It is 9:15 on a Sunday night in Pune.

Meera has found the flat she wants. She opens a lender's app, taps "Home loan" and starts typing. PAN. Aadhaar-based eKYC. Employer. Three months of salary slips. Her husband Rohan goes in as co-applicant, with his income too. She approves an account-aggregator request so the lender can read her bank statements, consents to a bureau check, and accepts a credit-life insurance quote. Her father is named as nominee. She takes a live selfie for KYC.

Twenty-two minutes.

By the end, her file has reached a sourcing partner, a KYC system, a credit bureau, an aggregator, a valuer, a law firm, an insurer, a co-lending bank, a mandate registry, a cloud host and a messaging gateway. If she ever falls behind, it will reach a collections agency too. She has heard of perhaps three of them.

None of this is careless. It is how lending works. But under the Digital Personal Data Protection Act, 2023, one organisation answers for the whole journey: the one she applied to.

This article is for the people who run those institutions: CIOs, CISOs, chief compliance officers, heads of operations and the newly appointed data protection leads at banks, NBFCs, insurers, broking and asset-management firms, payment companies and the fintechs that plug into all of them.

Why BFSI is the hardest room in the DPDP house

Financial services holds the most valuable personal data in the economy, and holds it longest. Identity documents, income, liabilities, health declarations, family and nominee details, and transaction trails that show where someone shops, travels and worships. A leaked address is an annoyance. A leaked KYC folder is a loan taken in your name.

The Act creates no separate "sensitive data" class, so a bank's account-opening form is not formally treated differently from a cinema's booking form. That is not comfort. The Data Protection Board will look at harm, and in this industry the harm is financial.

Three things set BFSI apart from every other sector:

• You already have regulators. RBI, SEBI, IRDAI and PFRDA continue to apply. The Act operates in addition to their rules (Section 38), and where the two genuinely conflict, the Act prevails to the extent of the conflict. In practice you satisfy both, and the stricter one governs each point.
• You are legally required to keep data other industries can delete.
• You outsource more than almost anyone.

On timing: the Board was constituted on 13 November 2025, Rule 4 on Consent Managers commences on 13 November 2026, and the core obligations commence on 13 May 2027. There has been talk of compressing that timeline. As far as I can tell nothing has been gazetted, so plan for May 2027 and watch official notifications.

What a financial institution actually holds

Segment	Data it holds	Biggest DPDP pressure point
Banks	Accounts, KYC, transactions, cards, CCTV, call recordings	Decades of legacy data, joint accounts, minors, hundreds of vendors
NBFCs and digital lenders	Applications, bureau data, statements, selfies, device data, references	Sourcing partners, collection agencies, co-lending, app permissions
Insurers	Proposals, medical declarations, claims, nominees, agent and TPA records	Health data inside claims, intermediaries, long retention
Broking, AMCs, wealth	Demat and folio data, PAN, bank links, advisory profiles	KRAs and RTAs, algorithmic profiling, family accounts
Payments and fintech	Wallet and UPI data, merchant details, device and location signals	Localisation rules, partner-bank flows, heavy analytics

The legal question on every line of that diagram is the same. Is the partner acting on your instructions, or deciding its own purposes? The first is a Data Processor, and you remain accountable for what it does. The second is an independent Data Fiduciary, and your job is to have told the customer the hand-off happens. Section 8(1) makes you responsible for compliance whatever your contracts say, and Section 8(2) allows processors only under a valid contract.

THE PART MOST TEAMS MISS Calling a partner an independent fiduciary does not make the obligation go away. You still chose to send the data, so the customer must be told, and you must be able to show why each field travelled.

Where the Act meets sector law

The most common mistake is treating DPDP and sector rules as rivals. They stack, and the Act itself anticipates it: the erasure duty gives way where a law requires retention (Section 8(7)).

