DPDPA Compliance for Banks & NBFCs: Financial Data Protection Guide

The Indian financial services industry—comprising banks, NBFCs (Non-Banking Financial Companies), payment aggregators, and fintech platforms—operates under a complex regulatory landscape. The Digital Personal Data Protection Act (DPDPA) 2023 intersects with Reserve Bank of India (RBI) guidelines, creating unique compliance obligations for financial data protection.

Critical Intersection: DPDPA operates alongside RBI Master Direction on IT Governance (2016) and RBI's data localization requirements. Financial institutions must comply with BOTH frameworks—DPDPA for personal data protection AND RBI for financial sector-specific requirements.

RBI-DPDPA Intersection and Data Localization

RBI mandates that "all customer data, financial data, and transaction records must be stored on servers located in India." DPDPA Section 5(9) reinforces this, prohibiting transfer of personal data outside India without explicit consent.

Practical Implementation

Banks and NBFCs must ensure:

Server Location: Core banking systems, customer databases must be on India-based servers
Cloud Usage: If using cloud storage (AWS, Azure), must use India regions only
Backup Data: Even backup/disaster recovery data cannot be stored outside India without explicit consent
Third-Party Processors: Payment processors, analytics providers must commit to India-only storage
Data Processing Agreement: Written DPA specifying data location for each third party

KYC (Know Your Customer) Data Handling

KYC is mandatory under RBI regulations. However, DPDPA requires that KYC data be handled with explicit purpose limitation:

Case Law Reference: RBI Master Direction on IT Governance specifies that KYC data forms the core of customer identity and must be protected with highest security standards. This aligns with DPDPA's classification of identity data as sensitive personal data requiring enhanced protection.

KYC Consent Framework

Banks and NBFCs must collect explicit consent for KYC data use:

KYC Consent Form Elements:

Identity Verification: Consent to collection of government ID (Aadhaar, PAN, Passport) for account opening
Address Verification: Consent to collect address proof (utility bill, rental agreement)
Financial Profile: Consent to assess income and creditworthiness through KYC
AML/CFT Screening: Consent to check against anti-money laundering and counter-financing terrorism lists
Credit Bureau Sharing: Separate consent to share KYC data with credit bureaus (CIBIL, Experian)
Data Retention: Notice that KYC data retained for duration of account + 10 years post-closure per RBI guidelines

Compliance Risk: Many banks combine "accept terms and conditions" with KYC consent. Under DPDPA, KYC consent must be separate, explicit, and specific. Customers must be able to withhold KYC consent for certain uses (like credit bureau sharing) even while opening accounts.

Loan Servicing Consent and Credit Assessment

When banks/NBFCs extend credit, they process sensitive financial data. DPDPA requires specific consents for different data uses:

Loan Processing Consent Workflow

Example: Digital Lending App Processing Personal Loan Applications

At application stage, customer consents to:

Credit Assessment: Pull credit score from bureaus, assess financial history
Income Verification: Verify employment, income through GST returns, salary slips
CIBIL/Equifax Inquiry: Explicit consent to credit bureau inquiry (note: hard inquiry affects credit score)
Bank Statement Analysis: Consent to access bank statements for financial assessment
Loan Servicing: During loan tenure, consent to monitor account for any defaults
Recovery Actions: If default occurs, consent to collection activities (not harassment)

Critically, each consent item must be separate. Customer cannot be forced to consent to all for loan approval.

Traditional Bank with Fintech Partnership

Case Study: Large Bank Offering Digital Lending through Fintech Partner

When traditional bank partners with fintech lender for digital lending:

Data Sharing Protocol: Bank shares only KYC data necessary for assessment, not entire customer profile
Customer Consent: Bank obtains separate consent from customer for fintech partnership data sharing
Data Processing Agreement: Written DPA between bank and fintech specifying: data to be shared, uses allowed, retention period, security measures
Fintech Compliance: Fintech platform must be DPDPA-compliant and implement required security measures
Data Return/Deletion: Fintech must return or delete shared data after loan decision or stated period

