DPDP Act for Banks and NBFCs: A Compliance Guide

Who this is for: compliance heads, DPOs, CISOs and legal teams at banks, NBFCs, housing finance companies and other RBI-regulated lenders.

Few sectors hold more personal data, or more sensitive personal data, than banking. A single customer relationship can include identity documents, income, transaction history, credit behaviour, nominee details and, for digital lenders, device data. Banks are also already among the most heavily regulated data handlers in India, which creates a dangerous assumption: that RBI compliance already covers the DPDP Act.

It does not. RBI, PMLA and credit information rules govern what lenders must collect, keep and secure. The DPDP Act governs how they must explain it, how they obtain and record consent, what rights customers have, when data must be erased and how breaches are reported. The two regimes overlap, but they are not the same.

This guide explains where the DPDP Act changes things for lenders. For the general obligations, start with The DPDP Act, Explained. The obligations below take effect on 13 May 2027, as set out in the DPDP compliance timeline.

How the DPDP Act and RBI rules fit together

Section 38 of the DPDP Act says its provisions apply in addition to, and not in derogation of, other laws. Where there is a genuine conflict, the DPDP Act prevails to the extent of that conflict. In practice, real conflicts are rare, because the Act itself preserves what other laws require:

• Retention: Section 8(7) allows a fiduciary to keep personal data where retention is necessary for compliance with any law.
• Loan recovery: Section 17(1)(f) exempts processing to ascertain the financial information and assets of a person who has defaulted on a loan, from most of the Act's obligations.
• Offences: Section 17(1)(c) exempts processing for preventing, detecting or investigating offences, which covers much fraud and AML work.

The result is layered compliance. RBI tells you what you must do. The DPDP Act tells you how you must treat the individual while you do it.

KYC retention versus the erasure duty

This is the question every bank asks first. A customer closes their account and asks you to delete their data. Do you have to?

For records that a law requires you to keep, no. Section 8(7) preserves retention necessary for legal compliance, so KYC documents and transaction records required under the RBI KYC Master Direction and PMLA Rules can be kept for the mandated period. Two conditions apply:

1. Retention must be field-specific, not blanket. The legal obligation covers the records it names. Marketing preferences, app usage data, call recordings kept for convenience and lead data from unconverted applications are not KYC records. They must be erased when their purpose ends.
2. Retention must end. When the statutory period expires, the data must be erased. A retention policy that says "seven years, then review" without automated erasure will not hold up.

The practical answer is a retention schedule that tags each data category with its governing instrument, its trigger date (usually the end of the relationship) and its erasure action. Erasure requests then check that schedule: data under a legal hold is retained and the customer is told why, while everything else is erased.

Consent: where banks most often fall short

KYC data that customers provide to open an account can typically be processed under the "voluntarily provided for a specified purpose" legitimate use in Section 7(a), provided the customer has been told the purpose. But much of what banks do with customer data goes beyond that purpose, and needs valid consent under Section 6:

• Cross-selling insurance, mutual funds, credit cards or group-company products
• Marketing calls, SMS, WhatsApp and email campaigns
• Sharing with partners such as co-branded card partners, fintech collaborators and lead aggregators
• Analytics and profiling beyond what the account relationship requires

The DPDP standard is that consent must be free, specific, informed, unconditional and unambiguous. A single account-opening form with one signature covering "all products and services of the bank and its group companies" fails that standard. So does making a loan conditional on agreeing to marketing. Our guide to valid consent under DPDP explains each test in detail.

RBI's own conduct rules increasingly point the same way, discouraging bundled consent and dark patterns in customer journeys. Banks that redesign consent once, to the DPDP standard, will generally satisfy both.

Credit bureau reporting deserves separate treatment. Reporting to credit information companies is required under the Credit Information Companies (Regulation) Act, 2005. Make sure the notice clearly explains this sharing and the bureaus involved, and document the legal basis for it in your records, rather than folding it into a marketing consent.

Digital lending and app permissions

Digital lenders and their lending service providers already operate under RBI's digital lending rules, first issued in 2022 and since consolidated into Directions. These rules require need-based data collection with the borrower's explicit prior consent, restrict access to phone resources such as contacts, media and call logs, and require data to be stored in India.

