Banks and the DPDP Act: An Industry Impact Study

Executive summary

Banks owe customers a duty of secrecy, keep identity records under anti-money-laundering law, report cyber incidents to the RBI within six hours and store payment data in India. That gives them a head start under the Digital Personal Data Protection Act, 2023 (the DPDP Act).

The head start is narrower than it looks. Secrecy rules say when a bank may disclose customer information. The DPDP Act asks on what basis the bank processes each piece of personal data, for which purpose, and for how long. Few banks have answered that element by element.

Headline impact rating: High. The three biggest changes are:

1. 1.Consent has to be rebuilt, not reworded. The RBI already bars cross-selling on account-opening data without express permission. The DPDP Act adds itemised notice, purpose-specific consent, easy withdrawal and a fresh notice to the existing customer book.
2. 2.One incident now has four audiences. The RBI's DAKSH platform and CERT-In already get six-hour reports. A personal data breach must also go to the Data Protection Board, with a detailed report within 72 hours, and to every affected customer. Non-cyber breaches, such as a mis-mailed statement batch, are caught too.
3. 3.Partners become the bank's problem by statute. Business correspondents, agents, recovery agencies, co-branding partners and fintechs all touch customer data, and section 8(1) keeps the bank responsible "irrespective of any agreement to the contrary".

The main obligations commence on 13 May 2027, about seven months away.

Background

Who the data principals are

The DPDP Act calls the individual whose data is processed the data principal, and the organisation that decides why and how it is processed the data fiduciary. A data processor processes data on a fiduciary's behalf. For a bank, the data principals include:

• depositors, borrowers, cardholders and walk-in remitters;
• people linked to an account: joint holders, nominees, guarantors, signatories and beneficial owners of business customers;
• minors, who may hold accounts through a guardian and operate them independently from age ten;
• prospects, including people who abandon a digital onboarding journey;
• employees, contract staff and agents.

What data a bank holds

Identity documents, PAN and Aadhaar-based verification results, photographs and video-KYC recordings, signatures, income details, transaction histories, card data, device and location signals for fraud scoring, call recordings and credit reports. Transaction patterns can also reveal health, religion or political giving.

Where it flows

Much data leaves by legal obligation: to the Central KYC Records Registry, credit information companies, the Financial Intelligence Unit-India, card networks, the National Payments Corporation of India (NPCI) and account aggregators.

The rest leaves through vendors: core banking and card processors, cloud providers, call centres, statement printers, collection agencies, business correspondents, selling agents, analytics firms and fintech partners. Small finance banks and payments banks lean heavily on agents and partnerships, which sharpens the vendor question for them.

Legal framework

The DPDP Act and Rules

The provisions that matter most to banks are:

• Grounds (sections 4, 6, 7). Consent or a legitimate use from the closed list in section 7. There is no "legitimate interests" ground and no general "legal obligation" ground. Section 7(a) covers data voluntarily provided for a specified purpose.
• Notice (section 5, Rule 3). An itemised notice with every consent request. For consents given before commencement, section 5(2) requires notice "as soon as it is reasonably practicable".
• Withdrawal (section 6(4) to (6)). As easy as giving consent. Processing then stops within a reasonable time unless required or authorised by the Act or "any other law for the time being in force in India".
• Fiduciary duties (section 8, Rules 6 and 7). Responsibility for processors, security safeguards including logs kept for a year, breach intimation, and erasure when the purpose ends unless law requires retention.
• Children (section 9, Rule 10). Verifiable guardian consent for anyone under 18; no tracking, behavioural monitoring or targeted advertising directed at children.
• Significant Data Fiduciaries (section 10, Rule 13). An SDF is a fiduciary the Centre designates for the volume, sensitivity or risk of its processing. It needs an India-based Data Protection Officer (DPO), an independent data auditor and an annual impact assessment and audit.
• Rights (sections 11 to 14, Rule 14). Access, correction, erasure, nomination and grievance redressal within 90 days.
• Exemptions (section 17). Section 17(1)(c) covers prevention and detection of offences; 17(1)(f) a loan defaulter's financial position. Sections 8(1) and 8(5) still apply.

