- Home
- Industries
- DPDP for banks
Industry
DPDP for banks
Banks hold years of customer data across core systems, branches, cards, apps and partners. DPDP asks them to find it, ground it in a lawful basis, and answer for it quickly.
Short answer
Banks are Data Fiduciaries for customer data, with notice, security, breach, retention and rights duties beginning 13 May 2027 (Rule 3, Rule 6, Rule 7, Rule 14). The Central Government notifies Significant Data Fiduciaries on s.10 factors such as the volume and sensitivity of data; none has been designated that we know of. Check your regulator's directions alongside DPDP, and keep CERT-In's 6-hour reporting of specified cyber incidents separate from Rule 7.
Where personal data sits in a bank
- Core and legacy systems: customer master, KYC, account and transaction history, often spread across older platforms.
- Branches: account opening forms, signature records, scanned documents and CCTV.
- Cards and digital channels: card data, net banking and mobile app logs, and UPI IDs.
- Lending: loan files, collateral documents, credit bureau reports and collection records.
- Partners: co-branded card partners, business correspondents, collection agencies and fintech partners.
- Contact centres: call recordings and complaint records.
- Employee devices and shared drives: exports, MIS reports and spreadsheets.
Legacy data is the hard part. Older systems often hold records of closed accounts and former customers, and nobody owns the question of whether a purpose still exists. s.8(7) makes that question someone's job: erase when the purpose is no longer served, unless a law requires retention.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Know where data is | s.8(4), Rule 6 | You cannot safeguard or erase what you have not found. Legacy systems and shadow copies are the usual gap. |
| Notice to existing customers | s.5(2) | Customers whose consent was taken before commencement get a notice as soon as reasonably practicable. |
| Consent for cross-sell | s.6 | Marketing insurance, investments or partner products needs specific, freely given consent, separate from opening an account. |
| Security safeguards | s.8(5), Rule 6 | Masking or virtual tokens, access control, logs reviewed and kept a year, backups and continuity, and security terms in processor contracts. |
| Breach intimation | Rule 7 | Intimate affected customers and the Board without delay, and give the Board a detailed report within 72 hours. |
| Grievance at scale | s.13, Rule 14(3) | Publish a grievance response period of no more than 90 days. Customers must use your process before going to the Board (s.13(3)). |
| SDF duties, if notified | s.10, Rule 13 | An India-based DPO, an independent data auditor, a yearly DPIA and audit, and algorithmic due diligence. |
Roles: fiduciary or processor
The bank is the fiduciary for its customers. Business correspondents, collection agencies, card processors and IT vendors acting for it are usually processors that need valid contracts (s.8(2)), and the bank answers for what they do (s.8).
Co-branded and partnership products need clear roles. Where a partner uses customer data for its own purposes, it is a fiduciary for that use, and the customer should be told.
Check your regulator's directions alongside DPDP. CERT-In's directions of 28 April 2022 under s.70B of the IT Act require reporting specified cyber incidents within 6 hours, separately from Rule 7. Significant Data Fiduciaries are notified by the Central Government; prepare, but do not assume.
A 90-day starting plan
- 01Days 1 to 30: discovery across the estate
Connect databases and cloud stores, enrol employee devices, and find KYC and account data that sits outside core systems.
- 02Days 31 to 60: notice and consent
Draft the s.5(2) notice to existing customers, separate cross-sell consent, and make withdrawal as easy as giving consent.
- 03Days 61 to 90: response at scale
Set up request intake across branches and digital channels, publish the grievance period, run a Rule 7 drill alongside the CERT-In process, and open an SDF readiness file.
How TruePrivacy helps
- Data discovery connects databases, cloud stores and SaaS tools; the DSPM endpoint agent scans enrolled devices; and data security posture shows who can reach each store.
- Notice campaigns send the s.5(2) notice and re-consent requests to existing customers by email.
- Grievance redressal runs categories, SLA states and escalation against the 90-day limit, alongside Data Principal requests with identity verification.
- The SDF workspace records a designation once notified, with the DPO, the independent data auditor and yearly clocks for the DPIA, data audit and algorithmic due diligence.
- Multiple brands and workspaces, SSO and MFA, and an API with webhooks fit a bank's existing systems.
Are banks Significant Data Fiduciaries?
Only if the Central Government notifies them under s.10, on factors such as the volume and sensitivity of data and the risk to Data Principals' rights. None has been designated that we know of.
Do customers have to complain to the bank first?
Yes. Under s.13(3), a Data Principal must exhaust the fiduciary's grievance redressal before approaching the Board.
Does DPDP replace our sector rules?
No. It applies alongside them, so check your regulator's directions alongside DPDP. Where another law requires you to keep data, s.8(7) allows that.
Do we need to notify existing customers?
Yes. Where consent was given before commencement, s.5(2) requires a notice as soon as reasonably practicable.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin