By the VD Hosts team 4 min read
The Digital Personal Data Protection Act, 2023 ("DPDP Act") is India's first comprehensive data protection law. Together with the DPDP Rules notified in November 2025, it sets out how organisations, called Data Fiduciaries, may process the digital personal data of individuals, called Data Principals. For banks, NBFCs and insurers, which hold large volumes of sensitive customer data and already work under sector regulators, the Act adds a new layer of obligations rather than replacing existing ones.
This article focuses on what the Act means in practice for technology and operations. It is not legal advice; work with your legal and compliance teams on interpretation, and check the official texts published by the Ministry of Electronics and Information Technology (MeitY).
The core obligations, in plain terms
1. Notice and consent
Where processing relies on consent, the consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data necessary for the stated purpose. It must be preceded by a notice that explains what data is collected and why, how to withdraw consent, and how to complain. Withdrawing consent must be as easy as giving it.
The Act also recognises certain legitimate uses where consent is not required, such as where data is processed to comply with a law, or where an individual voluntarily provides data for a specified purpose. Financial institutions should map which processing relies on consent and which on a legitimate use, because the obligations differ.
2. Purpose limitation and retention
Personal data must be erased once the purpose is served and consent is withdrawn, unless retention is required by law. For financial institutions, sector rules on record-keeping, such as RBI KYC requirements, continue to require retention for defined periods. The practical task is to document a retention schedule that reconciles both.
3. Security safeguards
Data Fiduciaries must take reasonable security safeguards to prevent personal data breaches. The DPDP Rules describe minimum measures such as encryption or masking, access control, logging and monitoring, and the ability to detect and respond to breaches, and expect them to be reflected in contracts with processors.
4. Breach notification
In the event of a personal data breach, the Data Fiduciary must inform the Data Protection Board of India and each affected Data Principal, in the form and within the time the Rules prescribe, including a more detailed report to the Board after the initial intimation. This sits alongside the six-hour reporting duty to CERT-In and any sector-regulator reporting. See our CERT-In incident reporting checklist.
5. Data Principal rights
Individuals can request information about the processing of their data, correction, completion, updating and erasure, grievance redressal, and can nominate someone to exercise their rights in case of death or incapacity. Requests need a channel, an identity check, a workflow and response deadlines.
6. Children's data
Processing personal data of children (under 18) requires verifiable consent of a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are restricted.
7. Significant Data Fiduciaries
The government may notify certain organisations as Significant Data Fiduciaries based on factors such as the volume and sensitivity of data. They must appoint a Data Protection Officer based in India, conduct periodic Data Protection Impact Assessments and independent data audits, and meet other obligations.
What this means for technology teams
| Obligation | Technology and process work |
|---|---|
| Notice and consent | Versioned notices; consent captured with timestamp, version and purpose; withdrawal flows in apps and portals |
| Purpose and retention | Data inventory by purpose; retention schedule; automated deletion or anonymisation jobs; legal holds |
| Security safeguards | Encryption, masking in non-production environments, least-privilege access, logging, regular security testing |
| Breach response | Detection and escalation; one playbook covering the Board, CERT-In and sector regulators; notification templates |
| Data Principal rights | Request intake, identity verification, search across systems, response tracking |
| Processors | Data processing agreements, vendor assessments, sub-processor lists |
Common gaps we see
- Copies of production data in test environments, often unmasked and accessible to many people.
- No reliable data inventory, which makes erasure and access requests slow and incomplete.
- Consent recorded without a version, so it cannot be shown what the customer agreed to.
- Vendors without data processing terms, especially marketing, analytics and messaging tools.
A sensible order of work
- Build a data inventory: what personal data you hold, where, why and for how long.
- Reconcile retention with sector requirements and write it down.
- Fix the highest-risk security gaps, starting with test data and privileged access.
- Update notices and consent capture in customer journeys.
- Prepare the breach and rights-request workflows, and test them.
VD Hosts helps financial institutions with the technical side of this work: data protection controls, compliance programmes, secure changes to customer journeys, and security testing. Legal interpretation stays with your counsel; we make the controls work and help you evidence them.
Common questions
Does the DPDP Act override RBI rules on keeping customer records?
What are the penalties under the DPDP Act?
Is every bank a Significant Data Fiduciary?
When do the obligations apply?
This article is general information, not legal or regulatory advice. Check the current official texts and take professional advice for your situation. See our Website Disclaimer.
