Capital Markets and the DPDP Act: An Industry Impact Study

Executive summary

Securities market intermediaries already live with rules on investor data. SEBI's codes of conduct bar disclosure without consent, KYC records travel through KYC registration agencies, brokers and depositories keep records for eight years, and cyber incidents go to SEBI within six hours.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) asks different questions: a lawful ground and a specified purpose for every use of an investor's data, a direct answer to the investor, and responsibility for everyone the data is passed to.

Headline impact rating: High. The three biggest changes are:

1. 1.Roles across a crowded chain. One investor's data sits with a broker, a depository participant, a depository, an exchange, a clearing corporation, a KYC registration agency, an asset management company and its registrar. Each must decide, data set by data set, whether it acts for itself or for someone else.
2. 2.Breaches reach the investor. From 13 May 2027 a personal data breach must also go to the Data Protection Board, with a detailed report within 72 hours, and to every affected investor, whether or not the cause was a cyber attack.
3. 3.Accountability for tools and vendors. SEBI's regulations already make an intermediary solely responsible for investor data handled by AI tools. Section 8(1) of the DPDP Act applies the same logic to every processor.

The rulebook has also moved: new regulations for registrars (December 2025), stock brokers (January 2026) and mutual funds (April 2026), and simpler nomination rules (September 2026).

This study covers stockbrokers, depositories and their participants, exchanges, clearing corporations, registrars and transfer agents (RTAs), mutual funds and their asset management companies (AMCs), advisers, research analysts and portfolio managers. Trayambic's fintech and banking studies cover wealth-tech apps and banks.

Background

Who the data principals are

The DPDP Act calls the individual whose data is processed the data principal. The organisation that decides why and how data is processed, alone or with others, is the data fiduciary; one that processes data on a fiduciary's behalf is a data processor.

Here they include investors, unitholders and shareholders, including joint holders; nominees, who may be minors; legal heirs; signatories and beneficial owners of non-individual clients; prospects who abandon onboarding; and individual employees, authorised persons and distributors.

What data flows where

The core data set is identity documents, PAN, Aadhaar-based verification results, verification videos, bank details, income range, risk profiles, order logs, recorded order calls, holdings and nominee details.

KYC is done once and reused. The onboarding intermediary uploads the record to a KYC registration agency (KRA), and the next intermediary downloads it. KRA systems may connect to the Central KYC Records Registry and, since 20 August 2026, may be accessed by entities regulated by the International Financial Services Centres Authority.

Trades flow from broker to exchange and clearing corporation; holdings move between the depository participant (DP) and the depository. Under the UPI block mechanism, which qualified stock brokers must offer from 1 February 2025, funds stay blocked in the client's bank account until settlement, bringing the bank and UPI into the chain. Fund data runs from distributor to AMC to the RTA the AMC appoints. Around all of this sit platform, cloud, call-recording, e-sign, video-KYC, mailing and support-tool vendors.

Legal framework

The DPDP Act and Rules

• Grounds (sections 4, 6, 7). Consent, or a legitimate use from a closed list. Section 7(a) covers data voluntarily provided for a specified purpose; section 7(d) covers a legal obligation to disclose information to the State, defined by Article 12 of the Constitution (section 2(zb)). There is no "legitimate interests" ground.
• Notice (section 5, Rule 3). An itemised notice with every consent request, and notice to earlier consenters "as soon as it is reasonably practicable" (section 5(2)).
• Fiduciary duties (section 8, Rules 6 and 7). Responsibility for processors "irrespective of any agreement to the contrary"; accurate data where it drives a decision about the investor (section 8(3)); security safeguards with logs kept a year; breach intimation; erasure when the purpose ends unless law requires retention.
• Children (section 9). Verifiable guardian consent for under-18s; no tracking, behavioural monitoring or targeted advertising.
• Significant Data Fiduciaries (section 10, Rule 13). A fiduciary the Centre designates for the volume, sensitivity or risk of its processing (an SDF) needs an India-based Data Protection Officer (DPO), an independent data auditor and an annual impact assessment.
• Rights (sections 11 to 14, Rule 14). Access, including everyone the data was shared with; correction and erasure; grievances answered within 90 days; nomination.
• Offences (section 17(1)(c)). Processing to prevent or detect offences or contraventions is largely exempt, but sections 8(1) and 8(5) still apply.

Sector instruments

• CSCRF (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024). Covers exchanges, depositories and clearing corporations as market infrastructure institutions (MIIs), treats KRAs and qualified RTAs as MIIs, and covers brokers, DPs, AMCs, portfolio managers, non-individual advisers and RTAs with 10,000 or more folios, among others. "Regulatory Data" is to be stored in India, but a circular of 31 December 2024 (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/184) put the localisation standard (PR.DS.S2) in abeyance "until further notification". SEBI's 2023 cloud framework, now a CSCRF annexure, separately says data should reside and be processed in India.
• SEBI circular of 24 August 2026. Restates six-hour email reporting of cyber incidents to SEBI and 24-hour portal reporting, and aligns the portal with the Financial Stability Board's Format for Incident Reporting Exchange (FIRE).
• Stock Brokers Regulations, 2026 (7 January 2026, replacing the 1992 Regulations): records kept at least eight years (reg 16); client details confidential unless law requires disclosure or the client consents in writing (reg 18(4)); cyber security (reg 18(5)); outsourcing (reg 18(8)).
• Depositories and Participants Regulations, 2018: eight-year records (regs 54(3), 66(5)); nomination for death and, since 2 December 2024, for incapacity (reg 60A).
• Registrars to an Issue and Share Transfer Agents Regulations, 2025 (15 December 2025, repealing the 1993 Regulations): eight-year records (reg 18); grievances resolved within 21 calendar days (reg 21); confidentiality, and return of records within a month after an engagement ends (Schedule III).
• Mutual Funds Regulations, 2026 (in force 1 April 2026): AMCs appoint and supervise registered RTAs (reg 22); unitholders may nominate persons to transact on incapacity and to hold units on death as trustee for the legal heirs (reg 27).
• KYC Registration Agency Regulations, 2011: the KRA safeguards records (reg 15(d)), shows an intermediary only clients who approach it (reg 15(l)) and logs every upload, change and download (reg 15(p)); intermediaries may not use KRA data for other purposes or profit by sharing it (reg 16(c)).
• Intermediaries Regulations, 2008: regulation 16C (from 10 February 2025) makes any regulated person using AI or machine learning tools, in-house or bought in, solely responsible for the privacy, security and integrity of investors' data, for the output and for legal compliance. Regulation 16A (from 29 August 2024) bars association, including through client referrals or interaction of IT systems, with unregistered advisers.
• Investment Advisers and Research Analysts Regulations: since 16 December 2024, disclosure of AI use and sole responsibility for client data (IA regs 15(14), 18(9); RA regs 19(vii), 24(7)); advisers keep client communications, including call recordings (IA reg 19(1)(h)); five-year retention (IA reg 19(2); RA reg 25(2)).
• Nomination circular SEBI/HO/OIAE/OIAE_IAD-3/P/CIR/2026/12676 (29 May 2026, in force 1 September 2026), superseding the January 2025 framework.
• Prevention of Money-laundering Act, 2002 (PMLA), section 12, and the 2005 Maintenance of Records Rules: five-year records; KYC records obtained from the Central KYC Records Registry may be used only to verify identity or address (rule 9(1F)).
• SCORES 2.0 (1 April 2024): complaints auto-routed to the intermediary and resolved within 21 calendar days.
• CERT-In Directions, 28 April 2022: six-hour reporting; 180-day logs kept in India.

How the layers fit

Section 38(1) makes the DPDP Act additional to SEBI's regime; section 38(2) makes it prevail in a conflict. Section 16(2) preserves any SEBI restriction on transfers abroad, which matters if the abeyance is lifted. Sections 6(6) and 8(7) let records SEBI or the PMLA requires survive withdrawal of consent. Most SEBI rules add to the Act; the friction lies in nomination, AI accountability, differing retention periods and localisation.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Roles along the trade and the folio

No regulator has published a DPDP role map for the securities market. In Trayambic's view:

• Brokers and DPs are fiduciaries for their client relationships.
• Depositories, exchanges and clearing corporations are fiduciaries for the records they keep under law, such as beneficial ownership records, client codes and trades. Surveillance falls largely within section 17(1)(c), but accountability and security duties remain.
• A KRA is a fiduciary, not any intermediary's processor: its purposes are fixed by regulation and it answers to SEBI. Each intermediary that downloads a record becomes a fiduciary for its copy, limited by regulation 16(c).
• An RTA is usually a processor, for the AMC that appoints and supervises it or the company whose register it keeps. Its own statutory duties do not change that, but the contract must say who answers rights requests and who notifies breaches.
• Authorised persons and distributors act for the broker or AMC when onboarding; a distributor advising its own clients is also a fiduciary for that relationship.
• Platform and AI vendors are processors unless they reuse investor data, for example to train general models; they then need their own ground, and regulation 16C still holds the intermediary responsible.

Calling the KRA a processor leaves no one giving investors proper notice about central KYC reuse; calling every RTA a fiduciary produces duplicate notices. The map should drive each notice, the section 8(2) contracts and the recipient list an investor receives under section 11.

Breaches that start in the mailroom

Intermediaries send contract notes, statements, capital gains reports and tax certificates in very large volumes, so many breaches here will not be attacks. A mail-merge error that sends statements to the wrong addresses is a personal data breach. From 13 May 2027 it needs notice to the Board without delay, a detailed report within 72 hours, and notice to each affected investor explaining what happened and what she can do. Cyber incidents also keep their SEBI clocks (six hours by email, 24 hours on the portal) and CERT-In's six hours.

The FIRE-aligned SEBI portal takes reports in stages, mirroring the DPDP Rules' initial intimation and later detailed report, so one incident record can feed both.

Two sector triggers need attention. Where an RTA errs, the AMC or issuer must notify, so the RTA contract should require prompt alerts and help with notices. And staff who download the KRA record of someone who never approached the firm breach regulation 15(l); under the DPDP Act that is unauthorised access, a breach in its own right.

