DPDP Compliance for Banks and NBFCs: Where the DPDP Act Meets RBI Requirements

The Digital Personal Data Protection (DPDP) Act, 2023 introduces data protection obligations that banks and NBFCs must address alongside existing Reserve Bank of India (RBI) requirements. From customer consent and KYC data retention to third-party risk and breach reporting, financial institutions need a coordinated approach to privacy, security and regulatory compliance. Understanding how these requirements intersect is essential for building a practical DPDP compliance strategy.

Consider a bank that collects customer information during account opening, uses it for KYC verification, shares it with a lending partner and stores it in a cloud-based system. Each activity raises questions about lawful processing, access controls, retention, vendor accountability and data deletion.

For banks and non-banking financial companies (NBFCs), DPDP compliance is not simply a privacy-policy update. It requires a coordinated approach to data governance, regulatory obligations, cybersecurity and third-party risk management.

Why Does DPDP Compliance Matter for Banks and NBFCs?

Banks and NBFCs process substantial volumes of personal data, including identity documents, contact details, financial information, credit records and digital transaction data. The DPDP Act establishes obligations for processing digital personal data within its scope, including requirements relating to consent, security safeguards, individual rights and personal data breaches.

Non-compliance can create financial, regulatory and reputational consequences. The Act provides for financial penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches and up to ₹200 crore for failure to notify the Data Protection Board and affected Data Principals as required.

Financial institutions should assess their existing data practices, identify compliance gaps and prepare for the relevant commencement dates.

DPDP Act Implementation Timeline for Banks and NBFCs

The DPDP Act and the Digital Personal Data Protection Rules, 2025 follow a phased commencement schedule. Banks and NBFCs should plan according to the effective dates of the specific provisions rather than assuming that every obligation applies immediately.

Effective date	Key development	What financial institutions should do
13 November 2025	Initial provisions of the Act and Rules commenced, including provisions relating to the Data Protection Board and institutional arrangements.	Monitor applicable provisions and establish ownership for the compliance programme.
13 November 2026	Rule 4 relating to Consent Managers is scheduled to commence.	Review the potential implications for consent management and applicable processes.
13 May 2027	The principal operational Rules and core Data Fiduciary obligations are scheduled to commence under the notified phased timeline.	Prepare data inventories, notices, security safeguards, breach-response processes and supporting evidence.

These dates reflect the notified commencement schedule. Financial institutions should check the latest official notifications, amendments and corrigenda before finalising their implementation plans.

How DPDP Compliance Intersects with RBI Requirements

The DPDP Act does not replace RBI directions or other applicable financial-sector regulations. Banks and NBFCs need to identify how privacy obligations interact with KYC, cybersecurity, outsourcing, digital lending and recordkeeping requirements.

Compliance area	DPDP consideration	RBI-related consideration
Customer data collection	Identify the applicable basis for processing and provide required notices where applicable.	Meet relevant customer onboarding, KYC and recordkeeping requirements.
Data security	Implement reasonable security safeguards to protect personal data.	Follow applicable cybersecurity, IT governance and information-security directions.
Third-party processing	Address processing carried out by Data Processors on behalf of the institution.	Meet applicable outsourcing, digital lending and third-party risk requirements.
Data retention	Assess whether personal data remains necessary and whether erasure obligations apply.	Preserve records for periods required by applicable KYC, PMLA and other regulations.
Breach reporting	Meet applicable personal data breach notification requirements.	Follow relevant RBI and CERT-In incident reporting requirements.
Governance and accountability	Assign responsibility for processing, compliance and Data Principal requests.	Maintain applicable governance, risk management and compliance controls.

The practical requirement is to map each business process to the applicable laws, regulations and controls. A single control may support multiple obligations, but the institution must still demonstrate that each specific requirement has been addressed.

Consent and Permitted Uses of Personal Data

Under the DPDP Act, consent is one basis for processing personal data. Section 7 also recognises specified legitimate uses. Financial institutions should assess which basis applies to each processing activity rather than treating consent as a universal requirement or assuming that every banking activity automatically qualifies as a legitimate use.

For consent-based processing, institutions should examine whether:

• The required notice clearly explains the personal data being processed and the purpose.
• Consent is obtained through an appropriate affirmative action.
• Consent can be withdrawn through a process comparable to giving it.
• Withdrawal and other Data Principal requests can be recorded and acted upon.
• Records demonstrate when consent was obtained, what it covered and whether it changed.

Institutions should distinguish processing required to fulfil legal or regulatory obligations from optional activities such as promotional communications. The appropriate basis must be assessed for each processing purpose.

DPDP Compliance for Digital Lending and Financial Services

Digital lending ecosystems often involve banks or NBFCs, lending service providers, technology platforms and other service partners. Personal data may move across several systems during an application, underwriting, disbursement and servicing lifecycle.

