# DPDP Act for fintech, NBFCs and banks: one more layer on top of RBI Source: https://dpdp.d2c.in/guides/dpdp-for-fintech/ · Updated 2026-11-13 · DPDP Ready by Mirav Labs **Short answer:** The DPDP Act applies to banks, NBFCs, lending apps and payment companies in addition to RBI and other sectoral rules (section 38(1)), and stricter laws on transfers outside India continue to apply (section 16(2)). Data that a law requires you to keep, such as KYC records, stays outside the erasure duty in section 8(7). Section 17(1)(f) exempts, from most duties, processing to ascertain a loan defaulter's financial information, assets and liabilities. Core duties apply from 13 May 2027. ## Key takeaways - DPDP adds a horizontal layer; stricter RBI and other sectoral rules keep applying. - Keep KYC and other records the law requires, but use them only for that purpose (section 8(7)). - Section 17(1)(f) covers ascertaining a defaulter's financial information, assets and liabilities, not harvesting third-party contacts. - Data used for credit decisions or shared with bureaus must be complete, accurate and consistent (section 8(3)). - Run DPDP breach intimation, CERT-In's 6-hour reporting and your regulator's reporting as one process. Financial services already run under some of India's most detailed data rules. RBI, SEBI and other regulators set requirements on KYC, outsourcing, cyber security, data storage and customer conduct. The DPDP Act does not replace any of that. It adds a general privacy layer that applies to every Data Fiduciary, with its own notice, consent, rights, retention and breach duties, and its own regulator: the Data Protection Board. For a bank, NBFC, lending app, broker or payment company, the work is mostly about joining the two layers: where they agree, where DPDP adds something new, and where a sectoral rule asks for more. ## How does the DPDP Act sit alongside RBI and other sectoral rules? The Act applies to all digital personal data processed in India, and to processing abroad connected with offering goods or services to people in India (section 3). There is no carve-out for regulated entities. Three provisions do most of the work of fitting it alongside sectoral law: - **Section 16(2):** any law that gives a higher degree of protection or a stricter restriction on transferring personal data outside India continues to apply. - **Section 8(7):** the duty to erase does not apply where retention is necessary to comply with a law. - **Section 7:** legitimate uses include complying with a legal obligation to disclose information to the State, and complying with a judgment, decree or order. | Topic | DPDP Act and Rules | Sectoral layer (general) | In practice | |---|---|---|---| | Data location | Transfers allowed unless a country is notified (s.16); none notified | RBI requires payment system data to be stored in India | Follow the sectoral rule; it is stricter | | Retention | Erase when purpose ends, unless law requires retention (s.8(7)); one-year minimum (Rule 8(3)) | KYC, anti-money laundering and record-keeping rules require longer retention | Keep what the law requires, restrict its use, erase the rest | | Security | Reasonable safeguards (s.8(5)); Rule 6 minimum measures | Regulators' cyber security and IT governance requirements | Map one control set to both | | Outsourcing | Processors only under a valid contract (s.8(2)); fiduciary stays responsible (s.8(1)) | Outsourcing and digital lending rules on service providers | One vendor contract template that covers both | | Breach reporting | Board and affected people without delay; detailed report in 72 hours (Rule 7) | CERT-In's 6-hour direction; regulator's own incident reporting | One incident process, several clocks | | Customer rights | Access, correction, erasure, grievance, nomination (s.11 to 14) | Grievance and ombudsman frameworks | Link the DPDP rights flow to existing grievance desks | Use this as a starting map, and have your compliance and legal teams confirm the exact sectoral requirements that apply to your licence. ## How should you handle KYC data and retention required by law? KYC is the clearest case of a law requiring you to collect and keep personal data. The DPDP Act does not stop you, but it changes how you hold it. - **Notice still applies.** Tell customers, in your itemised notice under Rule 3, what KYC data you collect and why. See the [privacy notice guide](https://dpdp.d2c.in/guides/dpdp-privacy-notice/). - **Separate legal retention from business use.** When an account closes or consent is withdrawn, the KYC record that law requires you to keep stays, but it should move to restricted storage and stop feeding marketing, cross-sell or model training. - **Erase the rest.** Marketing preferences, app analytics and enrichment data have no legal retention reason once the purpose ends. - **Record the legal source** for each retained category in your [retention schedule](https://dpdp.d2c.in/guides/dpdp-data-retention/), so an erasure request gets a specific answer. Rule 8(3) also requires every fiduciary to keep personal data, traffic data and processing logs for at least one year from processing. For most financial records, sectoral retention periods are longer, so the sectoral period governs. ## What does the loan-defaulter exemption cover? Section 17(1)(f) exempts processing for the purpose of ascertaining the financial information, assets and liabilities of a person who has defaulted on a loan or advance taken from a financial institution, provided the processing follows the disclosure provisions in other laws. For that processing, most of Chapter II (notice, consent, retention), Chapter III (the rights of Data Principals) and section 16 do not apply. Two things still apply in full: section 8(1), which keeps you responsible for your processors, and section 8(5), the duty to keep reasonable security safeguards. A separate exemption, section 17(1)(a), covers processing necessary to enforce a legal right or claim. Read it narrowlyThe exemption is about the defaulter's own financial position. On a plain reading, it does not cover processing before default, marketing to the borrower, or contacting the borrower's family, friends or employer. Collections teams and agencies should be briefed on exactly where the exemption stops. ## Consent managers or Account Aggregators: what is the difference? DPDP consent manager - Registered with the Data Protection Board (Rule 4, from 13 November 2026) - Indian company with net worth of at least ₹2 crore - Lets a person give, manage, review and withdraw consent across fiduciaries - Cannot read the personal data it helps share - None registered yet Account Aggregator - Part of RBI's consent-based framework for sharing financial information - Financial information is shared only with the customer's consent - Governed by RBI's rules for the framework - Relationship to DPDP consent managers not yet set out officially If you already use