Abstract
The Digital Personal Data Protection Act, 2023 (DPDPA), read with the Digital Personal Data Protection Rules, 2025, introduces a comprehensive data protection framework that significantly impacts India’s financial service sector. Banks and NBFCs are major processors of sensitive personal and financial data and are likely to be designated as Significant Data Fiduciaries, making them subject to enhanced compliance obligations.
This article examines the impact of the DPDPA and DPDP Rules on the financial service industry, particularly on banks and NBFCs, through a practical, compliance-oriented lens and proposes a structured compliance approach tailored to sector-specific operational realities.
It analyses the key obligations under the DPDPA and DPDP Rules, including consent and notice requirements, purpose limitation, minimisation of data, storage limitation, breach notification, and governance measures, and evaluates their implications for core financial activities such as digital onboarding, KYC processes, credit assessment, customer analytics, outsourcing, and incident response.
The article further explores the interaction between the DPDPA, DPDP Rules, and existing RBI regulations and guidelines, identifying areas of convergence and practical tension, particularly with respect to data retention mandates, cybersecurity reporting, outsourcing frameworks, and data localisation requirements.
Drawing on guidelines and industry analyses, the article identifies key implications of these challenges and outlines actionable compliance measures for banks and NBFCs. These require an integrated approach combining legal interpretation, technological design, and operational governance to achieve sustainable regulatory alignment.
Keywords: DPDP Compliance, DPDP Rules, Banks and NBFCs, Data Governance Framework, Consent and Notice, Vendor Risk Management, Data Breach Reporting, Privacy Technology
Introduction
The enactment of the Digital Personal Data Protection Act, 2023, read with the Digital Personal Data Protection Rules, 2025, marks the first time India has adopted a comprehensive, horizontal data protection regime governing the collection, processing, storage, and disclosure of digital personal data. Unlike earlier sector-specific or fragmented frameworks, the DPDPA applies uniformly across industries, including financial services, thereby reshaping compliance obligations for banks and NBFCs.
The financial services sector is uniquely positioned at the intersection of data volume, sensitivity, and regulatory oversight. Banks and NBFCs process vast quantities of personal data, ranging from identity information and transaction histories to credit behaviour, financial profiling, and behavioural analytics. This makes them natural candidates for classification as Data Fiduciaries, and in many cases, Significant Data Fiduciaries under the DPDPA framework.
Consequently, compliance is not merely a statutory requirement but also a critical component of risk management, consumer trust, and institutional resilience.
Constitutional Foundation of Data Protection
The constitutional basis of the DPDPA can be found in the historic Supreme Court decision in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), where the Court held that informational privacy is a fundamental right under Article 21 of the Constitution of India. The Court held that privacy includes control over personal data and the right of informational self-determination.
The DPDPA and DPDP Rules give effect to this constitutional imperative by providing a statutory framework for the processing of digital personal data. Specifically, the principles of purpose limitation, notice given by the Data Fiduciary to the Data Principal, consent, consent manager framework, proportionality in processing legitimate use conditions, and reasonable security safeguards are in line with the constitutional test of Puttaswamy, which held that any limitation on the right to privacy must be subject to the tests of legality, necessity, and proportionality.
For banks and NBFCs, therefore, compliance with the DPDPA is not just a regulatory requirement but a constitutional imperative based on the protection of individual autonomy and dignity.
Scope and Applicability of the DPDPA to Financial Institutions
Data Fiduciary Status of Banks and NBFCs
Under the Act, any entity that determines the purpose and means of processing personal data qualifies as a Data Fiduciary. Banks and NBFCs routinely make such determinations in relation to customer onboarding, KYC verification, credit appraisal, transaction monitoring, fraud detection, and marketing initiatives. Therefore, their inclusion within the Act’s scope is unequivocal.
Further, once physical records are digitised, for example scanned loan documents or digitised customer forms, they fall squarely within the ambit of digital personal data under the Act. This substantially widens the compliance perimeter, bringing legacy systems and historical datasets into focus.
