OneConsent and PHDCCI Partner to Advance DPDP Act Readiness

What happened

OneConsent and PHDCCI formed a partnership to assist businesses in India with Digital Personal Data Protection Act compliance. The Tribune India reported the primary goal is to advance DPDPA readiness among Indian businesses. This association is a specific step to help entities evaluate their data compliance posture before regulatory enforcement begins. Trade groups want members to address statutory obligations under the new privacy regime. The DPDP Act requires Data Fiduciaries to operationalize consent management and notice provisions.

Does the DPDP Act apply here?

The DPDP Act, 2023 applies to the processing of digital personal data. Section 1 states the Central Government will appoint specific dates for different provisions to come into force. Fintech enterprises collect customer payment histories and loan application profiles. These entities fall directly within this scope as Data Fiduciaries. The Act regulates personal data rather than anonymised transaction aggregates. A digital lender processes identifiable information from Data Principals in India. The statutory rules for consent and notice apply strictly to those datasets.

Legal implications under DPDP

Section 4 of the DPDP Act, 2023 establishes consent as the primary basis for processing, except where Section 7 legitimate uses apply. Fiduciaries provide clear, itemised notices to Data Principals before they request consent. The Rules, 2025 detail how these notices operate in practice. Fintechs rely on rapid onboarding flows and account-aggregator APIs. These product cycles generate verifiable consent artefacts. They include a withdrawal mechanism that matches the ease of the initial consent grant. Data Principals also hold duties under Section 15 of the Act. They agree to furnish only verifiably authentic information when exercising the right to correction or erasure. A Data Principal agrees not to suppress material information when providing personal data for state-issued documents.

Could this happen to you

Partnerships between industry chambers and compliance entities indicate regulators expect market participants to prepare. The Data Protection Board of India investigates large fintechs and demands a regulator-ready evidence pack. An auditor asks to see the Record of Processing Activities and consent logs for every active digital loan. Product teams push new lending features. If they do not embed these checks, the compliance department cannot produce the required trail. Deficient records expose the enterprise to penalties that reach Rs 250 crore per breach.

What companies should do in the next 30 days

1. The Head of Compliance directs product leads to map all customer data collection points across the lending lifecycle.

2. The compliance department documents the consent architecture to specify where users grant or revoke data access within the application.

3. The legal team audits existing vendor agreements to verify third-party payment processors operate under DPDP-aligned data processing contracts.

4. Data protection officers generate a baseline Record of Processing Activities to link each data category to its specific processing purpose and retention limit.

5. Teams verify the business maintains clear internal mechanisms to process data correction and erasure requests submitted by Data Principals.

What to watch

Trade associations prepare sector-specific guidance for financial services in the coming months. Companies monitor upcoming notifications from the Ministry of Electronics and Information Technology regarding consent manager technical standards. Exactly 193 days remain until the 13 May 2027 deadline. Fintech compliance leaders evaluate current deficits to these requirements using a free assessment at https://www.complydp.com/audit-preview.