DPDP Rules: What Changes for Financial Institutions & What’s Next

• Dushyant Sharma
• 14 Nov 2026
• 75 Views

On 13 November 2026, the Digital Personal Data Protection (DPDP) framework reached a major rollout milestone as the registration of Consent Managers commenced. However, this date does not signify the start of full compliance requirements for businesses under the law. 

Key obligations pertaining consent management, data security, customer rights and breach reporting will be enforced on 13 May 2027. For banks, insurers and NBFCs, this six month transition period will be extremely crucial for reviewing practices pertaining to collection, processing, storage and sharing of customer information. 

According to CNBC TV18, Krishna Chaitanya B, Chief Product Officer at Perfios, stated, “Consent becomes an operational control, not just a legal formality. Banks, insurers and NBFCs will need to rethink how they capture, document, manage and demonstrate customer consent across digital and physical channels.”

Customer Consent and Data Collection under DPDP Framework

Under the DPDP framework, financial institutions will be required to make their data collection practices more specific to their purposes. They need to differentiate between information necessary for regulatory compliance and data collected for commercial activities, such as marketing and cross-selling. For example, KYC (Know Your Customer) requirements under Prevention of Money Laundering Act and RBI regulations do not automatically allow institutions to reuse customer information for purposes that are completely unrelated. 

Furthermore, institutions must ensure that information collected by them for credit assessments is actually relevant to that purpose. This is particularly important as many lenders increasingly rely on bank statements, transaction histories, credit bureau information and alternative data so as to evaluate borrowers. 

Chaitanya noted that lenders would need to establish a lawful basis for processing different categories of personal data, limit access to that data and prevent its unrelated reuse, including for marketing and profiling purposes. 

Data Storage and Third-Party Sharing

Another requirement for financial institutions under the DPDP framework is to review their data retention policies and identify what customer information they retain, where such information gets stored, why it is held and when it should be wiped out.

This includes information across the following:

• Legacy databases, 

• Unsuccessful loan applications,

• Closed accounts, 

• Cloud systems,

• Outsourced Platforms.

Another core area that requires serious attention is third-party data sharing. Customer information is routinely shared by banks, insurance companies and NBFCs with fintech companies, analytics firms, collection agencies, credit bureaus and cloud providers.

Personal Data Security and Breach Response Mechanism

The framework also makes it compulsory for organizations to strengthen their personal data security and breach response systems. It is necessary to mention that personal data breach is not limited to incidents that involve the theft or extraction of information. According to a briefing given by K7 CyberSecurity, ransomware attacks can trigger breach-reporting requirements if they lead to a significant loss of access to personal data even in the absence of data theft evidence.

Under DPDP Rules, Data Fiduciaries must promptly notify affected individuals and submit a detailed report to Data Protection Board of India within 72 hours of becoming aware of a personal data breach unless they are granted an extension.

The briefing also emphasizes importance of timely communication by third-party processors. The reporting timeline begins from when Data Fiduciary is made aware regarding breach. Timely coordination is crucial for financial institutions to communicate effectively with their technology vendors for proper incident assessment and reporting.

The law stipulates penalties of up to Rs. 250 crore for failing to implement reasonable security safeguards and up to Rs. 200 crore for not fulfilling breach notification obligations. It is important to note that these penalties are maximum statutory amounts and do not apply automatically. 

The Road Ahead…

November 13 marks the beginning of the Consent Manager registration phase under the broader Data Protection and Digital Privacy framework. The substantive obligations for Data Fiduciaries are set to take effect next year, i.e., on 13 May 2027. 

Financial institutions will need to use the time leading up to this deadline to review the following: 

• Consent processes, 

• Customer data flows’ mapping, 

• Retention policies’ updation, 

• Third-party arrangements’ assessment,

• Cybersecurity and incident response mechanisms. 

Source:- CNBC TV18