India’s Digital Personal Data Protection (DPDP) framework reaches a new implementation milestone on Friday, November 13, with the registration of Consent Managers set to begin.
However, the date does not mark the commencement of the law’s full compliance requirements for businesses. Key obligations relating to consent management, data security, customer rights and breach reporting are scheduled to come into effect on May 13, 2027.
For banks, insurers and non-banking financial companies (NBFCs), the six-month transition period will be important for reviewing how they collect, process, store and share customer information.
“Consent becomes an operational control, not just a legal formality. Banks, insurers and NBFCs will need to rethink how they capture, document, manage and demonstrate customer consent across digital and physical channels,” said Krishna Chaitanya B, Chief Product Officer, Perfios, an Indian financial technology (FinTech) and AI-driven software company.
Consent and customer data collection
Under the DPDP framework, financial institutions will need to make their data collection practices more purpose-specific, distinguishing information required for regulatory compliance from data collected for commercial activities such as marketing and cross-selling.
For instance, KYC requirements under the Prevention of Money Laundering Act (PMLA) and RBI regulations do not automatically permit institutions to reuse customer information for unrelated purposes.
Institutions will also need to ensure that the information collected for credit assessment is relevant to that purpose. This assumes significance as lenders increasingly use bank statements, transaction histories, credit bureau information and alternative data to assess borrowers.
Chaitanya said lenders would need to establish a lawful basis for processing different categories of personal data, restrict access and prevent unrelated reuse, including for marketing and profiling.
Data storage and third-party sharing
Financial institutions will also need to review their data retention policies and identify what customer information they hold, where it is stored, why it is retained and when it should be deleted.
This includes information across legacy databases, unsuccessful loan applications, closed accounts, cloud systems and outsourced platforms, subject to applicable statutory retention requirements.
Third-party data sharing is another area requiring attention. Banks, insurers and NBFCs routinely share customer information with fintech companies, cloud providers, analytics firms, credit bureaus and collection agencies.
“Outsourcing data processing does not outsource the Data Fiduciary’s accountability,” Chaitanya said.
He said institutions would need to strengthen vendor due diligence, contractual safeguards, access controls and oversight of further data sharing. They would also need to ensure that service providers return or delete customer information when their engagements end.
Coordination across teams remains a challenge
Beyond technology and compliance processes, aligning different business functions will be important for organisations preparing for the DPDP requirements.
“Working closely with enterprises through their DPDP implementations, we’re learning that the gap often isn’t technology, but alignment. Legal, technology, InfoSec and business teams each understand their own roles, but bringing them together around a shared understanding of the organisation’s data and responsibilities is where the real work lies,” said Malcolm Gomes, COO, IDfy and Head of Privy by IDfy.
He said organisations would need to address these coordination gaps early, given the six-month window before the substantive compliance requirements take effect in May 2027.
Why cybersecurity and breach reporting matter
The DPDP framework also requires organisations to strengthen personal data security and breach response mechanisms. Importantly, a personal data breach may not be limited to incidents involving the theft or extraction of information.
According to a November 12 briefing by K7 CyberSecurity, Indian multinational cybersecurity solutions provider for enterprises, ransomware attacks could trigger breach-reporting requirements if they result in a qualifying loss of access to personal data, even without evidence of data theft.
Under the DPDP Rules, Data Fiduciaries must notify affected individuals without delay and submit a detailed report to the Data Protection Board of India within 72 hours of becoming aware of a personal data breach, unless an extension is permitted.
The briefing also highlights the importance of timely escalation by third-party processors. The reporting timeline runs from the Data Fiduciary’s awareness of the breach, making communication between financial institutions and their technology vendors important for incident assessment and reporting.
The law provides for penalties of up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for failure to meet breach notification obligations. These are maximum statutory penalties and are not automatic.
What happens next?
November 13 marks the beginning of the Consent Manager registration phase. The substantive obligations for Data Fiduciaries are scheduled to come into force on May 13, 2027.
Financial institutions will need to use the intervening period to review consent processes, map customer data flows, update retention policies, assess third-party arrangements and strengthen cybersecurity and incident response systems.