to the extent of the conflict.
Is a payments app a Significant Data Fiduciary?
Only if the Central Government notifies it, based on the volume and sensitivity of data and the risks involved. Large platforms should plan for it.
Are credit bureaus covered?
Yes, as Data Fiduciaries. The Credit Information Companies Act also continues to apply.
Who handles complaints, the Board or the RBI?
Both can be relevant. The Board handles personal data breaches and DPDP complaints. Your sector regulator handles financial conduct complaints. A customer must normally use your grievance process first.