DPDP Compliance for Banks and NBFCs

A bank is almost always a Data Fiduciary for the personal data it collects directly from customers KYC documents, transaction records, and credit data because it determines the purpose and means of processing. Vendors it engages to process that data on its behalf, such as a BPO running collections calls, act as Data Processors under contract to the bank.

The Act applies to personal data processing generally, not just data collected after a specific date. Existing customer records collected before the Act's provisions came into force still need to meet the Act's consent, purpose-limitation, and security requirements going forward.

The two operate alongside each other rather than one replacing the other. RBI's 2018 circular requires payment system data to be stored in India specifically. The DPDP Act governs cross-border transfer more broadly and currently permits transfer to any country the government hasn't specifically restricted by notification — no such restriction list has been published as of mid-2026. A bank needs both rules mapped against its actual data flows, not just the more permissive one.

A Consent Manager under the DPDP Act is a registered intermediary through which a Data Principal can manage consent across multiple platforms. It's structurally similar to RBI's existing Account Aggregator framework, which already lets customers consent to share financial data across institutions, but the Consent Manager framework is broader in scope and sits under the Data Protection Board rather than the RBI. Registration for Consent Managers opens 13 November 2026.

The DPDP Act allows the government to notify certain Data Fiduciaries as Significant Data Fiduciaries based on the volume and sensitivity of data they process, among other factors. Institutions processing data at the scale of a large bank or NBFC are widely expected to qualify, but as of this writing the government has not published the specific list or criteria for that notification; treat this as a strong likelihood to prepare for, not a confirmed classification.

Penalties can run up to ₹250 crore per contravention, depending on the nature and severity of the violation, as stated in the Act's Schedule. The exact figure depends on which specific obligation was breached.

DPDP consent needs to be specific to the purpose for which data is collected and processed. A single KYC consent captured at account opening is unlikely to cover distinct purposes like credit scoring, marketing communication, or data sharing with a collections vendor; each purpose generally needs its own clearly itemised consent.