Financial institutions should map these data flows and establish clear accountability for:

• Data collection: Collect personal data required for the identified purpose.
• Entity responsibilities: Document the role of each participating entity.
• Access controls: Control access to customer information.
• Vendor assessment: Assess vendors that collect, store or process personal data.
• Customer requests and incidents: Handle requests and personal data breaches across the ecosystem.
• Retention and deletion: Apply appropriate rules consistently across connected systems.

These practices should be assessed against the RBI requirements applicable to the specific lending model and the relevant DPDP obligations.

Account Aggregators and DPDP Consent Managers: Understanding the Difference

Account Aggregators and DPDP Consent Managers serve different functions. An Account Aggregator operates within the financial information-sharing framework and facilitates the sharing of financial information with customer consent under the applicable regulatory framework.

A DPDP Consent Manager is a distinct concept under the DPDP Act and Rules, designed to help Data Principals manage consent through the prescribed framework. Financial institutions should not assume that consent obtained through one mechanism automatically fulfils every requirement under the other.

Institutions should evaluate the purpose, data involved, applicable framework and responsibilities associated with each process.

KYC Data Retention vs. the Right to Erasure

One of the key challenges in DPDP compliance for banks and NBFCs is balancing data erasure obligations with mandatory record-retention requirements. Financial institutions cannot apply a blanket deletion rule to every record, nor should they retain personal data indefinitely without assessing the applicable requirements.

Under applicable KYC and PMLA recordkeeping requirements, regulated entities generally need to preserve transaction records for at least five years from the date of the transaction. Customer identification records are generally required to be preserved for at least five years after the business relationship ends or the account is closed, subject to the precise applicable provision and record category.

Institutions should review the relevant RBI KYC Master Direction, PMLA requirements and other applicable rules to confirm the retention period for each record type.

A practical retention framework should:

• Classify data: Organise personal data by record type and business purpose.
• Map retention periods: Identify statutory and regulatory retention requirements.
• Document exceptions: Record the reason for retaining data beyond its original purpose.
• Restrict access: Limit access to records that must be retained.
• Define deletion procedures: Establish deletion or anonymisation processes when retention is no longer required.
• Cover connected systems: Apply retention rules to relevant backups, archives and third-party systems where appropriate.

Where retention is required by law, institutions should document the applicable basis and handle the records in accordance with that requirement.

Security Safeguards and Data Governance

Section 8(5) of the DPDP Act requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. The DPDP Rules, 2025 prescribe further requirements relating to security safeguards, incident notifications and recordkeeping.

Financial institutions should assess whether their existing controls address:

• Access management: Least-privilege permissions and appropriate user access reviews.
• Data protection: Encryption and protection of personal data.
• Activity monitoring: Monitoring of access to customer information.
• Secure integrations: Protection of data transfers and system integrations.
• Vulnerability management: Security testing and remediation of identified weaknesses.
• Incident response: Detection, escalation and response procedures.
• Vendor oversight: Periodic review of vendors and outsourced services.
• Compliance evidence: Records demonstrating control implementation and effectiveness.

The applicable DPDP Rules also prescribe requirements concerning the retention of certain logs and personal data records for at least one year, subject to the scope and conditions of the relevant provisions. Institutions should verify the precise applicability and align it with other legal and regulatory retention obligations.

For a broader view of governance and control management, explore the Cytrusst AI-Driven GRC tool.

DPDP Breach Notification and Incident Response

A personal data breach may trigger obligations under more than one regulatory framework. Banks and NBFCs should establish a coordinated response process that identifies which reporting requirements apply to the specific incident.

Recipient	General requirement	Important consideration
Affected Data Principals	Notify without delay in accordance with the applicable DPDP Rules.	Communications should follow the prescribed requirements.
Data Protection Board	Provide the initial notification without delay and the prescribed detailed information within 72 hours, unless the Board permits additional time.	Follow the applicable notification procedure and required information.
CERT-In	Report incidents covered by the applicable CERT-In Directions within the prescribed six-hour window.	Confirm whether the incident falls within the reporting categories.
RBI	Follow the reporting timelines and procedures applicable under the relevant RBI directions.	Requirements depend on the institution, incident and applicable direction.

Not every privacy incident automatically triggers every reporting obligation. The response team should classify the incident, determine the relevant reporting paths and document the decisions, timelines and actions taken.

Third-Party Risk and Vendor Accountability

Financial institutions frequently rely on cloud providers, lending service providers, customer communication platforms, analytics vendors and other technology partners. These relationships can create additional risks when personal data is shared, accessed or processed outside the institution's direct systems.

