Financial services run on personal data. A single loan application can involve identity documents, bank transactions, credit history, device data, and employer details, often passing through several vendors before a decision is made.
The Digital Personal Data Protection Act, 2023 (DPDP Act) sets the rules for how that data may be collected, used, shared, protected and deleted. With the DPDP Rules, 2025 notified in November 2025, the clock is running: the core obligations apply from May 2027.
This guide explains the framework in terms that matter to fintechs, banks and NBFCs: who is a data fiduciary, when KYC needs consent, what changes in onboarding and vendor management, and how to prepare before the deadline.
What DPDP Means and the Key Roles
DPDP stands for Digital Personal Data Protection. The Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India.
| Role | Meaning | Fintech example |
|---|---|---|
| Data principal | The individual the data relates to | Borrower, account holder, investor |
| Data fiduciary | Decides the purpose and means of processing | Lender, bank, payments company |
| Data processor | Processes data on the fiduciary’s behalf | KYC vendor, cloud provider, collections agency |
| Consent manager | Registered entity that lets principals give, manage, and withdraw consent | A consent platform registered with the Data Protection Board |
| Significant data fiduciary (SDF) | Fiduciary notified for higher obligations based on volume, sensitivity and risk | Large banks or platforms, if notified |
The fiduciary is accountable for what its processors do. Outsourcing KYC or analytics does not outsource responsibility.
Implementation Timeline
The DPDP Rules, 2025 were notified in November 2025 with an 18-month phased rollout.
| Phase | Date | What applies |
|---|---|---|
| Immediate | November 2025 | Rules on the Data Protection Board and its functioning |
| 12 months | November 2026 | Consent manager registration and obligations |
| 18 months | May 2027 | Core fiduciary obligations: notice, consent, security, breach notification, rights, retention and SDF duties |
A proposal to shorten the timeline has been discussed but, as of September 2026, not notified. Firms should plan against the May 2027 date and monitor for changes.
Consent vs Legitimate Use in Financial Services
The Act allows processing on two bases: the data principal’s consent, or specified legitimate uses that do not need consent.
For financial services, the key legitimate use is processing needed to comply with a law or a judgment. Customer due diligence required under PMLA and RBI’s KYC Directions falls here. That means a regulated lender does not need DPDP consent to perform mandatory KYC, though it still must process the data only for that purpose, protect it, and meet other duties.
Consent remains the basis for much of what fintechs do beyond statutory requirements:
- Marketing and cross-selling
- Using data for purposes other than the one it was collected for
- Alternative-data credit models using device or behavioural data
- Sharing data with partners that is not required by law
Valid consent under the Act must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data necessary for the stated purpose. It must be as easy to withdraw as to give.
Core Duties of a Data Fiduciary
- Notice: Tell principals, in clear and plain language, what data is collected, for what purpose, and how to exercise their rights.
- Purpose limitation and minimisation: Collect only what the purpose needs and use it only for that purpose.
- Accuracy: Keep data complete and accurate where it is used for decisions, such as credit.
- Security safeguards: Apply reasonable security measures, including encryption, access control, logging and monitoring, across the fiduciary and its processors.
- Breach notification: Inform affected principals and the Data Protection Board of a personal data breach, with a detailed report to the Board within the prescribed time (72 hours under the Rules).
- Retention and erasure: Delete data when the purpose is served and no law requires retention, and keep processing logs for at least one year as the Rules prescribe.
- Rights and grievances: Enable access, correction, erasure, and nomination requests, and resolve grievances within prescribed timelines.
- Children’s data: Obtain verifiable parental consent for users under 18 and avoid tracking or targeted advertising directed at children.
Significant data fiduciaries also need a Data Protection Officer based in India, periodic data protection impact assessments, and independent audits.
Where DPDP Meets RBI, PMLA and Sector Rules
DPDP does not override sector-specific requirements that impose stricter or specific duties. In practice:
- Retention: PMLA and RBI rules require KYC and transaction records to be kept for prescribed periods, generally five years. That retention continues; DPDP governs how the data is protected and when it must be deleted after that period.
