{"id":767,"date":"2026-06-01T02:49:45","date_gmt":"2026-06-01T01:49:45","guid":{"rendered":"https:\/\/www.befisc.com\/fintechsherlock\/?p=767"},"modified":"2026-06-01T02:49:46","modified_gmt":"2026-06-01T01:49:46","slug":"data-fiduciary-dpdp-act-fintech-compliance","status":"publish","type":"post","link":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/","title":{"rendered":"\u00a0Data Fiduciary Under DPDP Act: What It Means for Fintechs Handling User Data"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a new compliance framework for Indian businesses handling personal data. At the center of this framework is the concept of a \u201cdata fiduciary.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For fintechs, NBFCs, and digital platforms, this is critical. These businesses regularly <a href=\"https:\/\/www.befisc.com\/fintechsherlock\/kyc-know-your-client-identity-fraud\/\">collect and process customer data during KYC<\/a>, onboarding, and service delivery. Therefore, understanding what it means to be a data fiduciary is no longer optional\u2014it is essential.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide explains:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What a data fiduciary is under the DPDP Act<\/li>\n\n\n\n<li>Key obligations for financial services companies<\/li>\n\n\n\n<li>Practical steps fintechs can take to stay compliant<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">What Is a Data Fiduciary Under the DPDP Act?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Under the DPDP Act, a data fiduciary is any entity that determines:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What personal data to collect<\/li>\n\n\n\n<li>Why the data is collected<\/li>\n\n\n\n<li>How the data is processed<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In simple terms, if your company controls the purpose and means of data processing, it is a data fiduciary.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For most fintechs, this is straightforward. For example, <a href=\"https:\/\/www.befisc.com\/fintechsherlock\/aadhaar-ekyc-process\/\">collecting Aadhaar<\/a>, PAN, bank statements, or selfies for KYC clearly places the company in the role of a data fiduciary. Similarly, using this data for<a href=\"https:\/\/www.befisc.com\/fintechsherlock\/credit-risk-assessment-hidden-signals-lenders-miss\/\"> identity verification or credit assessment<\/a> reinforces this classification.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Key Obligations of Data Fiduciaries<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Lawful Basis for Processing<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, personal data must be processed only for a lawful purpose.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For fintechs, the common lawful bases include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Explicit consent from the user<\/li>\n\n\n\n<li>Legitimate uses defined under the Act<\/li>\n\n\n\n<li>Processing necessary to fulfill a contract<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As a result, every data activity must clearly link to a valid legal basis.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Consent Requirements<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When relying on consent, it must meet strict conditions. Consent must be:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Free and not forced<\/li>\n\n\n\n<li>Specific to a clear purpose<\/li>\n\n\n\n<li>Fully informed<\/li>\n\n\n\n<li>Unbundled from other terms<\/li>\n\n\n\n<li>Easily revocable<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In addition, <a href=\"https:\/\/www.befisc.com\/fintechsherlock\/screenshot-pdf-compliance-risk\/\">consent notices must<\/a> use simple language. Users should clearly understand what they are agreeing to.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Purpose Limitation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Personal data must only be used for the purpose it was collected for.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>KYC data cannot be used for marketing<\/li>\n\n\n\n<li>Credit data cannot be shared with third parties without consent<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, any secondary use requires fresh and explicit consent.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Data Minimisation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fintechs should only collect data that is necessary.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Collecting extra data \u201cjust in case\u201d violates the Act. Instead, companies should map:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What data is collected<\/li>\n\n\n\n<li>Why it is needed<\/li>\n\n\n\n<li>Whether it is truly required<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This ensures compliance and reduces risk.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Security Measures<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Data fiduciaries must protect personal data from:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Breaches<\/li>\n\n\n\n<li>Unauthorized access<\/li>\n\n\n\n<li>Loss or destruction<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Although the Act does not define exact standards, expectations are high for fintechs. This is because they handle sensitive financial and biometric data.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Data Principal Rights<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The DPDP Act gives users several rights. These include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Access to their data<\/li>\n\n\n\n<li>Correction of inaccurate data<\/li>\n\n\n\n<li>Erasure of data (subject to legal requirements)<\/li>\n\n\n\n<li>Nomination of a representative<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, fintechs must build systems to handle these requests efficiently.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Data Retention Limits<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Data cannot be stored forever.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It must be deleted once it is no longer needed. However, there is an important exception. Legal requirements\u2014such as PMLA\u2014may require data retention for a fixed period.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, KYC and transaction data must be retained for five years under PMLA.