Sector instruments

On 28 November 2025 the RBI consolidated its rulebook into entity-wise Master Directions. For commercial banks the key data instruments are:

• RBI (Commercial Banks – Know Your Customer) Directions, 2025 (RBI/DOR/2025-26/169). Para 50: transaction records for five years from the transaction, identification records for five years after the relationship ends. Para 63: secrecy; no cross-selling on account-opening data without express permission; four disclosure exceptions (compulsion of law, duty to the public, the bank's interest, the customer's express or implied consent). Para 27(3): video-KYC data stored in India. Para 65(2): KYC registry upload within ten days.
• RBI (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025 (RBI/DOR/2025-26/171). The bank answers for service providers (para 17); need-to-know access (para 24); storage in India where applicable (para 69(vi)); existing IT contracts compliant by renewal or 10 April 2026.
• RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (31 July 2026). Para 53 makes the bank owner of customer data, including with vendors. Para 182 requires reporting on DAKSH within six hours of detection and proactive notice to CERT-In. Para 230 repeals earlier cyber and IT governance instructions. Small finance banks and payments banks have separate directions of the same date with the same six-hour rule (para 181).

Small finance banks and payments banks fall outside the commercial bank directions and follow their own category instructions.

Other instruments in the stack:

• Statutory secrecy. Section 13 of the Banking Companies (Acquisition and Transfer of Undertakings) Act, 1970 bars nationalised banks from divulging constituents' affairs except as law or banking practice requires, and requires staff declarations of fidelity and secrecy. Section 44 of the State Bank of India Act, 1955 does the same for SBI. Both carve out credit information disclosed under CICRA. Private banks rely on the common-law duty of confidentiality and para 63.
• Credit Information Companies (Regulation) Act, 2005 (CICRA). Membership of credit information companies (s.15), furnishing data (s.17), accuracy and security (s.19), privacy principles (s.20) and correction within 30 days (s.21).
• Prevention of Money-laundering Act, 2002, section 12. Five years from the transaction for transaction records; five years after the relationship ends for identity records.
• RBI storage of payment system data circular, 6 April 2018. Payment data stored only in India.
• RBI (NBFC – Account Aggregator) Directions, 2025. Banks act as financial information providers and users, sharing data on the strength of a consent artefact the customer can revoke.
• Minors' accounts circular, 21 April 2025. Independent operation from age ten; fresh operating instructions on majority.
• Reserve Bank – Integrated Ombudsman Scheme, 2026. In force since 1 July 2026, it replaced the 2021 Scheme. Customers must complain to the bank first and wait 30 days before going to the Ombudsman.
• CERT-In Directions of 28 April 2022. Six-hour reporting and 180-day log retention in India.

How the layers fit

Section 38(1) makes the DPDP Act additional to other laws; section 38(2) makes it prevail in a conflict. Section 16(2) preserves laws that give greater protection or restrict transfers abroad, so RBI India-storage rules survive. Most RBI rules add to the Act. Friction arises where a legal duty requires processing that the closed list of grounds does not obviously cover; sections 6(6) and 8(7) resolve most of it.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Consent: from secrecy to purpose

Para 63 of the KYC Directions says when a bank may divulge information. The DPDP Act starts elsewhere: every purpose needs its own ground, and consent must be "free, specific, informed, unconditional and unambiguous". Three consequences follow.

Bundled account-opening consents will not survive. Forms often combine the account, marketing, group sharing and partner contact. Each is a separate purpose, and the permission para 63(2) already requires must now be separable, itemised and withdrawable.

Section 7(a) covers the core relationship, not everything. KYC documents given to open an account support processing for the account. They do not support transaction analytics to sell a credit card.

Mandatory flows sit awkwardly. Reporting to credit information companies under CICRA, uploading to the KYC registry and keeping PMLA records are legal duties, but the DPDP Act has no general "compliance with law" ground. In Trayambic's view, the safest structure is to describe these flows clearly in the onboarding notice, obtain consent for them as part of the product, and rely on section 6(6) so that a later withdrawal does not stop processing that another law requires. Reporting suspicious transactions also falls within section 17(1)(c). Banks should document this reasoning rather than leave it implicit.

The existing book is the largest task. Section 5(2) means a notice campaign through app, internet banking, SMS and branches, in English or any Eighth Schedule language the customer chooses.

Breach: one incident, four clocks

Banks already report to DAKSH within six hours and notify CERT-In, which has its own six-hour clock. The DPDP Rules add two audiences:

• The Data Protection Board, informed without delay, then sent a detailed report within 72 hours covering facts, causes, mitigation, who caused the breach and the notices sent to individuals.
• Each affected data principal, told without delay what happened, the likely consequences, what the bank is doing and what she can do to protect herself.

First, the trigger is wider. Accidental disclosure or loss of data counts, not only attacks. A mis-sorted statement print run, a spreadsheet emailed to the wrong person or a lost agent device are reportable even if they never reach the cyber desk.

Second, customers are taught to distrust unexpected messages about their account. A breach notice must not look like phishing. Design templates now, use channels customers already trust, and never include links that ask for credentials.

Partners and agents: responsibility without control

The outsourcing directions already make the bank answerable for service providers; section 8(1) adds a statutory penalty. The difficulty is the inventory. Few banks hold one current list of every entity receiving customer data, with purpose, fields and governing contract.

Classification matters too. A statement printer or cloud provider is plainly a processor. A co-branding partner running its own loyalty programme, an insurer selling in the branch, or a fintech running its own app on the bank's accounts may be a separate fiduciary for some data. That decides who gives notice, who answers rights requests and whose name a customer sees when she asks under section 11 who received her data.

Children: accounts that start at ten

The RBI's 21 April 2025 circular lets minors hold accounts through a guardian and operate them independently from an age the bank sets, not below ten, with internet banking and debit cards at the bank's discretion.

Under the DPDP Act every one of these customers is a child. Where a guardian operates the account, verifiable consent is manageable. Where a fifteen-year-old opens an account in an app, the journey needs a guardian step using identity details the bank already holds or a virtual token, as Rule 10 contemplates.

Section 9(3) means pre-approved offers and partner promotions aimed at teen accounts should stop. Fraud monitoring is behavioural by design; banks should document why it is required by law or falls within section 17(1)(c), and keep it apart from marketing analytics.

Worked example: a small finance bank and a lost device

A small finance bank reaches rural customers through branches and several hundred business correspondent agents. Each agent's handheld device captures photographs, Aadhaar-based authentication results and account-opening forms, and syncs overnight.

An agent's device is stolen before it syncs. It holds data on about 60 new customers. It is encrypted, but the PIN is written on a label on the back.

Today the response would focus on RBI and CERT-In reporting, the correspondent contract and a police complaint. From 13 May 2027:

• The bank, not the correspondent company, is the data fiduciary and answers for the breach under section 8(1).
• The incident is a personal data breach because unauthorised access is possible. The bank must inform the Board without delay and file the detailed report within 72 hours.
• Each of the 60 customers must be told without delay in a language and channel they use; for many, a call or branch visit.
• The Board will ask whether safeguards were reasonable. A written-down PIN invites questions about agent training and device controls.
• The correspondent contract should require prompt reporting, device hardening and help with notices. If it does not, the bank carries the gap.

The agent network is part of the security perimeter, and the breach plan must work for customers reached by phone, not app.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Appoint or confirm a DPO with board access. Complete the data inventory, starting with retail and cards. List every partner that receives customer data. Decide the consent architecture for new journeys. Track the consent manager regime, which starts on 13 November 2026.

January to March 2027. Rebuild onboarding and product journeys with itemised notice and separable consents. Add the guardian step for minors. Merge breach playbooks and run a joint tabletop exercise covering a non-cyber breach and an agent-network breach. Begin contract amendments, prioritising business correspondents, recovery agencies and fintech partners.

April to May 2027. Launch the existing-customer notice campaign. Switch on the rights workflow and test the 90-day grievance timeline. Finalise the retention schedule and run the first deletion cycle for leads and abandoned applications.

Ongoing. Review consents when products change. Re-test breach plans every six months. Monitor SDF designations and any RBI guidance on aligning its directions with the Act.

Recommendations

1. 1.Treat secrecy and data protection as separate questions. Keep the para 63 disclosure tests, and add a record of the ground and purpose for each processing activity.
2. 2.Write down the legal-duty reasoning for bureau reporting, KYC registry uploads and PMLA records, showing how consent, section 6(6) and section 8(7) fit together.
3. 3.Start with the agent network. Fix correspondent and agent devices, training and contracts first.
4. 4.Design breach notices customers will believe, and test them with real customers.
5. 5.Flag every under-18 account so marketing, analytics and partner sharing switch off automatically.
6. 6.Prepare as if designated. Large banks should build SDF impact assessment and audit capability now.
7. 7.Use account aggregator discipline as a model. The consent artefact already records purpose, recipients and expiry; apply it to the bank's own consents.

Trayambic's article on digital lending apps covers the RBI lending and recovery rules, including the loan-defaulter exemption, in more detail.

Key takeaways

• Banking's DPDP impact is High: secrecy rules govern disclosure, but the Act demands a lawful ground and purpose for every use of customer data.
• Every customer who consented before commencement needs a fresh notice under section 5(2), which for banks means a book-wide campaign.
• A single incident can now require reports to the RBI (DAKSH, six hours), CERT-In, the Data Protection Board (72-hour report) and each affected customer.
• Minors aged ten and above can operate accounts, but the Act treats every under-18 as a child needing verifiable guardian consent and no targeted offers.
• Business correspondents, agents and fintech partners are the bank's statutory responsibility under section 8(1); contracts and devices need work before May 2027.