{"id":2179,"date":"2026-10-09T06:45:09","date_gmt":"2026-10-09T05:45:09","guid":{"rendered":"https:\/\/www.befisc.com\/fintechsherlock\/?p=2179"},"modified":"2026-10-09T06:45:10","modified_gmt":"2026-10-09T05:45:10","slug":"dpdp-act-for-fintechs","status":"publish","type":"post","link":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/","title":{"rendered":"DPDP Act for Fintechs: Data Fiduciary Duties in KYC, Onboarding and Lending"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Financial services run on personal data. A single loan application can involve identity documents, bank transactions, credit history, device data, and employer details, often passing through several vendors before a decision is made.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Digital Personal Data Protection Act,<a href=\"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/\"> 2023 (DPDP Act)<\/a> sets the rules for how that data may be collected, used, shared, protected and deleted. With the DPDP Rules, 2025 notified in November 2025, the clock is running: the core obligations apply from May 2027.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide explains the framework in terms that matter to fintechs, banks and NBFCs: who is a data fiduciary, when KYC needs consent, what changes in onboarding and vendor management, and how to prepare before the deadline.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What DPDP Means and the Key Roles<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DPDP stands for <strong>Digital Personal Data Protection<\/strong>. The Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Role<\/th><th>Meaning<\/th><th>Fintech example<\/th><\/tr><\/thead><tbody><tr><td>Data principal<\/td><td>The individual the data relates to<\/td><td>Borrower, account holder, investor<\/td><\/tr><tr><td>Data fiduciary<\/td><td>Decides the purpose and means of processing<\/td><td>Lender, bank, payments company<\/td><\/tr><tr><td>Data processor<\/td><td>Processes data on the fiduciary&#8217;s behalf<\/td><td>KYC vendor, cloud provider, collections agency<\/td><\/tr><tr><td>Consent manager<\/td><td>Registered entity that lets principals give, manage, and withdraw consent<\/td><td>A consent platform registered with the Data Protection Board<\/td><\/tr><tr><td>Significant data fiduciary (SDF)<\/td><td>Fiduciary notified for higher obligations based on volume, sensitivity and risk<\/td><td>Large banks or platforms, if notified<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The fiduciary is accountable for what its processors do. Outsourcing KYC or analytics does not outsource responsibility.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Implementation Timeline<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The DPDP Rules, 2025 were notified in November 2025 with an 18-month phased rollout.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Phase<\/th><th>Date<\/th><th>What applies<\/th><\/tr><\/thead><tbody><tr><td>Immediate<\/td><td>November 2025<\/td><td>Rules on the Data Protection Board and its functioning<\/td><\/tr><tr><td>12 months<\/td><td>November 2026<\/td><td>Consent manager registration and obligations<\/td><\/tr><tr><td>18 months<\/td><td>May 2027<\/td><td>Core fiduciary obligations: notice, consent, security, breach notification, rights, retention and SDF duties<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A proposal to shorten the timeline has been discussed but, as of September 2026, not notified. Firms should plan against the May 2027 date and monitor for changes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Consent vs Legitimate Use in Financial Services<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Act allows processing on two bases: the data principal&#8217;s consent, or specified <strong>legitimate uses<\/strong> that do not need consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For financial services, the key legitimate use is processing needed to comply with a law or a judgment. Customer due diligence required under PMLA and <a href=\"https:\/\/www.befisc.com\/fintechsherlock\/rbi-kyc-master-directions-guide\/\">RBI&#8217;s KYC Directions<\/a> falls here. That means a regulated lender does not need DPDP consent to perform mandatory KYC, though it still must process the data only for that purpose, protect it, and meet other duties.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consent remains the basis for much of what fintechs do beyond statutory requirements:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Marketing and cross-selling<\/li>\n\n\n\n<li>Using data for purposes other than the one it was collected for<\/li>\n\n\n\n<li>Alternative-data credit models using device or behavioural data<\/li>\n\n\n\n<li>Sharing data with partners that is not required by law<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Valid consent under the Act must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data necessary for the stated purpose. It must be as easy to withdraw as to give.