AI tools: SEBI got there first

Regulation 16C already settles who answers when an AI tool mishandles investor data: the regulated entity. The DPDP Act adds three things.

• Purpose. Data collected for KYC or execution cannot simply feed a cross-selling model or a vendor's general model. Each new use needs a ground, usually consent.
• Accuracy. Section 8(3) applies to AI-driven risk profiling, suitability checks and alerts that restrict an account, because each is a decision affecting the investor.
• Transparency. An access request under section 11 must name any AI vendor that received the investor's data.

SEBI's AI and ML reporting circulars of 4 January 2019 (brokers and DPs) and 9 May 2019 (mutual funds) already require intermediaries to report their AI systems. Extend that inventory with the data fields each system uses, its ground, vendor, location and retention. Trayambic's article on AI training covers model-training questions in more detail.

Nomination: one word, two rights

SEBI nomination decides who receives securities or units on death and, under regulation 60A for demat accounts and regulation 27 for fund units, who may transact if the investor is incapacitated. The May 2026 circular allows up to three nominees, makes only name and relationship mandatory (plus date of birth for a minor), makes contact details and identity documents optional, permits opt-out, and requires half-yearly reminders to investors without a nominee.

Section 14 of the DPDP Act is different. A DPDP nominee exercises the investor's data rights if she dies or is incapacitated, meaning unsoundness of mind or infirmity of body. Rule 14(4) lets the investor nominate one or more individuals through the means the fiduciary publishes.

Consequences:

1. 1.A securities nominee is not automatically a DPDP nominee. Offer DPDP nomination in the same journey, as a separate choice.
2. 2.Expect requests from the wrong nominee. A SEBI incapacity nominee asking for the investor's data may lack standing unless also nominated under section 14.
3. 3.Nominee details are the nominee's personal data. SEBI's move to optional identifiers is a minimisation win; collect them only where they serve a purpose.
4. 4.Minor nominees are children. Keep their details out of marketing and analytics.

Worked example: a broker's AI support assistant

A mid-size broker and DP licenses an AI assistant that reads each client's ledger and holdings to answer service queries. The vendor runs it on servers outside India and keeps full transcripts "for quality". A misconfigured storage bucket exposes months of transcripts with names, client codes, PANs and holdings. The vendor tells the broker four days later.

• SEBI. The broker reports to SEBI by email within six hours and on the portal within 24 hours, and to CERT-In within six hours. Regulation 16C makes it solely responsible.
• DPDP Act, from 13 May 2027. The broker informs the Board without delay, reports in detail within 72 hours and warns each affected client, for example about calls impersonating the broker.
• The contract. The vendor is a processor and needs a section 8(2) contract. A four-day delay shows the contract lacked a short reporting deadline, and indefinite transcript retention cannot be justified under section 8(7).
• Hosting abroad. No country is restricted under section 16(1), and CSCRF localisation is in abeyance. But the cloud framework's India-residency principle, and any reinstated localisation rule, apply through section 16(2); the broker should have checked before going live.
• Afterwards. Section 11 answers must name the vendor.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Appoint a DPO with board access. Complete the role map and inventory, starting with onboarding, KRA flows and statement dispatch, and list every vendor and AI tool receiving investor data. Track consent manager registrations from 13 November 2026.

January to March 2027. Rebuild journeys with itemised notices and separable consents. Merge incident playbooks and rehearse a misdirected statement batch and a vendor breach. Keep security logs for at least a year (Rule 6).

April to May 2027. Sign amended contracts. Launch the existing-investor notice campaign. Switch on DPDP nomination and rights workflows, testing the 90-day grievance limit alongside SCORES handling.

Ongoing. Watch for the end of the localisation abeyance, SDF designations and SEBI's July 2026 review of the Portfolio Managers Regulations. Re-test breach plans every six months.

Recommendations

1. 1.Write the role map first. Every notice, contract and access answer depends on it.
2. 2.Treat a KRA download as a privileged act. Log it, restrict it, and treat misuse as a breach.
3. 3.Plan for the mailroom breach. Template the investor notice for misdirected documents now.
4. 4.Make regulation 16C operational. Bind AI vendors to no reuse, short retention and fast reporting.
5. 5.Keep the two nominations apart, and collect less nominee data.
6. 6.Prepare as if designated. MIIs, KRAs and the largest intermediaries should build SDF capability now.

Key takeaways

• The DPDP Act's impact on SEBI-regulated entities is High: brokers, DPs, depositories, KRAs, AMCs and RTAs must each settle whether they act as fiduciary or processor.
• Breaches, including misdirected statements and contract notes, must go to the Data Protection Board and every affected investor, on top of SEBI's six-hour email and 24-hour portal reports.
• SEBI's regulation 16C already makes intermediaries solely responsible for investor data handled by AI tools; the DPDP Act adds purpose limits, accuracy duties and vendor transparency.
• SEBI nomination and DPDP nomination are different rights; a securities nominee does not automatically inherit the investor's data rights.
• CSCRF data localisation is in abeyance, but SEBI's cloud framework still points to India and section 16(2) would preserve any reinstated rule.