Likelihood of Significant Data Fiduciary Designation
The DPDPA and DPDP Rules empower the Central Government to designate certain entities as Significant Data Fiduciaries based on the volume and sensitivity of data processed, the risks to data principals, and the potential impact on national interests. Large banks and systemically important NBFCs are almost certain to fall within this classification, triggering enhanced obligations such as:
- Appointment of a Data Protection Officer
- Conducting Data Protection Impact Assessments
- Independent data audits
- Heightened accountability mechanisms
Industry analyses suggest that most major BFSI players must assume Significant Data Fiduciary level obligations even before formal designation to avoid regulatory shock once enforcement begins.
Core Compliance Principles Under the DPDPA
a) Consent and Notice Architecture
Consent lies at the heart of the DPDPA. Financial institutions must ensure that consent is:
- Free
- Specific
- Informed
- Unambiguous
This represents a departure from earlier practices where consent was often bundled, implied, or embedded within lengthy account opening forms. Banks must redesign onboarding workflows, both digital and physical, to incorporate unbundled consent mechanisms, allowing customers to clearly understand and agree to the distinct purpose of data processing.
b) Purpose Limitation and Data Minimisation
The DPDPA and DPDP Rules mandate that personal data be processed only for specified and lawful purposes, and only to the extent necessary for those purposes. This requirement significantly affects banking practices such as:
- Profiling for cross-selling
- Behavioural analytics
- AI-driven credit scoring
- Targeted marketing
Institutions must reassess whether such secondary uses are clearly disclosed and consented to, or whether they risk violating purpose limitation principles.
c) Rights of Data Principals
The DPDPA provides enforceable rights to individuals, including the right to access personal data and the right to grievance redressal. Banks and NBFCs must operationalise these rights through integrated workflows that cut across branches, call centres, mobile apps, and backend systems.
Failure to do so may result in systemic non-compliance, especially given the scale at which financial institutions operate.
d) Accountability and Governance Obligations
One of the defining characteristics of the Act is the importance it places on accountability. The obligation to comply is not only about documentation but also about being able to demonstrate good governance practices.
Significant Data Fiduciaries are expected to embed privacy governance by ensuring the appointment of a qualified Data Protection Officer, carrying out Data Protection Impact Assessments on high-risk processing activities, conducting internal audits and reviews, and ensuring board-level oversight.
Legitimate Uses vs Consent in Financial Services
Though consent is the main legal ground for processing under Section 6 of the DPDPA, Section 7 and Rule 5 introduce the notion of legitimate uses, allowing the processing of personal data without consent in certain situations. This is of great importance to financial institutions.
Processing for legal obligation compliance under the Prevention of Money Laundering Act, 2002, RBI KYC Master Directions, fraud prevention systems, credit monitoring, and recovery cases may fall under the definition of legitimate use.
However, difficulties in interpretation may arise when financial institutions generally fall back on legal compliance to support secondary uses such as credit analysis or in-house risk modelling. A prudent and documented analysis is therefore necessary to separate processing for legal compliance from processing requiring new consent. Overdependence on Section 7 may lead financial institutions to face scrutiny from the Data Protection Board.
Interplay with RBI and Sectoral Regulations
a) Data Retention and Deletion Conflicts
One of the most important challenges in compliance comes from the interaction between the storage limitation principles of the DPDPA and retention requirements under RBI regulations. RBI rules require the retention of customer and transaction data for a fixed period of time, which may appear to conflict with the deletion requirement of the DPDPA after fulfilment of purpose.
The DPDPA addresses this issue by allowing retention of information as required by law. Banks need to record retention reasons in detail and ensure that their data retention policies align with both regimes.
b) Cybersecurity and Breach Reporting
Banks are already subject to RBI cybersecurity guidelines and incident reporting frameworks. The DPDPA and DPDP Rules impose a similar requirement to notify the Data Protection Board and concerned individuals in case of a breach of personal data.