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Core Duties of a Data Fiduciary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Notice:<\/strong> Tell principals, in clear and plain language, what data is collected, for what purpose, and how to exercise their rights.<\/li>\n\n\n\n<li><strong>Purpose limitation and minimisation:<\/strong> Collect only what the purpose needs and use it only for that purpose.<\/li>\n\n\n\n<li><strong>Accuracy:<\/strong> Keep data complete and accurate where it is used for decisions, such as credit.<\/li>\n\n\n\n<li><strong>Security safeguards:<\/strong> Apply reasonable security measures, including encryption, access control, logging and monitoring, across the fiduciary and its processors.<\/li>\n\n\n\n<li><strong>Breach notification:<\/strong> Inform affected principals and the Data Protection Board of a personal data breach, with a detailed report to the Board within the prescribed time (72 hours under the Rules).<\/li>\n\n\n\n<li><strong>Retention and erasure:<\/strong> Delete data when the purpose is served and no law requires retention, and keep processing logs for at least one year as the Rules prescribe.<\/li>\n\n\n\n<li><strong>Rights and grievances:<\/strong> Enable access, correction, erasure, and nomination requests, and resolve grievances within prescribed timelines.<\/li>\n\n\n\n<li><strong>Children&#8217;s data:<\/strong> Obtain verifiable parental consent for users under 18 and avoid tracking or targeted advertising directed at children.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Significant data fiduciaries also need a Data Protection Officer based in India, periodic data protection impact assessments, and independent audits.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Where DPDP Meets RBI, PMLA and Sector Rules<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DPDP does not override sector-specific requirements that impose stricter or specific duties. In practice:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Retention:<\/strong> PMLA and RBI rules require KYC and transaction records to be kept for prescribed periods, generally five years. That retention continues; DPDP governs how the data is protected and when it must be deleted after that period.<\/li>\n\n\n\n<li><strong>Aadhaar:<\/strong> The <a href=\"https:\/\/www.befisc.com\/fintechsherlock\/best-kyc-api-providers-india-2026\/\">Aadhaar Act<\/a> and UIDAI regulations continue to govern Aadhaar handling, including masking and data vault requirements.<\/li>\n\n\n\n<li><strong>Account Aggregator:<\/strong> AA&#8217;s consent architecture already reflects DPDP principles, which makes AA-sourced data easier to align.<\/li>\n\n\n\n<li><strong>Digital lending:<\/strong> <a href=\"https:\/\/blogs.fineye.co\/rbi-master-directions-nbfc\/\">RBI&#8217;s digital lending<\/a> rules on data collection, storage in India, and explicit borrower consent continue to apply alongside DPDP.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The practical answer is a single data inventory that records, for each data element, the legal basis, the retention rule, and the controlling regulation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Vendors, Processors and Verification APIs<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most fintechs share personal data with verification, analytics, and collections vendors. Under DPDP, each needs:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A valid contract that limits processing to the fiduciary&#8217;s instructions and purpose<\/li>\n\n\n\n<li>Security obligations and breach reporting to the fiduciary<\/li>\n\n\n\n<li>Deletion or return of data at the end of processing<\/li>\n\n\n\n<li>Evidence the fiduciary can use in audits<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.befisc.com\/fintechsherlock\/aadhaar-verification-api\/\">Verification APIs <\/a>that return only the result needed (for example, &#8220;PAN valid, name match 94%&#8221;) rather than full records help with minimisation by design.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Penalties<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Act sets penalties per instance, imposed by the Data Protection Board after inquiry:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Up to \u20b9250 crore for failing to take reasonable security safeguards to prevent a breach<\/li>\n\n\n\n<li>Up to \u20b9200 crore for failing to notify a breach, or failing children&#8217;s data obligations<\/li>\n\n\n\n<li>Up to \u20b9150 crore for failing additional SDF obligations<\/li>\n\n\n\n<li>Up to \u20b950 crore for other breaches of the Act or Rules<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For regulated financial entities, a DPDP breach will rarely stay a DPDP matter. It is likely to draw attention from sector regulators too.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A Practical Readiness Plan<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Map data:<\/strong> Build an inventory of personal data by journey (onboarding, underwriting, servicing, collections, marketing), system, and vendor.<\/li>\n\n\n\n<li><strong>Assign legal bases:<\/strong> Tag each processing activity as legal obligation, consent, or other legitimate use.