Introduction

India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), together with the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) (collectively, the “DPDP Framework”), ushers in a comprehensive privacy regime with significant implications for banks, insurers, securities intermediaries, fintech companies, credit information companies, payment system participants and other financial services companies. The DPDP Framework is presently being implemented in a phased manner. While certain preliminary provisions (for instance, the definitions under the law and provisions in relation to establishment of the Data Protection Board of India (“Board”)) came into force on November 13, 2025, certain other provisions such as those in relation to consent managers take effect from November 13, 2026. Further, all substantive obligations and compliance requirements under the DPDP Framework, including those relating to consent, notice, data principal rights, data breach reporting, cross-border transfers, and penalties, take effect from May 13, 2027.

This article outlines the impact of the DPDP Framework on entities operating in the financial sector, highlights compliance challenges and opportunities for them,  and sets out practical recommendations to achieve compliance with the law in time.

Applicability and scope for financial institutions

The DPDP Framework applies to processing of digital personal data within India and, extra‑territorially, to the processing outside India if such processing is in connected with offering goods or services to individuals in India. The law centers obligations on “Data Fiduciaries” (entities determining purposes and means of processing) and recognizes “Data Processors” (service providers processing on behalf of a Data Fiduciary) under contract.

Financial service providers typically act as Data Fiduciaries in customer‑facing, employee and vendor contexts, and may act as Data Processors, for instance where they provide outsourced services to other entities. In parallel, relevant entities operating in the financial sector may also need to reconcile their DPDP Framework compliance duties with the regulatory frameworks prescribed by the Reserve Bank of India (“RBI”), Securities and Exchange Board of India (“SEBI”) Insurance Regulatory and Development Authority of India (“IRDAI”) as applicable; and the Prevention of Money Laundering Act, 2002 (“PMLA”) driven KYC (“Know Your Customer”) obligations that prescribe data collection and retention.

Key compliances under the DPDP Framework

Lawful grounds for processing: Consent is the main lawful ground for processing under the DPDP Framework.  Consent must be free, specific, informed, unconditional, unambiguous and by clear affirmative action, and be supported by a standalone privacy notice that itemizes personal data, specifies granular purposes of processing and goods/ services enabled by such processing, and provides direct weblinks for accessing the website and / or web application for exercising rights of data principals including withdrawal of consent and making complaints to the Board. Further, data principals must be given the option to access requests for consent and privacy notices in English or any of the twenty‑two languages listed in the Eighth Schedule to the Constitution. Where historic consents exist, fresh consents need not be obtained and the Data Fiduciary can provide the relevant data principals a privacy notice compliant with the requirements under the DPDP Framework and continue processing unless consent is withdrawn.

Legitimate uses and certain exempted purposes: The DPDP Framework allows processing without consent for certain “legitimate uses”. These include processing scenarios where an individual voluntarily provides their data for a specified purpose without indicating refusal to provide consent; various public health and medical emergency scenarios; employment‑related purposes; and processing to safeguard an employer from loss or liability to provide a benefit sought by an employee. In addition to legitimate uses, there are certain exempted purposes of processing to which almost all substantive provisions of the DPDP Framework do not apply. These include an exemption enabling processing “for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted” on a loan or advance from a financial institution, subject to consistency with disclosure provisions in other applicable law. Such exempted purposes also cover enforcement of legal rights and functions of judicial and regulatory bodies, and processing of personal data of foreign data principals in India pursuant to a cross-border contract.

Facilitating exercise of data principal rights: Where processing is based on consent, data principals can request a summary of personal data and processing activities undertaken in relation to such processing, identities of third-party recipients of personal data along with a description of data so shared, correction, completion, updation and erasure of personal data, and withdrawal of consent. Further irrespective of whether processing is based on consent, data principals have a right to grievance redressal within 90 days, and nominate another person to exercise their rights upon death or incapacity. Data Fiduciaries are obligated to publish effective means to exercise these rights and designate contact points capable of answering questions about processing.

Implementing reasonable security safeguards: The DPDP Framework requires all Data Fiduciaries to implement reasonable security safeguards and appropriate technical and organizational measures to achieve compliance with the DPDP Framework.  The law specifies certain baseline information security measures including encryption or tokenisation, access controls, logging, monitoring and review, data backups, and the retention of personal data and associated traffic data and logs for a minimum of one year to enable detection, investigation, remediation and continuity of processing where confidentiality, integrity or availability is compromised. Further, contracts with Data Processors must flow down appropriate safeguards and governance expectations.

