Banking, Financial Services, and Insurance (BFSI) institutions and fintech firms in India handle substantial volumes of sensitive financial data. Financial fiduciaries must navigate the intersection of the DPDP Act 2023, the DPDP Rules 2025, and sector-specific circulars issued by the Reserve Bank of India (RBI), SEBI, and IRDAI.
1. The DPDP & Sectoral Regulator Dynamic
Section 38 of the DPDP Act clarifies that the Act is in addition to, and not in derogation of, any other law for the time being in force. Therefore, if the RBI mandates a stricter compliance threshold (such as the RBI Local Payments Data Storage Directive), the financial entity must comply with both.
2. Core Compliance Obligations for BFSI Entities
- Mandatory Significant Data Fiduciary (SDF) Status: Scheduled commercial banks, major NBFCs, and payment system operators are prime candidates for designation as SDFs under Section 10.
- Alignment with Account Aggregators: The statutory Consent Manager framework under Rule 4 closely mirrors the RBI's NBFC-Account Aggregator (AA) architecture. Fintechs should leverage Account Aggregator rails for verified consent.
- Credit Underwriting & Consent Withdrawal: While Data Principals have the right to withdraw consent, Section 8(7) permits banks to retain transaction records required under the Prevention of Money Laundering Act (PMLA) for statutory minimum periods (typically 5 to 10 years).
- 72-Hour Breach Reporting vs. 6-Hour CERT-In Mandate: Fintechs must maintain dual incident response channels—reporting to CERT-In within 6 hours and reporting comprehensive data protection impact to the DPBI within 72 hours.