<\/li>\n\n\n\n<li><strong>Fix notices and consents:<\/strong> Rewrite notices in plain language, separate mandatory from optional consents, and build withdrawal.<\/li>\n\n\n\n<li><strong>Set retention rules:<\/strong> Map each data type to its retention period and automate deletion.<\/li>\n\n\n\n<li><strong>Review vendors:<\/strong> Update contracts, test security, and confirm deletion.<\/li>\n\n\n\n<li><strong>Prepare breach response:<\/strong> Define detection, escalation, and the 72-hour reporting workflow.<\/li>\n\n\n\n<li><strong>Enable rights:<\/strong> Build channels for access, correction, erasure, and grievances with tracked timelines.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Use Cases<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Digital lender:<\/strong> Separates mandatory KYC processing (legal obligation) from optional marketing consent, cutting blanket consent screens and improving completion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Payments company:<\/strong> Automates deletion of merchant onboarding documents after the regulatory retention period ends, with logs kept for audit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Wealth platform:<\/strong> Uses <a href=\"https:\/\/www.befisc.com\/fintechsherlock\/pan-aadhaar-link-status\/\">AA-based<\/a> consented data for portfolio aggregation and displays consent status and withdrawal in the app.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DPDP means Digital Personal Data Protection; the Act dates from 2023 and its Rules were notified in November 2025.<\/li>\n\n\n\n<li>Core fiduciary obligations apply from May 2027; consent manager rules from November 2026.<\/li>\n\n\n\n<li>Mandatory KYC can rely on the legal-obligation basis; marketing and non-mandatory uses need consent.<\/li>\n\n\n\n<li>Fiduciaries remain accountable for processors, including verification and analytics vendors.<\/li>\n\n\n\n<li>Sector retention rules such as PMLA continue; DPDP governs protection and deletion around them.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Frequently Asked Questions<\/strong><\/h2>\n\n\n\n<div class=\"wp-block-gutena-accordion gutena-accordion-block gutena-accordion-block-c7d894-5b is-layout-flow wp-block-gutena-accordion-is-layout-flow\" data-single=\"true\">\n<div class=\"wp-block-gutena-accordion-panel gutena-accordion-block__panel\">\n<div class=\"wp-block-gutena-accordion-panel-title gutena-accordion-block__panel-title\"><div class=\"gutena-accordion-block__panel-title-inner\">\n<h6 class=\"wp-block-heading\" style=\"margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px\"><strong>What is the maximum DPDP penalty?<\/strong><\/h6>\n<div class=\"trigger-up-down\"><div class=\"horizontal\"><\/div><div class=\"vertical\"><\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion-panel-content gutena-accordion-block__panel-content\"><div class=\"gutena-accordion-block__panel-content-inner\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0;margin-bottom:0\"> Up to \u20b9250 crore per instance for failing to take reasonable security safeguards.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion gutena-accordion-block gutena-accordion-block-5b807a-2f is-layout-flow wp-block-gutena-accordion-is-layout-flow\" data-single=\"true\">\n<div class=\"wp-block-gutena-accordion-panel gutena-accordion-block__panel\">\n<div class=\"wp-block-gutena-accordion-panel-title gutena-accordion-block__panel-title\"><div class=\"gutena-accordion-block__panel-title-inner\">\n<h6 class=\"wp-block-heading\" style=\"margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px\"><strong>When do DPDP obligations take effect?<\/strong><\/h6>\n<div class=\"trigger-up-down\"><div class=\"horizontal\"><\/div><div class=\"vertical\"><\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion-panel-content gutena-accordion-block__panel-content\"><div class=\"gutena-accordion-block__panel-content-inner\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0;margin-bottom:0\"> The Rules were notified in November 2025. Consent manager provisions apply after 12 months and the core fiduciary obligations after 18 months, in May 2027.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion gutena-accordion-block gutena-accordion-block-696bce-a8 is-layout-flow wp-block-gutena-accordion-is-layout-flow\" data-single=\"true\">\n<div class=\"wp-block-gutena-accordion-panel gutena-accordion-block__panel\">\n<div class=\"wp-block-gutena-accordion-panel-title gutena-accordion-block__panel-title\"><div class=\"gutena-accordion-block__panel-title-inner\">\n<h6 class=\"wp-block-heading\" style=\"margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px\"><strong>Do lenders need consent for KYC under DPDP?<\/strong><\/h6>\n<div class=\"trigger-up-down\"><div class=\"horizontal\"><\/div><div class=\"vertical\"><\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion-panel-content gutena-accordion-block__panel-content\"><div class=\"gutena-accordion-block__panel-content-inner\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0;margin-bottom:0\">Mandatory KYC under PMLA and RBI rules can be processed as a legal obligation, without DPDP consent. Uses beyond that generally need consent.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion gutena-accordion-block gutena-accordion-block-51509c-4d is-layout-flow wp-block-gutena-accordion-is-layout-flow\" data-single=\"true\">\n<div class=\"wp-block-gutena-accordion-panel gutena-accordion-block__panel\">\n<div class=\"wp-block-gutena-accordion-panel-title gutena-accordion-block__panel-title\"><div class=\"gutena-accordion-block__panel-title-inner\">\n<h6 class=\"wp-block-heading\" style=\"margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px\"><strong>What is a data fiduciary?<\/strong><\/h6>\n<div class=\"trigger-up-down\"><div class=\"horizontal\"><\/div><div class=\"vertical\"><\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion-panel-content gutena-accordion-block__panel-content\"><div class=\"gutena-accordion-block__panel-content-inner\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0;margin-bottom:0\">Any person or entity that decides the purpose and means of processing personal data, such as a bank, lender, or fintech app.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion gutena-accordion-block gutena-accordion-block-1c1a67-63 is-layout-flow wp-block-gutena-accordion-is-layout-flow\" data-single=\"true\">\n<div class=\"wp-block-gutena-accordion-panel gutena-accordion-block__panel\">\n<div class=\"wp-block-gutena-accordion-panel-title gutena-accordion-block__panel-title\"><div class=\"gutena-accordion-block__panel-title-inner\">\n<h6 class=\"wp-block-heading\" style=\"margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px\"><strong>What is the full form of DPDP?<\/strong><\/h6>\n<div class=\"trigger-up-down\"><div class=\"horizontal\"><\/div><div class=\"vertical\"><\/div><\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-gutena-accordion-panel-content gutena-accordion-block__panel-content\"><div class=\"gutena-accordion-block__panel-content-inner\">\n<p class=\"wp-block-paragraph\" style=\"margin-top:0;margin-bottom:0\">Digital Personal Data Protection, as in the Digital Personal Data Protection Act, 2023.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DPDP turns privacy from a policy document into an operating discipline. For fintechs, the largest changes are practical: separating legal-obligation processing from consent-based uses, minimising what is collected and shared, controlling <a href=\"https:\/\/www.befisc.com\/fintechsherlock\/pmla-reporting\/\">PMLAndors<\/a>, and deleting data on time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Firms that start now can use the remaining months to redesign journeys once, rather than patching them under deadline pressure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">BeFiSc&#8217;s verification APIs are designed to return the minimum data needed for each decision, which supports purpose limitation across onboarding and underwriting. <a href=\"https:\/\/www.befisc.com\/\">Talk to the BeFiSc team <\/a>about privacy-conscious verification flows.<\/p>\n","protected":false},"excerpt":{"rendered":"Financial services run on personal data. A single loan application can involve identity documents, bank transactions, credit history,&hellip;","protected":false},"author":8,"featured_media":2180,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[548],"tags":[655,654,239,448],"class_list":["post-2179","post","type-post","status-publish","format-standard","has-post-thumbnail","category-regulatory-compliance","tag-data-privacy","tag-dpdp-act","tag-fintech-compliance","tag-kyc-compliance","cs-entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>DPDP Act for Fintechs: Compliance Guide for India<\/title>\n<meta name=\"description\" content=\"DPDP Act for Fintechs: Learn compliance deadlines, KYC consent rules, data retention, vendor duties and penalties up to \u20b9250 crore.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DPDP Act for Fintechs: Compliance Guide for India\" \/>\n<meta property=\"og:description\" content=\"DPDP Act for Fintechs: Learn compliance deadlines, KYC consent rules, data retention, vendor duties and penalties up to \u20b9250 crore.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/\" \/>\n<meta property=\"og:site_name\" content=\"BeFiSc\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-09T05:45:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-09T05:45:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/10\/DPDP-Act-for-Fintechs-Data-Fiduciary-Duties-in-KYC-Onboarding-and-Lending.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"864\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Chailsee Yadav\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Chailsee Yadav\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DPDP Act for Fintechs: Compliance Guide for India","description":"DPDP Act for Fintechs: Learn compliance deadlines, KYC consent rules, data retention, vendor duties and penalties up to \u20b9250 crore.