DPDP Act Obligations for Banks and NBFCs: Rules 2025 and Legacy System Compliance

Overview: BFSI Context and the Compliance Timeline

The Digital Personal Data Protection Act, 2023 applies to digital personal data processing within India. For banks, NBFCs, and insurers operating out of Mumbai and across the country, compliance intersects heavily with existing RBI and IRDAI mandates. Chief Compliance Officers face a strict timeline. Exactly 218 days remain until the DPDP hard compliance deadline of 13 May 2027.

Legacy core banking systems hold decades of KYC data, transaction histories, and credit profiles. Updating these systems for the new consent and retention rules requires clear evidence packs and regulator-ready audit trails, not just policy updates.

What the DPDP Act Says: Consent, Retention, and Borders

Section 4 of the Act establishes that a Data Fiduciary may process personal data only for a lawful purpose based on consent or for certain legitimate uses. Section 8 details data retention limits and outlines specific exemptions for regulated entities. The Act explicitly notes an example where a bank must retain a client's identity records for ten years beyond account closure due to applicable banking laws. This statutory requirement supersedes standard erasure requests from a Data Principal.

Section 16 states that cross-border transfers are permitted unless the Central Government notifies a restriction on a specific country or territory. This negative-list approach differs significantly from frameworks requiring predefined approvals for overseas data transfers. Sector-specific mandates, such as RBI data localisation rules, still apply and provide a higher degree of restriction.

DPDP Act vs Rules 2025: Operational Changes

The DPDP Rules, 2025 operationalise the Act by detailing exact procedural requirements. Itemised notices must now precede consent requests. These notices must explain the data collected and the specific processing purpose in clear terms.

For breach response, the Rules require an intimation to affected Data Principals without delay, followed by a detailed report to the Data Protection Board within 72 hours. The Rules also specify verifiable parental consent mechanics for minors, requiring clear audit trails.

Large financial institutions will likely qualify as Significant Data Fiduciaries (SDFs) based on data volume and risk. SDF designation triggers additional duties, including appointing a Data Protection Officer based in India and conducting periodic Data Protection Impact Assessments (DPIAs).

What Every Data Fiduciary Must Do Now

Compliance teams must document a Record of Processing Activities (RoPA) covering all legacy systems and third-party processors. A common objection from risk committees is whether this effort requires another dashboard duplicating existing GRC tools. The reality is that spreadsheets fail when tracking itemised consent withdrawals across millions of retail accounts or managing tight breach reporting windows.

A competent team can handle initial data mapping and policy drafting in-house. Operationalising consent artefacts, processor oversight, and automated erasure triggers at scale requires dedicated tooling. Control owners need evidence trails that satisfy both DPBI auditors and internal board reporting standards.

Breach Notification Specifics

The DPDP Rules, 2025 set tight timelines for data breach incidents. Fiduciaries must intimate affected Data Principals without delay upon discovering a personal data breach. Concurrently, they must submit a detailed report to the Data Protection Board within 72 hours.

This report must include the nature of the breach, the categories of data compromised, and the remedial measures taken. For BFSI entities, this process must run parallel to existing RBI or CERT-In cyber incident reporting workflows. The compliance function needs a unified incident response plan that captures evidence immediately.

Common Misconceptions

Several misinterpretations complicate compliance planning for financial firms. First, consent is the primary basis for processing, except where Section 7 legitimate uses apply. It is incorrect to claim consent is required for every processing activity.

Second, the DPDP 2023 framework does not create a separate legal classification for higher-risk data. Financial, health, or biometric data follow the same base rules as general personal data, though volume and risk factor into SDF designation.

Third, Section 16 governs cross-border transfers via a negative list. The government restricts transfers to notified countries, rather than requiring predefined approvals for permitted destinations.

Implementation Checklist

1. Map personal data flows across all core banking, insurance underwriting, and CRM systems. [In-house feasible]

2. Draft itemised notices in multiple languages matching the Rules, 2025. [In-house feasible]

3. Audit existing KYC data repositories against the 10-year retention mandate cited in Section 8. [In-house feasible]

4. Deploy verifiable consent management systems that capture time-stamped consent artefacts. [Tooling-assisted]

5. Establish a 72-hour breach reporting workflow connecting the security operations centre to the DPO. [Tooling-assisted]

6. Review processor contracts to mandate immediate incident notification and audit rights. [In-house feasible]

7. Implement automated data erasure protocols for marketing databases once consent is withdrawn. [Tooling-assisted]

Penalties and Enforcement Risk

The Data Protection Board of India (DPBI) holds the authority to levy financial penalties for non-compliance. Penalties are proportionate to the severity and duration of the violation. Failure to implement reasonable security safeguards preventing a data breach carries a maximum penalty of 250 crore rupees.

Failure to notify the Board and affected Data Principals of a breach carries a ceiling of 200 crore rupees. The DPBI will assess the mitigating steps taken, the evidence pack provided by the control owner, and the fiduciary's history of compliance when determining the final penalty amount.

How ComplyDP Helps

Financial compliance teams require precise tools to manage DPDP obligations without disrupting legacy GRC architecture. ComplyDP provides audit-ready workflows for itemised consent capture, processor oversight, and structured 72-hour breach intimation reporting mapping directly to the Rules, 2025. Evaluate your current operational gaps and readiness for the May 2027 deadline at https://www.complydp.com/audit-preview today.