Breach notification: All personal data breaches must be intimated to affected individuals without delay with concise information about the incident, consequences, mitigation and contact details. Additionally, two (2) sets of breach notifications must be made to the Board.  The first reporting must be made without delay with the initial description of the breach. This must be followed by an update within seventy‑two (72) hours with further particulars, remedial steps and a report regarding notifications to affected individuals. These obligations sit alongside existing requirements under Indian information technology laws to report certain cybersecurity incidents to the Indian Computer Emergency Response Team (“CERT‑In”) within six (6) hours, and incident notification requirements under sectoral regulations.

Children’s data: Children’s data is subject to heightened protections, including verifiable parental consent and prohibitions on processing that is likely to cause detrimental effects, as well as restrictions on tracking, behavioural monitoring and targeted advertising directed at children, subject to limited exemptions specified in the DPDP Rules.

Significant Data Fiduciaries (“SDFs”):  SDFs notified by the Government based on factors such as volume and sensitivity of data, risk to rights, and public interest considerations, face additional obligations. These include appointment of an India‑based Data Protection Officer reporting to the board of the data fiduciary, appointment of an independent data auditor, annual Data Protection Impact Assessments and audits, and further due diligence regarding technical measures and, where specified by the Government, restrictions requiring certain personal data and related traffic data to remain within India.

Cross‑border transfers : The DPDP Act adopts a “blacklist” model under which the Government may restrict transfers to specified countries or territories. The DPDP Rules additionally require that Data Fiduciaries meet any requirements specified by the Government when making data available to foreign States or their agencies. Firms must monitor for restrictions and adapt their transfer mechanisms, contracts and assessments accordingly.

Data retention restrictions: Where processing is based on consent, personal data must be erased upon withdrawal of consent or when it is reasonable to assume the specified purpose is no longer served, unless retention is required by other law. The DPDP Rules also establish a one‑year minimum retention of personal data and logs associated with processing to enable detection of unauthorised access, its investigation and remediation, and continued processing in the event of a compromise, after which erasure must follow unless longer retention is required by law or notified by Government. Additionally, all personal data processed by a Data Fiduciary must be retained for a period one year post completion of such processing for use the Government for purposes that primarily relate to India’s national security.

Potential compliance challenges and opportunities for financial service providers

Consent and notice requirements: Financial services providers face the practical challenge of aligning granular consent, privacy notice, and request for consent requirements with complex product suites and multi‑channel  customer onboarding mechanisms, that often rely on layered disclosures and recorded consents across branches, applications, call centres and third‑party distributors. Ensuring that consent artefacts and privacy notice content are harmonized and  provable across these channels will require coordinated content management, consent orchestration and robust mechanisms to demonstrate compliance with the notice and consent requirements under the DPDP Framework. These challenges are further compounded by the requirement under the DPDP Framework to make available privacy notices and requests for consent in English and the twenty-two (22) scheduled languages as mentioned above.

Rights handling at scale will test legacy systems: Banks, insurers and market intermediaries likely maintain numerous platforms and vendor integrations for customer relationship management, onboarding, KYC, underwriting, risk, collections, claims and dispute management. Delivering timely, identity‑ assured rights responses and consistent data correction and erasure across such platforms and integrations , including processors, necessitates standardized Application Programming Interface (APIs), entitlements, identity proofing steps and case management playbooks.

Breach response:  The sector already manages stringent incident reporting to multiple authorities. The DPDP Framework overlays an “all breaches” duty to notify both the Board and every affected individual without delay, as well as a seventy‑two‑hour update to the Board. Aligning triage severity matrices, notification templates and data minimisation principles with these timelines, while coordinating with existing technology and sectoral obligations, will be an area of intensive operational design.

Interplay with other financial laws: The purpose limitation and data retention requirements under the DPDP Framework, are complicated by prescriptive retention duties under various sectoral regulations applicable to financial service providers. For instance, the DPDP Framework’s consent‑linked deletion, one‑year data retention requirements, personal data breach reporting requirements, and obligation to implement reasonable security safeguards and appropriate technical and organizational measures must be reconciled with corresponding obligations prescribed under relevant sectoral laws, particularly in respect of datasets such as KYC records, transaction records and audit trails. Accordingly, financial service providers will need defensible compliance programs that operationalize both the DPDP Framework as well as requirements under relevant sectoral laws, and cascade that to processors.