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/","og_locale":"en_GB","og_type":"article","og_title":"DPDP Act for Fintechs: Compliance Guide for India","og_description":"DPDP Act for Fintechs: Learn compliance deadlines, KYC consent rules, data retention, vendor duties and penalties up to \u20b9250 crore.","og_url":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/","og_site_name":"BeFiSc","article_published_time":"2026-10-09T05:45:09+00:00","article_modified_time":"2026-10-09T05:45:10+00:00","og_image":[{"width":1536,"height":864,"url":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/10\/DPDP-Act-for-Fintechs-Data-Fiduciary-Duties-in-KYC-Onboarding-and-Lending.png","type":"image\/png"}],"author":"Chailsee Yadav","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Chailsee Yadav","Estimated reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/#article","isPartOf":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/"},"author":{"name":"Chailsee Yadav","@id":"https:\/\/www.befisc.com\/fintechsherlock\/#\/schema\/person\/6b4fa6213a7742947b3a7717dcd5615e"},"headline":"DPDP Act for Fintechs: Data Fiduciary Duties in KYC, Onboarding and Lending","datePublished":"2026-10-09T05:45:09+00:00","dateModified":"2026-10-09T05:45:10+00:00","mainEntityOfPage":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/"},"wordCount":1457,"commentCount":0,"publisher":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/#organization"},"image":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/#primaryimage"},"thumbnailUrl":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/10\/DPDP-Act-for-Fintechs-Data-Fiduciary-Duties-in-KYC-Onboarding-and-Lending.png","keywords":["Data Privacy","DPDP Act","Fintech Compliance","KYC Compliance"],"articleSection":["Regulatory &amp; Compliance"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/","url":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/","name":"DPDP Act for Fintechs: Compliance Guide for India","isPartOf":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/#primaryimage"},"image":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/#primaryimage"},"thumbnailUrl":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/10\/DPDP-Act-for-Fintechs-Data-Fiduciary-Duties-in-KYC-Onboarding-and-Lending.png","datePublished":"2026-10-09T05:45:09+00:00","dateModified":"2026-10-09T05:45:10+00:00","description":"DPDP Act for Fintechs: Learn compliance deadlines, KYC consent rules, data retention, vendor duties and penalties up to \u20b9250 crore.","breadcrumb":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/#primaryimage","url":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/10\/DPDP-Act-for-Fintechs-Data-Fiduciary-Duties-in-KYC-Onboarding-and-Lending.png","contentUrl":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/10\/DPDP-Act-for-Fintechs-Data-Fiduciary-Duties-in-KYC-Onboarding-and-Lending.png","width":1536,"height":864},{"@type":"BreadcrumbList","@id":"https:\/\/www.befisc.com\/fintechsherlock\/dpdp-act-for-fintechs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.befisc.com\/fintechsherlock\/"},{"@type":"ListItem","position":2,"name":"DPDP Act for Fintechs"}]},{"@type":"WebSite","@id":"https:\/\/www.befisc.com\/fintechsherlock\/#website","url":"https:\/\/www.befisc.com\/fintechsherlock\/","name":"BeFiSc","description":"Identity, Fraud &amp; Compliance Insights","publisher":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.befisc.com\/fintechsherlock\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.befisc.com\/fintechsherlock\/#organization","name":"BeFiSc","url":"https:\/\/www.befisc.com\/fintechsherlock\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.befisc.com\/fintechsherlock\/#\/schema\/logo\/image\/","url":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2025\/06\/befiscsymbol.png","contentUrl":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2025\/06\/befiscsymbol.png","width":508,"height":120,"caption":"BeFiSc"},"image":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.befisc.com\/fintechsherlock\/#\/schema\/person\/6b4fa6213a7742947b3a7717dcd5615e","name":"Chailsee Yadav","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/1bd43e74edffa6494c6b2aa707e92cd52e04c1319d36fb8b57e2945bb6ca2a2c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1bd43e74edffa6494c6b2aa707e92cd52e04c1319d36fb8b57e2945bb6ca2a2c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1bd43e74edffa6494c6b2aa707e92cd52e04c1319d36fb8b57e2945bb6ca2a2c?s=96&d=mm&r=g","caption":"Chailsee Yadav"}}]}},"_links":{"self":[{"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/posts\/2179","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/comments?post=2179"}],"version-history":[{"count":1,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/posts\/2179\/revisions"}],"predecessor-version":[{"id":2181,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/posts\/2179\/revisions\/2181"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/media\/2180"}],"wp:attachment":[{"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/media?parent=2179"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/categories?post=2179"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/tags?post=2179"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}