DPDP by sector
For a regulated lender, the DPDP Act is a new layer, not a fresh start.
Banks, non-banking financial companies (NBFCs) and the fintechs that partner with them already work under Reserve Bank of India (RBI) rules on customer data, outsourcing and storage. The Act adds duties owed to the customer directly. This page sets out where each layer leads, in cautious terms, because the sectoral detail changes often.
Back to DPDP services01 · How the Act fits
Three sections decide how the Act meets RBI rules
Additive by default, prevailing on conflict, and deferring on retention and stricter transfer rules.
- Section 38(1)
- The Act applies in addition to other laws, not in place of them.
- Section 38(2)
- Where a provision of the Act conflicts with another law, the Act prevails to the extent of that conflict.
- Section 8(7)
- The erasure duty yields where another law requires retention. The Act's own illustration is a bank keeping identity records after an account closes.
- Section 16(2)
- Any Indian law giving higher protection or tighter limits on sending data abroad keeps applying.
Read together, these mean most RBI rules simply stack on top. A real conflict is rarer than it first looks, because most sectoral rules ask for more protection, not less.
02 · The sector layer
What a regulated entity already carries
Name the instrument; check the current version before relying on any detail.
- Customer confidentialityA long-standing duty of secrecy over customer affairs, from banking practice and statute.
- KYC directionsRBI's Know Your Customer master direction sets what identity data is collected, verified and kept.
- Record retentionAnti-money-laundering law and KYC rules set minimum periods for identity and transaction records.
- Payment data storageRBI's payment-data storage direction expects payment system data to be stored in India.
- Outsourcing directionsRBI rules on outsourcing financial and IT services keep accountability with the regulated entity.
- Account Aggregator frameworkA consent-based route for sharing financial information between regulated entities.
- Digital lending rulesLimits on what lending apps may collect and who may hold borrower data.
Usually covered by RBI work
- Information security policy, controls and audits
- Outsourcing due diligence and oversight
- Fixed retention for identity and transaction records
- Incident reporting to the regulator
Added by the DPDP Act
- An itemised notice for each purpose
- Consent that can be withdrawn as easily as given
- Access, correction and erasure on request
- Breach intimation to the Board and to each affected customer
- A published contact and a grievance route
The right-hand column is where most gap work for a lender sits.
03 · Consent and KYC flows
Account Aggregator and KYC data under the Act
Two existing flows, each needing a DPDP role assigned.
In an Account Aggregator flow, a customer approves the movement of their financial data from one institution to another through an RBI-licensed aggregator. Each party should record its own DPDP role. The institution that asks for the data and decides how to use it is a data fiduciary for that use. The one that releases it is a fiduciary for its own records. Whether the aggregator also counts as a consent manager under the Act depends on registration with the Data Protection Board of India (the Board), which is a separate step.
KYC data is collected because the law requires it, so retention after the relationship ends follows the KYC and anti-money-laundering periods, not the customer's wish. What the Act still asks is that the data is used only for its purpose, kept secure, and erased once the legal period runs out.
04 · Which rule leads
A decision table for common situations
A starting view for discussion with counsel, not a legal opinion.
| Situation | Which rule leads | Why |
|---|---|---|
| Customer closes an account and asks for erasure | Sector retention rules, then the Act | Section 8(7) lets retention required by law override erasure; erase once the period ends |
| Marketing a new product to existing customers | The Act | Consent and notice govern a purpose the account itself does not need |
| Storing payment data in a foreign region | RBI storage direction | Section 16(2) keeps stricter transfer limits in force |
| Outsourcing a call centre | Both, stacked | RBI outsourcing rules plus a valid contract under section 8(2) |
| Tracing a defaulted loan | Exemption may apply | Section 17(1)(f) lifts most duties when ascertaining a defaulter's finances, subject to other disclosure law |
| Fraud investigation | Exemption may apply | Section 17(1)(c) covers prevention and investigation of offences; security duties still apply |
| A data breach at a vendor | Both, in parallel | Board and customer intimation under the Act, plus regulator and CERT-In reporting |
Even where section 17(1) applies, sub-sections (1) and (5) of section 8 still bind you: you stay responsible, and you still owe reasonable security safeguards.
05 · What to do
A sequence that respects both layers
Reuse the RBI compliance work; fill only the gaps the Act opens.
- Map every activity and tag the legal ground: consent, a legitimate use, or a legal duty.
- Attach the governing retention period and its source to each activity.
- Compare outsourcing agreements with what section 8(2) and your security duty need.
- Separate marketing and cross-sell consent from account-opening consent.
- Merge breach playbooks so one incident triggers every required notice.
- Record each conflict you find, the view taken and who approved it.
Sources: the Digital Personal Data Protection Act, 2023 (sections 8, 16, 17 and 38, and the illustrations to section 8); the CERT-In directions of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000. RBI master directions are named at a general level and should be read in their current form.
Questions from regulated lenders
Does RBI compliance mean we already meet the DPDP Act?
Partly. Security and outsourcing overlap; customer-facing duties do not.
RBI work covers a lot of the security and vendor ground. The Act adds duties owed to the customer: itemised notice, withdrawable consent, access and correction, grievance handling and breach intimation to each affected person.
Can a customer force us to delete KYC records?
Not while a law requires you to keep them.
Section 8(7) lets retention required by law prevail over erasure. The Act's own illustration uses a bank keeping identity records after an account closes. Once the legal period ends, the erasure duty returns.
Do fintech partners of a bank have their own DPDP duties?
Usually yes, for whatever they decide themselves.
A partner that only processes for the bank is a processor. One that also uses the data for its own products is a fiduciary for that use. Many partnerships contain both, and the contract should say which is which.
Who do we notify after a breach?
Possibly several bodies, each on its own timeline.
The Act requires intimation to the Board and each affected person. CERT-In's 2022 directions require reporting listed incidents within six hours of noticing them. RBI has its own incident reporting expectations. Plan for all three in one playbook.
Fit the Act into the controls you already run.
A DPDP readiness assessment for a regulated entity starts from your RBI evidence and lists only the real gaps. Counsel should confirm how the law applies to your contracts and licences.