Third‑party risk management: The DPDP Framework makes Data Fiduciaries accountable for processing by their processors, and the DPDP Rules mandate contractual safeguards. Financial institutions’ extensive outsourcing to fintechs, cloud providers, KYC utilities, analytics partners and recovery agencies will require uplifted clauses, Data Protection Impact Assessments (“DPIAs”) triggers, audit and assurance rights, breach cooperation covenants and logging obligations.

SDF designation : Certain banks, insurers, securities market infrastructures and major fintech platforms service a very large number of data principals, process high volumes of  personal data and present systemic risk considerations, increasing the likelihood of their notification as SDFs. Standing up an India‑based Data Protection Officer (“DPO”) function reporting to the board, instituting annual DPIAs and data audits and putting in place algorithmic risk due diligence will be material governance lifts.

Appointment of Consent Managers: Consent Managers present an opportunity for consent portability and standardization: The DPDP Rules contemplate registered consent managers providing interoperable platforms through which individuals can give, manage and withdraw consent, including illustrations of bank‑to‑bank data sharing with user‑directed consent flows. Financial services providers could both consume and, in some cases, participate in such ecosystems to streamline consent capture, evidence and data sharing with reduced friction.

Operational, legal and business implications

Operationally, financial service providers should anticipate substantial change programmes spanning data mapping; redesign of consent requests, privacy notices, and internal organizational policies governing processing of personal data; rights response orchestration; security uplift; breach response playbooks; and vendor governance. Technology investments will likely include consent orchestration services, multilingual privacy notice delivery, identity‑assured rights portals, deletion automation, logging upgrades and data discovery tools to support DPIAs and audits (where required) and processor oversight.

Privacy artefacts will expand to include DPDP Framework compliant notices and consent texts, revised customer and employee terms, and re‑drafted processor agreements flowing down obligations under the DPDP Framework, breach cooperation,  and logging obligations. Financial services providers should also be ready with governance artefacts including records of consent obtained and notices provided, policies reflecting legitimate uses, exemptions and retention rationales, and if notified as an SDF, DPIA and privacy audit methodologies tailored to financial use cases, policies in relation to risk averse use of algorithmic software, and appoint a DPO.

Child accounts, education insurance, and other products for children require verifiable parental consent. Tracking, behavioural monitoring, and targeted advertising directed at children are restricted, subject to limited exemptions. Financial services providers should review onboarding and digital experiences for child-focused products and services and update them to align with the safeguards prescribed under the DPDP Framework.

The absence of default localization requirements under the DPDP Framework coupled with the Government’s blacklist‑based restriction powers, allows continued regional and global processing arrangements, including cloud. Financial services providers should however monitor for any notified data transfer restrictions and requirements specified for making data available to foreign States or agencies and incorporate those conditions in transfer governance. Additionally, the data localization restrictions under sector specific regulations including those prescribed by the RBI, would continue to apply.

From a business perspective, compliance can act as a differentiator. Transparent notices, robust rights handling and prompt breach communication build customer trust and can be positioned as enhancements to digital journeys. Participation in Consent Manager ecosystems could accelerate data portability‑enabled propositions and partnerships, with appropriate controls. Conversely, enforcement risk and the scale of potential penalties underscore the importance of early readiness to avoid remediation costs and reputational harm.

Way forward

With the DPDP Framework taking full effect on May 13, 2027, financial service providers must take urgent steps to initiate compliance with the law, if not already done. This would include among others, launching an India‑specific data mapping exercise and gap assessment; updating relevant documentation including privacy notices, consent requests, and internal organizational policies to align with the DPDP Framework; redrafting data processor agreements to flow down DPDP Framework obligations on data processors, seek appropriate representations, warranties and indemnities, and align processor governance with applicable sector specific outsourcing regulations; complying with data retention, data deletion, and information security requirements under the DPDP Framework; reconciling compliance requirements under the DPDP Framework with corresponding obligations under applicable sector specific regulations;  and implementing technical systems to comply with the DPDP Framework.  Even mature global privacy programmes will need targeted localization to satisfy the DPDP Framework’s unique features such as absence of lawful bases other than consent, multilingual standalone privacy notices, consent provenance, breach notification obligations sans impact / risk thresholds, one‑year personal data retention including log retention requirements, and additional compliance requirements for SDFs. Institutions that operationalize these requirements early will both de‑risk enforcement exposure and convert compliance capability into client‑facing trust and competitive advantage in India’s rapidly expanding financial services market.