Area	Sector rule	How it meets DPDP
KYC records	PMLA rules and RBI KYC directions: keep identity records at least five years after the relationship ends	Erasure yields for those records only. It does not license keeping everything else.
Payment data	RBI: payment system data stored only in India	Sits beside DPDP's open transfer model, which restricts only countries the government notifies
Outsourcing	RBI IT outsourcing directions: the regulated entity stays responsible	Same answer under Section 8(1), plus contracts carrying safeguards (Rule 6)
Digital lending	RBI digital lending directions: limits on app permissions, data stored in India	Consent and minimisation under Section 6 point the same way
Credit data	Credit Information Companies Act: statutory sharing with bureaus	Statutory reporting has its own basis. Marketing use of the same data does not.
Incidents and controls	CERT-In six-hour reporting, plus RBI, SEBI CSCRF and IRDAI norms	The Rules add Board and customer intimation, and baseline safeguards including logs kept for a year

Seven real challenges, and why they are hard

1. Decades of legacy data

Section 5(2) says that where a customer consented before the Act began, you must give notice as soon as reasonably practicable, and you may keep processing until they withdraw. For a bank with forty years of customers, "reasonably practicable" means dead mobile numbers, abandoned email addresses, joint holders, NRIs, dormant accounts and people who have never opened the app. A notice programme for that base is a multi-quarter operation with its own evidence trail, not a bulk SMS.

2. Legal bases: consent is not the only tool, and misusing the others is worse

Lending runs on a mix of bases. Data a customer voluntarily provides to get a loan can be processed for that purpose (Section 7(a)). Disclosures a law requires you to make to the State, such as AML reporting, have their own footing (Section 7(d)). Section 17(1)(f) lets a lender process a defaulter's data to ascertain their financial information and assets and liabilities, and 17(1)(c) covers prevention and detection of offences such as fraud.

The trap is stretching them. Section 17 relaxes Chapter II duties but still leaves Sections 8(1) and 8(5) standing: accountability and security safeguards. And none of it covers cross-selling.

Activity	Basis commonly relied on	Watch-out
Underwriting and servicing	Voluntarily provided data for the specified purpose (7(a))	Collect only what the decision needs
AML and regulatory disclosures	Legal obligation to disclose (7(d))	Basis covers the disclosure, not reuse
Defaulter tracing	Section 17(1)(f)	Security safeguards still apply
Fraud detection	Section 17(1)(c)	Do not repurpose fraud signals for marketing
Cross-sell and marketing	Consent (Section 6)	Separate, specific, withdrawable

Take this to counsel per product line. A second wrinkle: the Account Aggregator framework is sectoral, while Consent Managers under the Act are a separate registered category, with an Indian company and a minimum net worth of ₹2 crore required. Institutions may end up honouring both rails.

3. The retention collision

The Act requires erasure once the purpose is served or consent is withdrawn, unless a law requires you to hold the data. The three-year inactivity erasure rule in the Third Schedule targets e-commerce, gaming and social media platforms above user thresholds, not BFSI. For you, retention is decided record by record, by purpose and by law.

The declined loan application is where teams slip. The purpose ended at rejection, yet the file sits for years "for future cross-sell", a purpose nobody asked you to pursue. Retain the KYC record the law needs. Do not keep the marketing profile built on top of it.

4. Other people's data in your customer's file

Co-applicants, guarantors, nominees, references, employers. Most never saw your notice. Section 14 gives customers a right to nominate someone to exercise their rights on death or incapacity, so nominee handling becomes a process, not a form field.

Minors are harder. Anyone under 18 is a child under Section 9, which requires verifiable parental or guardian consent and bars tracking, behavioural monitoring and targeted advertising aimed at children. Banking rules allow older minors to operate savings accounts, so the two must be reconciled deliberately. Contacting a borrower's references during recovery is a purpose question as much as a conduct question.

5. The vendor chain

Sourcing partners, valuers, law firms, collection agencies, KRAs, cloud hosts, messaging vendors. Rule 6 expects processor contracts to carry reasonable safeguards, and RBI's outsourcing directions already leave accountability with the regulated entity. The real risk is small vendors: a collection agency running KYC documents through WhatsApp groups, a valuer emailing property papers. Your breach clock also depends on theirs.

6. Rights requests at bank scale

Section 11 lets a customer ask for a summary of the personal data you process, and the identities of every other fiduciary and processor it has been shared with. Section 12 adds correction, completion, updating and erasure. Grievances must be resolved within ninety days, and customers must exhaust your grievance route before approaching the Board (Section 13).