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Significant Data Fiduciary (SDF)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Act introduces a special category called <a href=\"https:\/\/www.befisc.com\/fintechsherlock\/corporate-fraud-in-india-patterns-risk-signals-and-prevention-frameworks\/\" type=\"link\" id=\"https:\/\/www.befisc.com\/fintechsherlock\/corporate-fraud-in-india-patterns-risk-signals-and-prevention-frameworks\/\">Significant Data Fiduciary <\/a><strong>(SDF).<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This applies to companies that:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Process large volumes of sensitive data<\/li>\n\n\n\n<li>Pose higher risks to users<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Although final criteria are pending, fintechs handling large-scale KYC data may fall under this category.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SDFs must meet additional requirements, such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Appointing a Data Protection Officer<\/li>\n\n\n\n<li>Conducting Data Protection Impact Assessments<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Practical Compliance Steps for Fintechs<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">To comply with the DPDP Act, fintechs should take the following steps:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Data Mapping<\/strong><br>Document all data flows, including collection, usage, storage, and sharing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Consent Redesign<\/strong><br>Replace bundled consent with clear, purpose-specific consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Privacy Notice Update<\/strong><br>Ensure policies are simple, transparent, and easy to understand.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. User Rights Management<\/strong><br>Set up systems to handle access, correction, and deletion requests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. Vendor Compliance<\/strong><br>Ensure third-party processors follow DPDP requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6. Security Review<\/strong><br>Evaluate and strengthen data protection measures.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Where BeFiSc Fits<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">BeFiSc\u2019s<a href=\"https:\/\/www.befisc.com\/fintechsherlock\/kyc-api-integration-guide\/\"> verification APIs<\/a> are designed with compliance in mind. They support:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Purpose-limited data processing<\/li>\n\n\n\n<li>Minimal data retention<\/li>\n\n\n\n<li>Secure verification workflows<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As a result, fintechs can use BeFiSc as a compliant data processor while maintaining their data fiduciary responsibilities.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Key Takeaways<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Fintechs that control data processing are <strong>data fiduciaries<\/strong><\/li>\n\n\n\n<li>Consent must be <strong>clear, specific, and revocable<\/strong><\/li>\n\n\n\n<li>Data must only be used for its <strong>intended purpose<\/strong><\/li>\n\n\n\n<li>Only <strong>necessary data<\/strong> should be collected<\/li>\n\n\n\n<li>Regulatory laws like PMLA override general retention limits<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Frequently Asked Questions<\/h1>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1780229150942\"><strong class=\"schema-faq-question\">What is the difference between a data fiduciary and a data processor?<\/strong> <p class=\"schema-faq-answer\">A data fiduciary decides how and why data is processed.<br>A data processor acts on behalf of the fiduciary and follows its instructions.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1780229181805\"><strong class=\"schema-faq-question\">What are the penalties for non-compliance?<\/strong> <p class=\"schema-faq-answer\">Penalties under the DPDP Act can be significant:<br>Up to \u20b9250 crore for major data breaches<br>Up to \u20b950 crore for security failures<br>The Data Protection Board determines penalties based on severity and impact.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1780229212387\"><strong class=\"schema-faq-question\">Does the DPDP Act override PMLA?<\/strong> <p class=\"schema-faq-answer\">No, it does not.<br>PMLA requirements, such as five-year data retention, take precedence. These are considered lawful obligations under the DPDP Act.<\/p> <\/div> <\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\"><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\"><\/h2>\n","protected":false},"excerpt":{"rendered":"Introduction The Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a new compliance framework for Indian businesses&hellip;","protected":false},"author":8,"featured_media":877,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[5],"tags":[315,317,316,318],"class_list":["post-767","post","type-post","status-publish","format-standard","has-post-thumbnail","category-resources","tag-dpdp-act-data-fiduciary","tag-fintech-compliance-dpdp","tag-india-data-protection-law","tag-personal-data-protection-india","cs-entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Data Fiduciary Under DPDP Act: Fintech Compliance Guide<\/title>\n<meta name=\"description\" content=\"Data Fiduciary under the DPDP Act 2023: compliance obligations, consent management, and data protection requirements for fintechs.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Data Fiduciary Under DPDP Act: Fintech Compliance Guide\" \/>\n<meta property=\"og:description\" content=\"Data Fiduciary under the DPDP Act 2023: compliance obligations, consent management, and data protection requirements for fintechs.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"BeFiSc\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-01T01:49:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-01T01:49:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/05\/Data-Fiduciary-Under-DPDP-Act.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Chailsee yadav\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Chailsee yadav\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Data Fiduciary Under DPDP Act: Fintech Compliance Guide","description":"Data Fiduciary under the DPDP Act 2023: compliance obligations, consent management, and data protection requirements for fintechs.