- Aadhaar: The Aadhaar Act and UIDAI regulations continue to govern Aadhaar handling, including masking and data vault requirements.
- Account Aggregator: AA’s consent architecture already reflects DPDP principles, which makes AA-sourced data easier to align.
- Digital lending: RBI’s digital lending rules on data collection, storage in India, and explicit borrower consent continue to apply alongside DPDP.
The practical answer is a single data inventory that records, for each data element, the legal basis, the retention rule, and the controlling regulation.
Vendors, Processors and Verification APIs
Most fintechs share personal data with verification, analytics, and collections vendors. Under DPDP, each needs:
- A valid contract that limits processing to the fiduciary’s instructions and purpose
- Security obligations and breach reporting to the fiduciary
- Deletion or return of data at the end of processing
- Evidence the fiduciary can use in audits
Verification APIs that return only the result needed (for example, “PAN valid, name match 94%”) rather than full records help with minimisation by design.
Penalties
The Act sets penalties per instance, imposed by the Data Protection Board after inquiry:
- Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach
- Up to ₹200 crore for failing to notify a breach, or failing children’s data obligations
- Up to ₹150 crore for failing additional SDF obligations
- Up to ₹50 crore for other breaches of the Act or Rules
For regulated financial entities, a DPDP breach will rarely stay a DPDP matter. It is likely to draw attention from sector regulators too.
A Practical Readiness Plan
- Map data: Build an inventory of personal data by journey (onboarding, underwriting, servicing, collections, marketing), system, and vendor.
- Assign legal bases: Tag each processing activity as legal obligation, consent, or other legitimate use.
- Fix notices and consents: Rewrite notices in plain language, separate mandatory from optional consents, and build withdrawal.
- Set retention rules: Map each data type to its retention period and automate deletion.
- Review vendors: Update contracts, test security, and confirm deletion.
- Prepare breach response: Define detection, escalation, and the 72-hour reporting workflow.
- Enable rights: Build channels for access, correction, erasure, and grievances with tracked timelines.
Use Cases
Digital lender: Separates mandatory KYC processing (legal obligation) from optional marketing consent, cutting blanket consent screens and improving completion.
Payments company: Automates deletion of merchant onboarding documents after the regulatory retention period ends, with logs kept for audit.
Wealth platform: Uses AA-based consented data for portfolio aggregation and displays consent status and withdrawal in the app.
Key Takeaways
- DPDP means Digital Personal Data Protection; the Act dates from 2023 and its Rules were notified in November 2025.
- Core fiduciary obligations apply from May 2027; consent manager rules from November 2026.
- Mandatory KYC can rely on the legal-obligation basis; marketing and non-mandatory uses need consent.
- Fiduciaries remain accountable for processors, including verification and analytics vendors.
- Sector retention rules such as PMLA continue; DPDP governs protection and deletion around them.
Frequently Asked Questions
What is the maximum DPDP penalty?
Up to ₹250 crore per instance for failing to take reasonable security safeguards.
When do DPDP obligations take effect?
The Rules were notified in November 2025. Consent manager provisions apply after 12 months and the core fiduciary obligations after 18 months, in May 2027.
Do lenders need consent for KYC under DPDP?
Mandatory KYC under PMLA and RBI rules can be processed as a legal obligation, without DPDP consent. Uses beyond that generally need consent.
What is a data fiduciary?
Any person or entity that decides the purpose and means of processing personal data, such as a bank, lender, or fintech app.
What is the full form of DPDP?
Digital Personal Data Protection, as in the Digital Personal Data Protection Act, 2023.
Conclusion
DPDP turns privacy from a policy document into an operating discipline. For fintechs, the largest changes are practical: separating legal-obligation processing from consent-based uses, minimising what is collected and shared, controlling PMLAndors, and deleting data on time.
Firms that start now can use the remaining months to redesign journeys once, rather than patching them under deadline pressure.
BeFiSc’s verification APIs are designed to return the minimum data needed for each decision, which supports purpose limitation across onboarding and underwriting. Talk to the BeFiSc team about privacy-conscious verification flows.