For an institution with crores of customers across core banking, cards, loans, wealth and insurance, the difficulty is not the form. It is finding one person's data across systems that never shared an identifier, and answering within the deadline. A shared inbox will not survive the first campaign of requests.

7. Three breach clocks, one very bad night

Under Section 8(6) and Rule 7, each affected individual must be told without delay, in plain language. The Board must be told without delay and given a detailed report within 72 hours. CERT-In's six-hour window and your sector regulator's norms run alongside. Failing to keep reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to notify a breach up to ₹200 crore.

Every BFSI breach ends as a phishing campaign. A message quoting a real loan amount and a real EMI date is very convincing. Warn customers proactively, on every statement and confirmation, that you will never ask for OTPs or card details by link.

Accuracy, algorithms and Significant Data Fiduciaries

Where personal data drives a decision about a person, Section 8(3) requires it to be accurate and complete. In credit, a wrong bureau record is a rejected loan. Correction requests must flow through to bureaus and partners, not just your own database.

The government can designate a Significant Data Fiduciary based on volume, sensitivity and risk. Large banks, insurers, major NBFCs and payment companies are plausible candidates, though designation is the government's call. It brings an India-based Data Protection Officer, an independent data auditor, an annual DPIA and audit under Rule 13, due diligence on algorithmic software such as credit models, and possible restrictions on transferring specified data abroad. The penalty band for these duties runs up to ₹150 crore.

Getting ready: eight workstreams

There are 226 days from today to 13 May 2027. Discovery and vendor renegotiation consume more time than any team expects, so start with the data map and the contracts, because every other workstream depends on knowing what you hold and who else holds it.

Run the workstreams in parallel, with one named owner for each and one evidence file for all of them. The pattern that works in regulated firms is the same one that works for audits: dated artefacts, not verbal assurance. When the Board or your sector regulator asks how you decided something, the answer should be a document with a date on it.

How VaultDef can help

Institutions rarely fail DPDP for lack of intent. They fail because the data lives in forty systems and nobody can prove what happens to it. VaultDef is a DPDP compliance platform built for Indian organisations, designed so that compliance produces evidence.

Challenge	Where VaultDef helps
Legacy data and unknown data	Data Intelligence scans your schemas, classifies personal data and shows why each verdict was reached
Bases, notices and consent	Consent and Preference Management keeps layered notices and purpose-wise consent, with withdrawal that reaches downstream tools
Retention and erasure	Data Principal Rights runs access, correction, erasure and nomination requests, with scheduled erasure
Vendor chain	Risk, Governance and Assurance tracks processors, roles and cross-border flows, and supports DPIAs
Breach clocks	Detection and Incident Response supports breach workflows against the 72-hour requirement
Proof	Evidence and Accountability keeps a tamper-evident trail for auditors, regulators and the Board

A live demo is forty-five minutes: we connect to a sample of your schema, or ours, and you watch a scan classify data. You leave with a gap assessment generated during the call.

Trust is the balance sheet

A financial institution sells trust before it sells any product. DPDP writes down what customers already assume: that you know where their data went, why it went there, and when it will be gone. The institutions that can prove it will find it becomes a competitive advantage.

VaultDef is a DPDP compliance platform built for Indian organisations. For BFSI it maps data across systems and partners, manages notices and purpose-wise consent, runs rights requests and scheduled erasure, tracks processors and cross-border flows, and keeps an evidence trail. Request a BFSI walkthrough at vaultdef.com

Frequently asked questions

Does the DPDP Act apply to banks, NBFCs and insurers?

Yes. Any entity processing digital personal data is a Data Fiduciary, whatever its size. Sector rules apply in addition.

Can we keep KYC records after a customer leaves?

Yes, for as long as a law such as the PMLA rules requires. Keep the record the law needs, not the whole profile.

Is legitimate use enough for cross-selling?

No. Cross-selling needs its own specific consent.

How fast must a breach be reported?

Affected individuals and the Board must be told without delay, with a detailed Board report within 72 hours. CERT-In and sector norms run alongside.

Will large BFSI entities be Significant Data Fiduciaries?

That is for the government to decide, but volume, data value and risk point that way. Prepare in advance.