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/","og_locale":"en_GB","og_type":"article","og_title":"Data Fiduciary Under DPDP Act: Fintech Compliance Guide","og_description":"Data Fiduciary under the DPDP Act 2023: compliance obligations, consent management, and data protection requirements for fintechs.","og_url":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/","og_site_name":"BeFiSc","article_published_time":"2026-06-01T01:49:45+00:00","article_modified_time":"2026-06-01T01:49:46+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/05\/Data-Fiduciary-Under-DPDP-Act.png","type":"image\/png"}],"author":"Chailsee yadav","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Chailsee yadav","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#article","isPartOf":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/"},"author":{"name":"Chailsee yadav","@id":"https:\/\/web.befisc.com\/fintechsherlock\/#\/schema\/person\/6b4fa6213a7742947b3a7717dcd5615e"},"headline":"\u00a0Data Fiduciary Under DPDP Act: What It Means for Fintechs Handling User Data","datePublished":"2026-06-01T01:49:45+00:00","dateModified":"2026-06-01T01:49:46+00:00","mainEntityOfPage":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/"},"wordCount":855,"commentCount":0,"publisher":{"@id":"https:\/\/web.befisc.com\/fintechsherlock\/#organization"},"image":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/05\/Data-Fiduciary-Under-DPDP-Act.png","keywords":["DPDP Act data fiduciary","fintech compliance DPDP","India data protection law","personal data protection India"],"articleSection":["Resources"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#respond"]}]},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/","url":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/","name":"Data Fiduciary Under DPDP Act: Fintech Compliance Guide","isPartOf":{"@id":"https:\/\/web.befisc.com\/fintechsherlock\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#primaryimage"},"image":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/05\/Data-Fiduciary-Under-DPDP-Act.png","datePublished":"2026-06-01T01:49:45+00:00","dateModified":"2026-06-01T01:49:46+00:00","description":"Data Fiduciary under the DPDP Act 2023: compliance obligations, consent management, and data protection requirements for fintechs.","breadcrumb":{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229150942"},{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229181805"},{"@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229212387"}],"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#primaryimage","url":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/05\/Data-Fiduciary-Under-DPDP-Act.png","contentUrl":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2026\/05\/Data-Fiduciary-Under-DPDP-Act.png","width":1200,"height":630,"caption":"Understanding data fiduciary obligations under India's DPDP Act 2023 for fintech businesses."},{"@type":"BreadcrumbList","@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.befisc.com\/fintechsherlock\/"},{"@type":"ListItem","position":2,"name":"\u00a0Data Fiduciary Under DPDP Act: What It Means for Fintechs Handling User Data"}]},{"@type":"WebSite","@id":"https:\/\/web.befisc.com\/fintechsherlock\/#website","url":"https:\/\/web.befisc.com\/fintechsherlock\/","name":"BeFiSc","description":"Founder Articles","publisher":{"@id":"https:\/\/web.befisc.com\/fintechsherlock\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/web.befisc.com\/fintechsherlock\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/web.befisc.com\/fintechsherlock\/#organization","name":"BeFiSc","url":"https:\/\/web.befisc.com\/fintechsherlock\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/web.befisc.com\/fintechsherlock\/#\/schema\/logo\/image\/","url":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2025\/06\/befiscsymbol.png","contentUrl":"https:\/\/www.befisc.com\/fintechsherlock\/wp-content\/uploads\/2025\/06\/befiscsymbol.png","width":508,"height":120,"caption":"BeFiSc"},"image":{"@id":"https:\/\/web.befisc.com\/fintechsherlock\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/web.befisc.com\/fintechsherlock\/#\/schema\/person\/6b4fa6213a7742947b3a7717dcd5615e","name":"Chailsee yadav","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/1bd43e74edffa6494c6b2aa707e92cd52e04c1319d36fb8b57e2945bb6ca2a2c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1bd43e74edffa6494c6b2aa707e92cd52e04c1319d36fb8b57e2945bb6ca2a2c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1bd43e74edffa6494c6b2aa707e92cd52e04c1319d36fb8b57e2945bb6ca2a2c?s=96&d=mm&r=g","caption":"Chailsee yadav"},"url":"https:\/\/www.befisc.com\/fintechsherlock\/author\/chailsee-yadav\/"},{"@type":"Question","@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229150942","position":1,"url":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229150942","name":"What is the difference between a data fiduciary and a data processor?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"A data fiduciary decides how and why data is processed.<br>A data processor acts on behalf of the fiduciary and follows its instructions.","inLanguage":"en-GB"},"inLanguage":"en-GB"},{"@type":"Question","@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229181805","position":2,"url":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229181805","name":"What are the penalties for non-compliance?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Penalties under the DPDP Act can be significant:<br>Up to \u20b9250 crore for major data breaches<br>Up to \u20b950 crore for security failures<br>The Data Protection Board determines penalties based on severity and impact.","inLanguage":"en-GB"},"inLanguage":"en-GB"},{"@type":"Question","@id":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229212387","position":3,"url":"https:\/\/www.befisc.com\/fintechsherlock\/data-fiduciary-dpdp-act-fintech-compliance\/#faq-question-1780229212387","name":"Does the DPDP Act override PMLA?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"No, it does not.<br>PMLA requirements, such as five-year data retention, take precedence. These are considered lawful obligations under the DPDP Act.","inLanguage":"en-GB"},"inLanguage":"en-GB"}]}},"_links":{"self":[{"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/posts\/767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/comments?post=767"}],"version-history":[{"count":2,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/posts\/767\/revisions"}],"predecessor-version":[{"id":878,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/posts\/767\/revisions\/878"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/media\/877"}],"wp:attachment":[{"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/media?parent=767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/categories?post=767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.befisc.com\/fintechsherlock\/wp-json\/wp\/v2\/tags?post=767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}