the Account Aggregator framework, keep doing so; it is a consent-led route that fits the DPDP approach. What the DPDP Act adds is your own notice and consent duties as the fiduciary receiving the data, and the option, once consent managers are registered, for customers to manage consent through one. The [consent manager guide](https://dpdp.d2c.in/guides/dpdp-consent-manager/) covers Rule 4 in detail. ## How should lenders handle collections and credit data? ### Collections and contact data Collections is one of the areas where lending businesses face the most practical DPDP risk, because it touches people who never signed up with you. - **The borrower's own contacts:** collect what is needed to service the loan, under a clear notice. - **References and guarantors:** they are Data Principals in their own right. Tell them why you hold their details and how they can exercise their rights. - **Phone contact lists:** consent under section 6(1) must be limited to data necessary for the purpose. Collecting a borrower's entire address book is very hard to justify, and the people in it have consented to nothing. Sectoral rules may be stricter still. - **Recovery agencies:** they typically act as your processors. Section 8(1) keeps you responsible for what they do with the data, so contracts, access limits and call-recording retention all need attention. ### Credit decisions and section 8(3) accuracy Section 8(3) requires a fiduciary to ensure the completeness, accuracy and consistency of personal data where it is likely to be used to make a decision that affects the person, or disclosed to another fiduciary. Credit decisions and reporting to credit bureaus fit both limbs. In practice: - Keep data lineage for every input to a credit decision, including alternative data. - Validate data before it reaches the model or the bureau file, and fix errors at the source. - Route correction requests under section 12 into the same dispute process your bureau reporting uses, and push corrections to everyone you shared the data with. - Review rejected applications for data errors, not only for model performance. ## Will large fintechs be significant data fiduciaries? No Significant Data Fiduciary has been notified. The government will consider the volume and sensitivity of personal data, risk to the rights of Data Principals, and wider factors such as security of the State and public order. Large banks, lenders and payment companies process high volumes of financial data, which makes them plausible candidates. For a lender, Rule 13's due diligence on technical measures, “including algorithmic software”, could reach credit scoring and fraud models. Rule 13(4) could also require specified data to stay in India. If designation is plausible, start the DPIA and model documentation now; they are useful anyway. See the [significant data fiduciary guide](https://dpdp.d2c.in/guides/significant-data-fiduciary/). ## How should financial firms run breach response? A single incident can start several clocks. Under section 8(6) and Rule 7 you must inform the Board and every affected person without delay, and send the Board a detailed report within 72 hours of becoming aware. There is no materiality threshold. CERT-In's separate 6-hour direction (April 2022) continues to apply in parallel for reportable cyber incidents, and your regulator will have its own incident reporting expectations. Run these as one process with one incident lead, one fact base and a checklist of who gets told what and when. Failing to take reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to intimate a breach up to ₹200 crore. The [breach notification guide](https://dpdp.d2c.in/guides/dpdp-breach-notification/) sets out the content of each notice. ## What to do next - **Build the joint map:** for each data category, the DPDP duty, the sectoral rule, and which is stricter. - **Split retention:** legal retention in restricted storage, everything else on an erasure schedule. - **Write down the exemption boundaries** for collections under sections 17(1)(a) and 17(1)(f). - **Stop excess collection,** especially phone contacts and device data not needed for the loan. - **Strengthen accuracy and correction** for credit inputs and bureau reporting. - **Unify incident response** across the Board, CERT-In and your regulator, and drill it. Sequence these in your [implementation roadmap](https://dpdp.d2c.in/guides/dpdp-implementation-roadmap/) against 13 May 2027. We work alongside your compliance, legal and engineering teams to build this; see [our services](https://dpdp.d2c.in/#services). ## Frequently asked questions ### Does the DPDP Act apply to banks and NBFCs already regulated by RBI? Yes. The DPDP Act is a general law that applies to every Data Fiduciary, including regulated entities. Sectoral rules continue alongside it, and where a law gives stricter protection on transfers, section 16(2) keeps it in force. In practice you comply with both. ### Can a customer ask a bank or NBFC to delete their KYC data? They can ask, but section 8(7) does not require erasure where retention is necessary to comply with a law. KYC and transaction records that a law requires you to keep stay for that period. You should erase or restrict everything else, and tell the customer what you kept and why. ### What is the loan defaulter exemption in the DPDP Act? Section 17(1)(f) exempts processing to ascertain the financial information, assets and liabilities of a person who has defaulted on a loan or advance from a financial institution, as long as it follows the disclosure rules in other laws. Most consent, notice and rights provisions do not apply to that processing, but security and processor accountability under section 8(1) and 8(5) still do. ### Is an Account Aggregator the same as a DPDP consent manager? No. An Account Aggregator works under RBI's consent-based framework for sharing financial data. A consent manager under the DPDP Act is registered with the Data Protection Board under Rule 4, which applies from 13 November 2026. How the two frameworks will interact has not been set out officially. ### Can lending apps access a borrower's phone contacts under DPDP? The people in a phone's contact list are Data Principals with their own rights, and they have not consented. Consent under section 6(1) must be limited to data necessary for the purpose, which is hard to argue for a whole contact list. Your sectoral rules may also be stricter. Most lenders should not collect it. ### Will fintech companies be notified as significant data fiduciaries? No fiduciary has been notified yet. The government will consider factors such as the volume and sensitivity of data and risk to the rights of individuals, which makes large lenders, banks and payment companies plausible candidates. Designation adds a DPO in India, an independent auditor, a DPIA and audit every 12 months, and a penalty of up to ₹150 crore for breaching those obligations.