Credit Bureau Data Sharing Under DPDPA

Banks share customer financial data with credit bureaus (CIBIL, Equifax, Experian). This requires explicit consent:

Separate Consent Item: Cannot be bundled with loan agreement
Purpose Clarity: Explain that data will be shared for creditworthiness assessment
Data Scope: Specify what financial data (loan amount, repayment status, defaults) will be shared
Bureau Identification: Name specific credit bureaus data will be shared with
Withdrawal Right: If customer withdraws consent, new data not shared (but existing data cannot be recalled)

Payment Aggregator Data Flows and Compliance

Payment aggregators (like Razorpay, PayU, Instamojo) processing payments for merchants handle sensitive data: customer bank details, transaction amounts, merchant details.

DPDPA for Payment Aggregators: Payment processors fall under "data processors" rather than "data controllers" for payment transactions. However, for any secondary data use (analytics, fraud detection, marketing), payment aggregators must obtain explicit customer consent.

Payment Aggregator Compliance Framework

Data Minimization: Aggregators should not store full bank account numbers, only tokens for re-billing.

Consent for Fraud Detection: Separate consent required to use transaction data for fraud detection algorithms and behavioral analysis.

Merchant Data Isolation: Payment data of one merchant's customers cannot be accessed by or shared with other merchants.

PCI-DSS + DPDPA Alignment: While PCI-DSS covers payment card security, DPDPA covers all customer personal data in payments ecosystem.

RBI Master Direction on IT Governance Alignment

RBI's Master Direction on IT Governance specifies security measures that align with DPDPA requirements:

RBI Requirement	DPDPA Alignment
Encryption of data in transit and at rest	Section 5(4) requires appropriate security measures
Access controls and user authentication	Section 5(3) requires data minimization and access control
Audit trails for data access	Section 5(5) requires accountability for data processing
Incident reporting to RBI within 72 hours	Section 8(3) requires breach notification to affected individuals
Data localization to India	Section 5(9) restricts cross-border data transfers
Customer grievance redressal	Section 7 mandates mechanism to address data subject rights

Data Subject Rights in Banking Context

Customers have specific rights under DPDPA that banks/NBFCs must facilitate:

Right to Access: Customer can request all personal data bank holds about them within 30 days
Right to Correction: Customer can correct inaccurate KYC data, address information
Right to Deletion: After account closure and 10-year retention period, customer can request data deletion (subject to RBI retention requirements)
Right to Opt-Out: Can opt-out of marketing communications, behavioral profiling
Right to Grievance: Can lodge DPDPA grievance with bank's Data Protection Officer

Breach Notification in Financial Sector

When banks/NBFCs experience data breach, heightened notification requirements apply:

RBI Notification: Bank must notify RBI within 72 hours of discovering breach
Customer Notification: DPDPA requires notification of affected customers within 72 hours
Regulatory Disclosure: May need to disclose breach in RBI regulatory filings if material
Incident Documentation: Maintain detailed logs of breach discovery, scope, mitigation

Key Takeaways for Banking/NBFC Compliance

DPDPA Compliance Checklist for Banks & NBFCs:

✓ Ensure all customer data stored in India only (RBI + DPDPA)
✓ Implement separate, explicit KYC data consent
✓ Obtain purpose-specific consent for loan servicing and credit assessment
✓ Get separate consent for credit bureau data sharing
✓ Establish Data Processing Agreements with all third parties
✓ Implement encryption and access controls per RBI standards
✓ Create customer data access request mechanism
✓ Establish breach notification procedures for RBI and customers
✓ Maintain audit trails of all data access for 3+ years
✓ Conduct annual DPDPA and RBI compliance audit

Conclusion

Banking and NBFC compliance with DPDPA requires understanding the intersection of DPDPA requirements with RBI's existing data protection framework. Financial institutions that implement clear consent mechanisms for different financial data uses, maintain India-based data storage, and provide robust customer rights mechanisms will achieve both DPDPA and RBI compliance while building customer trust in India's evolving financial services ecosystem.