Industry
DPDP priorities for fintech and NBFCs
Five DPDP priorities for lenders, payment companies and NBFCs, each tied to a section or rule, with sector rules kept separate.
Short answer
A fintech company or NBFC that decides why and how personal data is processed is a Data Fiduciary under the DPDP Act (s.2), with core obligations from 13 May 2027. The priorities are onboarding notices and consent (s.5, s.6, Rule 3), processor contracts (s.8(2), Rule 6), breach intimation (Rule 7), retention and erasure (s.8(7), Rule 8) and grievances (Rule 14(3)). Sector regulators may have their own rules, so check your regulator's directions alongside DPDP.
Onboarding: notices and consent
Every consent request needs a notice (s.5). Rule 3 asks for an itemised description of the personal data and each specified purpose, and links to withdraw consent, exercise rights and complain to the Board.
Consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and limited to the data the purpose needs (s.6). Not every purpose needs consent: s.4 also allows the legitimate uses listed in s.7. Map each onboarding purpose to one ground, with counsel.
The notice must be readable in English or any Eighth Schedule language (s.5(3)). For customers whose data you collected before commencement, give notice as soon as reasonably practicable (s.5(2)).
Processors and partners
You are responsible for processing done on your behalf (s.8), and may use a Data Processor only under a valid contract (s.8(2)). Rule 6 lists security terms in contracts with Data Processors among the reasonable security safeguards.
The other Rule 6 safeguards are a useful checklist for vendors too: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review; and backups and continuity.
List every vendor that receives customer data and record its role. Check each contract for breach reporting, erasure on instruction and log retention. Our processor contracts guide has the detail.
Breach readiness
Rule 7 asks you to intimate each affected Data Principal and the Board without delay, and to give the Board a detailed report within 72 hours of becoming aware. Your processors need to tell you quickly so you can meet this. See our Rule 7 post.
CERT-In's directions of 28 April 2022 under s.70B of the IT Act require reporting specified cyber incidents to CERT-In within 6 hours. That is separate from DPDP Rule 7. Sector regulators such as RBI may have their own rules: check your regulator's directions alongside DPDP.
Customer rights and grievances
Customers can ask for a summary of their personal data and its processing, and the identities of other fiduciaries and processors it was shared with (s.11). They can ask for correction, completion, updating and erasure (s.12), and nominate someone to exercise their rights on death or incapacity (s.14).
Publish how to make requests and which identifier is needed (Rule 14). A customer must use your grievance process before approaching the Board (s.13(3)), so give grievances an owner and a published response period.
Retention and governance
| Priority | DPDP source | First step |
|---|---|---|
| Erase when the purpose is served | s.8(7), Rule 8 | Set retention per kind of data, and note where another law requires you to keep data |
| Keep logs for at least one year | Rule 6, Rule 8(3) | Confirm log retention for systems that hold customer data |
| Publish a contact for questions | s.8(9), Rule 9 | Put the contact on your website or app and mention it in every response |
| Grievances | s.8(10), Rule 14(3) | Publish a response period of no more than 90 days and track each case |
| Indian identifiers | Rule 6 | Find where PAN, Aadhaar numbers, IFSC codes and UPI IDs sit, and mask or restrict access |
SDF designation comes only by notification under s.10, and no SDF has been designated that we know of. Do not assume your company is one.
How TruePrivacy helps
Data classification includes India-specific detection rules for Aadhaar number, Aadhaar Virtual ID, PAN, GSTIN, IFSC, UPI ID and Indian mobile numbers, and the scanner masks samples before they leave the source.
Consent management keeps a record per person and purpose with an event log, vendor management tracks processor risk and DPAs, and breach management runs a clock for each audience. TruePrivacy does not run a CERT-In track. See our fintech and NBFC page.
Does DPDP apply to NBFCs?
Yes, where an NBFC processes digital personal data and decides why and how it is processed, it is a Data Fiduciary (s.2, s.3). Core obligations begin on 13 May 2027.
Do sector rules still apply alongside DPDP?
Sector regulators may have their own rules, so check your regulator's directions alongside DPDP, with counsel. For transfers abroad, stricter sectoral laws still apply (s.16(2)).
Is CERT-In reporting the same as DPDP breach intimation?
No. CERT-In's directions of 28 April 2022 require reporting specified cyber incidents within 6 hours. Rule 7 is a separate duty to the Board and affected Data Principals.
Is a fintech a Significant Data Fiduciary?
Only if the Central Government notifies it, or its class, under s.10. No SDF has been designated that we know of.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin