DPDP Act for fintech: how it sits with RBI rules
For lenders, NBFCs, payment companies and wealth apps: how the DPDP Act layers on top of sector regulation, what it means for KYC data and credit decisions, and how far your duty reaches down a vendor chain.
Last updated 22 October 2026
How does the DPDP Act apply to fintech companies?
A fintech is a Data Fiduciary for its customers’ personal data. The DPDP Act applies in addition to RBI and other sector rules, not instead of them. KYC still needs a notice, data a law requires you to keep stays until that period ends, and the fintech answers for every vendor in its processing chain.
Where the DPDP Compliance Suite is today
The Perimattic DPDP Compliance Suite is in development. It is not yet live or for sale, and the features on this page are planned, not shipped.
Sign upHow does the DPDP Act interact with RBI regulation?
Section 38 of the DPDP Act, 2023 settles the relationship in two lines. The Act applies in addition to, and not in derogation of, any other law in force (section 38(1)). Where a DPDP provision conflicts with a provision of another law, the DPDP provision prevails to the extent of that conflict (section 38(2)).
For a regulated fintech that means a second layer, not a replacement. KYC, record-keeping, outsourcing, fraud reporting and data storage rules from your sector regulator keep applying. The DPDP Act adds consent, notice, rights, breach and erasure duties on top, from 13 May 2027, when sections 3 to 17 and 28 to 34 come into force (G.S.R. 843(E)). Section 38 itself has applied since 13 November 2025. Two provisions show the Act deferring to other law directly:
- Cross-border transfers. The government may restrict transfers to notified countries (section 16(1)), and section 16(2) preserves any other law that provides a higher degree of protection for, or restriction on, transfers of personal data outside India. Sector rules on where data must be stored are not loosened by the DPDP Act.
- Retention. Erasure duties give way where retention is necessary for compliance with law (sections 8(7) and 12(3)), and consent withdrawal does not stop processing that a law requires or authorises (section 6(6)).
What does the DPDP Act mean for KYC and credit data?
The Act’s own illustration to section 5 is a bank account opened on an app with a live, video-based customer identification process: the bank must accompany or precede the request for data with a notice describing the personal data and the purpose. KYC is therefore not outside the Act. Collect only what the KYC purpose needs, say so in the notice, and keep KYC data out of marketing.
| Data you hold | DPDP duty | Section or rule |
|---|---|---|
| KYC documents and video-KYC recordings | Notice describing the data and purpose; keep for the legally required period, then erase | Sections 5, 8(7); Rule 3 |
| Bureau pulls and underwriting inputs | Keep data complete, accurate and consistent when it drives a decision about the customer | Section 8(3) |
| Transaction and repayment history | Reasonable security safeguards, including encryption or tokenisation and access logs | Section 8(5); Rule 6 |
| Account aggregator and partner data | Consent limited to the stated purpose; customer can see who it was shared with | Sections 6(1), 11(1)(b) |
| Collections on defaulted loans | Exempt from most Chapter II and III duties when ascertaining a defaulter’s finances, subject to disclosure law | Section 17(1)(f) |
| Statutory disclosures to regulators or courts | Legitimate use: legal obligation to disclose to the State, or a court order | Section 7(d), 7(e) |
Legitimate uses are narrower than many expect. Section 7 does not contain a general “legal obligation” ground for any processing a fintech finds useful: clause (d) covers fulfilling an obligation under law to disclose information to the State, and clause (e) covers complying with a judgment, decree or order. Most customer-facing processing still rests on consent with a notice. Section 17(1)(c) separately exempts processing in the interest of preventing, detecting, investigating or prosecuting any offence from most duties, though security safeguards under section 8(5) still apply.
Could a fintech be a Significant Data Fiduciary, and who answers for vendors?
Significant Data Fiduciary factors
Section 10(1) lets the Central Government notify any Data Fiduciary or class as a Significant Data Fiduciary after assessing relevant factors, including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order. Large lenders and payment platforms process high volumes of financial data, so it is prudent to plan for the possibility. A notified fintech must:
- appoint a Data Protection Officer based in India and responsible to its board (section 10(2)(a));
- appoint an independent data auditor (section 10(2)(b));
- carry out a Data Protection Impact Assessment and an audit every twelve months and send the Board a report of significant observations (Rule 13(1) and (2));
- verify that algorithmic software it uses is not likely to pose a risk to Data Principals’ rights (Rule 13(3)); and
- keep any personal data the government specifies, and its traffic data, within India (Rule 13(4)).
Vendor and processor chains
Fintech stacks run through KYC vendors, cloud hosts, lending service providers, collection agencies, messaging gateways and analytics tools. Section 8(1) makes the fintech responsible for processing done on its behalf by a Data Processor, irrespective of any agreement to the contrary. Each processor needs a valid contract (section 8(2)) with security safeguards (Rule 6(1)(f)). When consent is withdrawn the fintech must make its processors stop (section 6(6)), and when data must be erased it must make them erase it too (section 8(7)(b)). Customers can ask for the identities of every Data Fiduciary and Data Processor their data was shared with (section 11(1)(b)), so the register has to be accurate.
What does a fintech owe after a data breach?
Rule 7 of the DPDP Rules, 2025 applies from 13 May 2027 and runs alongside any reporting your sector regulator requires.
| Duty | Timing | Source |
|---|---|---|
| Tell each affected customer: what happened, likely consequences, your mitigation, steps she can take, a contact | Without delay | Rule 7(1) |
| Initial intimation to the Data Protection Board | Without delay | Rule 7(2)(a) |
| Detailed report to the Board, including causes, findings on who caused it and the customer intimations | Within 72 hours, or longer if the Board allows on written request | Rule 7(2)(b) |
| Penalty ceiling for failing to give notice of a breach | May extend to ₹200 crore | Section 33; Schedule item 2 |
| Penalty ceiling for failing to take reasonable security safeguards | May extend to ₹250 crore | Section 33; Schedule item 1 |
A breach at a vendor is still your breach for DPDP purposes, because the safeguards duty in section 8(5) covers processing undertaken on your behalf by a Data Processor. Vendor contracts should require prompt notice to you.
How will the Perimattic DPDP Compliance Suite help fintechs?
For lenders, payment companies and wealth platforms, the planned features most relevant are:
- A personal-data inventory that separates KYC, credit, transaction and marketing data.
- Consent capture and records, with withdrawal as easy as giving consent.
- A rights-request tracker, including disclosures of who data was shared with.
- Retention and erasure schedules that hold data for legally required periods, then erase.
- A breach response workflow for customer intimations and Board reports under Rule 7.
- A processor and vendor register with contract tracking.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. It carries no regulatory approval, and using it will not by itself guarantee compliance. Sign up to tell us how your business handles customer data.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on DPDP compliance
The DPDP Act for fintech, answered
Do RBI rules still apply after the DPDP Act?
Yes. Section 38(1) says the Act is in addition to, and not in derogation of, any other law in force, so RBI directions and other sector rules continue to apply alongside it. Section 38(2) adds that where a provision of the DPDP Act genuinely conflicts with another law, the DPDP provision prevails to the extent of the conflict.
Can a customer make a fintech delete her KYC records?
Not while a law requires them to be kept. Sections 8(7) and 12(3) both carve out retention that is necessary for compliance with any law in force. The Act’s own illustration is a bank that must keep identity records for ten years after an account closes: it keeps them for that period. Once the legal period ends, the data must be erased.
Will a fintech be a Significant Data Fiduciary?
Only if the Central Government notifies it, alone or as part of a class, under section 10. The factors include the volume and sensitivity of the data, the risk to Data Principals, and security of the State. A notified fintech must appoint an India-based Data Protection Officer and an independent data auditor, and under Rule 13 carry out a DPIA and audit every twelve months.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up