This creates a need to harmonise both requirements to ensure early detection and synchronised reporting and communication. Failure to do so may result in inconsistent reporting or regulatory risk.
c) Outsourcing and Third-Party Risk Management
NBFCs, in particular, are heavily dependent on third-party service providers such as digital lenders, KYC service providers, analytics companies, and customer acquisition agents. Data Fiduciaries remain liable for the personal data processed on their behalf under the DPDPA.
This is consistent with RBI’s outsourcing guidelines but introduces a privacy-focused element that requires DPDPA clauses in agreements, monitoring of compliance, and clear definition of responsibilities. Non-compliance by third-party service providers will also have a direct impact on banks and NBFCs.
Enforcement Architecture and Financial Penalties
The enforcement mechanism under the DPDPA is based on financial penalties imposed by the Data Protection Board of India. Schedule I of the Act provides substantial financial penalties of up to ₹250 crore for some violations of the Act, such as failure to establish reasonable security safeguards and failure to notify personal data breaches.
Although the Act does not provide for criminal sanctions, the severity of the financial penalties, along with reputational risk and simultaneous enforcement by the Reserve Bank of India, poses a substantial enforcement risk to banks and NBFCs.
The simultaneous risk of horizontal financial penalties under the DPDPA and DPDP Rules, and sectoral financial penalties under RBI regulations, requires an integrated approach to monitoring and board-level oversight.
Practical Compliance Challenges
a) Legacy Systems and Data Silos
Financial institutions often operate legacy systems with fragmented data silos. Implementing rights management and consent withdrawal in accordance with the DPDP framework on such systems is a major challenge.
b) Consumer Awareness Gaps
Consumer awareness about DPDP rights remains limited, making it difficult to obtain meaningful consent and enable rights exercise. Banks may need to take the initiative to educate customers in order to ensure compliance.
c) Resource and Skill Constraints
DPDP compliance demands specialised skills in privacy law, cybersecurity, data governance, and technology, where many institutions currently face capacity gaps.
A Compliance Playbook for Banks and NBFCs
A structured compliance playbook can guide financial institutions through operationalising the DPDPA:
- Governance and Leadership
Establish a central privacy office, appoint a Data Protection Officer with independent authority, and integrate privacy into board-level risk oversight. - Data Mapping and Classification
Conduct enterprise-wide data discovery, identify high-risk datasets, and document lawful bases and purposes. - Consent and Notice Management
Deploy unbundled, multilingual consent mechanisms and maintain auditable consent logs. - Rights Enablement
Create unified workflows for access, correction, and erasure requests, ensuring backend propagation across systems. - Vendor and Outsourcing Controls
Amend contracts with DPDPA and DPDP Rules obligations and conduct periodic vendor audits. - Incident Response
Align DPDPA and DPDP Rules breach reporting with RBI requirements and conduct simulation exercises. - Technology Enablement
Invest in privacy-enhancing technologies and automate Data Protection Impact Assessments, audits, and reporting. Industry commentary increasingly highlights AI-driven privacy tools as essential enablers of scalable compliance.
Strategic Insight and the Road Ahead
Early movers are already setting up privacy offices, performing Data Protection Impact Assessments, and integrating DPDPA principles into product design. Over time, DPDPA and DPDP Rules compliance will become less of a regulatory requirement and more of a differentiator, thereby ensuring trust and transparency.
Conclusion
The DPDPA and DPDP Rules are a paradigm shift in the way personal data is handled by banks and NBFCs. Compliance with the law is more than just legal interpretation; it is a change that needs to happen at the organisational, technological, and cultural levels.
A structured compliance playbook will help financial entities deal with the complexity of regulations and future-proof their business in a privacy-centric financial environment.
Disclaimer
This article is meant for general informational purposes only and is not to be treated as legal advice or opinion.