DPDP compliance should be integrated with third-party risk management. Institutions should:

• Maintain an inventory of vendors that process personal data.
• Identify the data shared with each vendor and the purpose of processing.
• Assess vendor security and privacy controls before onboarding and periodically thereafter.
• Define responsibilities for incident reporting and cooperation.
• Address subcontracting, data return, retention and deletion in contractual arrangements.
• Track remediation actions and unresolved third-party risks.

Learn more about third-party risk management and how structured vendor oversight supports compliance.

What Should Banks Know About Significant Data Fiduciaries?

The DPDP Act allows the Central Government to notify certain Data Fiduciaries as Significant Data Fiduciaries based on prescribed considerations. Additional obligations may apply to entities that receive this designation, including requirements relating to Data Protection Officers, independent data audits and data protection impact assessments, as applicable under the Act and Rules.

Banks and NBFCs should monitor official notifications and assess their obligations based on their actual regulatory status. Not every financial institution automatically falls into this category.

DPDP Compliance Checklist for Banks and NBFCs

A structured readiness programme helps financial institutions identify gaps, prioritise remediation and prepare for the core DPDP obligations.

Phase 1: Identify and Map

• Inventory personal data collected across customer and employee processes.
• Map data flows between internal systems and external service providers.
• Identify the purposes and applicable legal basis for each processing activity.
• Review existing privacy notices and consent mechanisms.

Start by assessing your current readiness with the Cytrusst DPDP readiness assessment.

Phase 2: Review Controls and Obligations

• Map DPDP requirements to relevant RBI, KYC, PMLA and other applicable obligations.
• Review retention and erasure policies.
• Assess security safeguards and access controls.
• Review vendor contracts and third-party risk procedures.
• Define processes for Data Principal requests and breach response.

Phase 3: Implement and Document

• Assign clear ownership for privacy and compliance activities.
• Update policies, procedures and relevant contracts.
• Implement consent, retention and deletion workflows where required.
• Maintain evidence of control implementation and periodic reviews.
• Train relevant teams and test incident response procedures.

Phase 4: Monitor and Improve

• Track regulatory updates and commencement notifications.
• Review compliance gaps and remediation progress.
• Monitor third-party risks and overdue actions.
• Test whether controls continue to operate effectively.

How Cytrusst Can Support DPDP Compliance

Managing privacy requirements across multiple business units, systems and third parties can be difficult when evidence and risk information are fragmented. A structured compliance approach helps teams connect requirements, controls, owners and supporting evidence.

Cytrusst supports governance, risk and compliance activities through capabilities designed to help organisations organise compliance workflows, assess risks, manage third-party oversight and maintain visibility into control-related activities.

• AI-Driven GRC: Support compliance mapping, control tracking, risk registers and audit evidence management.
• Third-Party Risk Management: Structure vendor risk assessments and remediation tracking.
• Compliance management: Organise compliance obligations and supporting evidence.

Financial institutions evaluating a DPDP platform should assess how well it supports their specific workflows, regulatory obligations, evidence requirements and existing technology environment.

Schedule a demo with Cytrusst to discuss your governance and compliance requirements.

Frequently Asked Questions

Does the DPDP Act apply to banks and NBFCs?

Yes. The DPDP Act applies to the processing of digital personal data within its scope. Banks and NBFCs should assess their processing activities and prepare for the obligations applicable to them under the phased commencement schedule.

Does DPDP compliance replace RBI compliance?

No. The DPDP Act operates alongside applicable RBI directions and other legal requirements. Financial institutions must identify and comply with the requirements that apply to each activity.

Can a bank delete KYC data when a customer requests erasure?

Not necessarily. The institution must assess the applicable retention obligations and the circumstances of the request. Where retention is required by law, the relevant records may need to be preserved for the prescribed period.

What is the difference between an Account Aggregator and a DPDP Consent Manager?

An Account Aggregator facilitates financial information sharing under the applicable financial regulatory framework. A DPDP Consent Manager is a separate mechanism under the DPDP framework for managing consent. They serve different purposes and should not be treated as interchangeable.

What should a DPDP compliance checklist for banks include?

A DPDP compliance checklist for banks should cover data mapping, processing purposes, notices and consent, security safeguards, retention and erasure, vendor management, Data Principal requests, breach response, accountability and compliance evidence.

When do the core DPDP obligations take effect?

Under the notified phased schedule, the core Data Fiduciary obligations are scheduled to commence on 13 May 2027. Institutions should verify official notifications for any subsequent changes.

Prepare Your Institution for DPDP Compliance

For banks and NBFCs, DPDP readiness requires more than updating privacy documentation. It involves understanding how personal data moves through the organisation, aligning privacy practices with applicable RBI requirements, managing third-party exposure and maintaining evidence that controls are working.

Start with a structured review of your current practices, identify compliance gaps and assign clear ownership for remediation.

Take the DPDP readiness assessment or connect with Cytrusst to explore your governance and compliance needs.