The DPDP Act reinforces this and adds three things:

• Itemised notices for each data item collected through the app, presented separately from the loan terms (Rule 3)
• Purpose-limited retention, so device and location data collected for onboarding are erased once that purpose ends
• Withdrawal that works, so a borrower who revokes a permission or consent sees it honoured across the lender and its lending service providers

Vendors, LSPs and outsourcing

Banks rely on a long chain of service providers: core banking and cloud vendors, KYC and video-KYC providers, collection agencies, call centres, card processors and lending service providers. Under RBI outsourcing rules, the regulated entity remains responsible for them. The DPDP Act takes the same position: under Section 8(1), the fiduciary is responsible for processing done on its behalf, and under Section 8(2), processors may be engaged only under a valid contract.

Existing outsourcing agreements typically address service levels, confidentiality and audit rights. For DPDP, add:

• processing only on documented instructions and only for specified purposes
• the Rule 6 security safeguards, which Rule 6 itself requires to be written into the contract
• prompt breach notification to the bank, fast enough for the bank to meet its own Rule 7 duties
• support for access, correction and erasure requests
• deletion or return of data at the end of the engagement

Data localisation and cross-border transfers

Section 16 of the DPDP Act takes a negative-list approach: personal data may be transferred outside India unless the government restricts transfers to a specific country. But Section 16(2) preserves any law that provides a higher degree of protection or restriction on transfers. RBI's 2018 direction on storage of payment system data, which requires that data to be stored only in India, therefore continues to apply. So do the localisation expectations in the digital lending rules. For lenders, the DPDP Act loosens nothing.

Breach notification: three regulators, one incident

A cyber incident at a bank can trigger three reporting duties at once: to CERT-In within 6 hours for specified incidents, to RBI under its incident reporting requirements, and under the DPDP Act to every affected customer and the Data Protection Board, with a detailed report within 72 hours. The DPDP duties have no materiality threshold.

Run one incident process with a single timeline, and assign each regulatory notice to a named owner. Our Rule 7 breach notification playbook sets out the DPDP steps in detail.

Significant Data Fiduciary: plan for designation

Section 10 allows the government to designate Significant Data Fiduciaries based on the volume and sensitivity of the data they process, and the risks to individuals, the state and public order. The criteria have not yet been notified, but large banks and NBFCs process exactly the kind of data those factors describe. In early 2026, MeitY also consulted on giving SDFs a shorter compliance runway.

SDFs must appoint a Data Protection Officer based in India and reporting to the board, appoint an independent data auditor, and carry out a Data Protection Impact Assessment and audit every 12 months (Rule 13). Many banks already have a Chief Compliance Officer and CISO, but the DPO is a distinct role with its own accountability. Decide now whether you will appoint one, and how the role will relate to your existing functions.

Grievances and the Ombudsman

Banks already run grievance mechanisms and are subject to the RBI Integrated Ombudsman Scheme. The DPDP Act adds a separate, data-specific route: Section 13 requires a readily available grievance mechanism, Rule 14 caps the response time at 90 days, and individuals must use it before approaching the Data Protection Board. Integrate DPDP grievances into your existing complaints system, but tag and track them separately so you can evidence the DPDP timelines.

A 90-day starting plan for lenders

1. Weeks 1–3: Build a Record of Processing Activities for customer, employee and vendor data. Tag every data category with its lawful basis and its governing retention law.
2. Weeks 4–6: Redesign account-opening, loan and app journeys with itemised notices and unbundled consent for cross-selling, marketing and partner sharing.
3. Weeks 7–9: Implement the retention schedule, with automated erasure for data that no law requires you to keep.
4. Weeks 10–12: Re-paper vendor and LSP contracts, integrate DPDP breach notices into the incident process, and set up DPDP rights and grievance tracking.
5. Ongoing: Prepare for SDF designation, including the DPO role and annual DPIA.

For a general week-by-week version, see the DPDP compliance checklist and 90-day roadmap.

Common mistakes in banking

• Assuming RBI compliance is DPDP compliance. The overlap is mostly security. Notice, consent, rights and erasure are new.
• Using KYC retention as a reason to keep everything. The legal hold covers specific records, not the whole customer file.
• One consent for the whole group. Cross-selling across group companies needs specific, unbundled consent.
• Leaving LSPs out of scope. Processors' failures are your failures under Section 8(1).
• Ignoring existing customers. Section 5(2) requires notices for data held on consent given before the Act commenced.

How ConsentifyAI helps banks and NBFCs

ConsentifyAI gives lenders one system for the DPDP layer on top of RBI compliance. Its ROPA module maps each data category to its lawful basis and governing retention law. Consent is captured per purpose across branch, web and app journeys, with notices in the languages your customers use. Erasure requests automatically check legal holds before acting, and every decision is recorded in a tamper-evident audit trail you can show to the Data Protection Board or an RBI inspection team.