- Home
- Industries
- DPDP for fintech and NBFCs
Industry
DPDP for fintech and NBFCs
Lending, payments and wealth apps collect identity, bank and device data at onboarding and keep using it for years. DPDP asks you to know why you hold each item, prove the basis, and act fast when it leaks.
Short answer
Fintechs and NBFCs are Data Fiduciaries for the customer data they decide to process, so notice (Rule 3), consent or a legitimate use (s.6, s.7), security safeguards (Rule 6) and breach intimation (Rule 7) apply from 13 May 2027. KYC records that another law requires you to keep may be kept for that purpose (s.8(7)), not reused freely. Check your regulator's directions alongside DPDP; CERT-In's 6-hour reporting of specified cyber incidents is a separate duty from Rule 7.
Where personal data sits in fintech and NBFCs
Personal data enters at onboarding and spreads to every team and partner after it. A typical lending, payments or wealth stack holds:
- KYC and onboarding: Aadhaar numbers or Virtual IDs, PAN, photographs, address proofs and video KYC recordings, often captured through a KYC vendor.
- Bank and payment data: account numbers with IFSC, UPI IDs, mandates, and bank statements uploaded for underwriting.
- Underwriting: credit bureau reports, income documents, and the scores and decisions your models produce.
- Device data: location, contacts and other permissions the app requests, and what third-party SDKs inside the app collect.
- Servicing and collections: call recordings, support tickets, repayment reminders and field visit notes from collection partners.
- Partners: data shared with a co-lending bank or NBFC, payment partners, collection agencies and marketing platforms.
Copies multiply in exports, support tools and analysts' laptops. Those copies are personal data too, and they are the easiest to miss.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Notice before consent | s.5, Rule 3 | An itemised list of data and purposes at onboarding, with links to withdraw consent, use rights and complain to the Board. Not only a link to a long policy. |
| Consent limited to what is necessary | s.6 | Each data item and app permission must be necessary for a specified purpose. Keep cross-sell and marketing as separate, optional consents. |
| Withdrawal as easy as giving | s.6(4), s.6(6) | A customer who withdraws marketing consent can do it in the app as easily as she gave it, and your processors stop within a reasonable time. |
| Legitimate uses | s.7(d), s.7(e) | Where a law obliges you to disclose to the State, or a court order applies, record the specific ground. Have counsel confirm it. |
| Erasure and retention | s.8(7), Rule 8(3) | Erase when the purpose ends, unless a law requires retention. Records you must keep stay for that purpose only. Processing logs are kept for at least one year. |
| Security safeguards | s.8(5), Rule 6 | Masking or virtual tokens for Aadhaar, PAN and account data, access control, logs reviewed and kept for a year, and security terms in processor contracts. |
| Breach intimation | s.8(6), Rule 7 | Tell affected customers and the Board without delay, and give the Board a detailed report within 72 hours. |
Roles: fiduciary or processor
You are the Data Fiduciary for customers you onboard and decide to process data about. Your KYC vendor, cloud host, messaging provider and collection agency usually act as Data Processors on your behalf. You need a valid contract with each (s.8(2)), and you stay responsible for what they do (s.8).
Co-lending and partnerships are harder. Where two lenders each decide why and how they use a borrower's data, each may be a fiduciary for its own processing. Write down who decides what, settle it with counsel, and use our processor contracts guide for the clauses to cover.
DPDP sits alongside financial sector rules, not in place of them. Check your regulator's directions alongside DPDP. CERT-In's directions of 28 April 2022 under s.70B of the IT Act require reporting specified cyber incidents to CERT-In within 6 hours; that is a separate duty from Rule 7.
A 90-day starting plan
- 01Days 1 to 30: map the data
Scan databases, buckets and shared drives for Aadhaar, PAN, account and UPI data. List every partner that receives customer data and the contract you hold with each.
- 02Days 31 to 60: fix notices and consent
Rewrite the onboarding notice to Rule 3. Split mandatory processing from optional marketing and cross-sell consent, and add withdrawal in the app. Plan the s.5(2) notice to existing customers.
- 03Days 61 to 90: prepare to respond
Run a breach drill against Rule 7 timings alongside your CERT-In process. Set retention rules per data category. Publish the Rule 9 contact and your grievance response period.
How TruePrivacy helps
- Data discovery scans PostgreSQL, MySQL, MongoDB, Amazon S3 and other sources, and classification detects Aadhaar numbers and Virtual IDs, PAN, IFSC, UPI IDs and Indian mobile numbers. Samples are masked before they leave the source.
- Consent management keeps a record per customer and purpose, with an event log of every grant and withdrawal and SDKs for iOS, Android and React Native apps.
- Breach management runs clocks for the Board's intimation, the 72-hour detailed report and each affected customer. It does not run a CERT-In track; keep that process separate.
- Vendors and processors tracks contracts and sends assessments, including a question template asking processors to report breaches without delay.
- Retention applies rules per data category or system and logs every execution as evidence.
Is a fintech or NBFC a Significant Data Fiduciary?
Not automatically. The Central Government notifies SDFs on s.10 factors such as the volume and sensitivity of data and the risk to Data Principals' rights. No SDF has been designated that we know of.
Does DPDP replace RBI rules for NBFCs?
No. DPDP applies alongside sector rules, so check your regulator's directions alongside DPDP. Where another law requires you to keep records, s.8(7) allows that retention.
Is CERT-In reporting the same as Rule 7?
No. CERT-In's directions require reporting specified cyber incidents to CERT-In within 6 hours. Rule 7 requires intimating the Board and affected customers without delay, and a detailed report to the Board within 72 hours.
Can we keep KYC data after a customer closes the account?
Only where a law requires you to keep it, and only for that purpose (s.8(7)). Data no law requires you to keep should be erased once the purpose is served, and your processors must erase it too.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin