Does RBI compliance already cover DPDPA for Indian banks and NBFCs?

October 15, 2026

Does RBI compliance already cover DPDPA for banks and NBFCs? Quick answer

No. RBI directions on KYC, digital lending, outsourcing and cyber security overlap with the DPDP Act but do not satisfy it. DPDPA adds its own notice and consent rules for non-mandated uses, a 72-hour report to the Data Protection Board, rights handling within a published 90-day ceiling, and penalties up to ₹250 crore. Treat RBI compliance as the foundation, not the finish line.

Overlap: KYC, AML and fraud processing can rest on Section 7 legitimate uses; security controls and vendor due diligence carry over.
Gap: consent for marketing, cross-sell and partner sharing; Data Principal rights; breach reports to the Board; Significant Data Fiduciary duties.
Deadlines: Consent Managers 13 Nov 2026; full obligations 13 May 2027.

Banks and NBFCs are among the most heavily regulated data handlers in India, so compliance teams reasonably ask whether the Digital Personal Data Protection Act, 2023 changes anything. Our view, after mapping both rulebooks side by side: a lot carries over, but the gaps are exactly where the largest penalties sit.

Why do banks assume RBI compliance is enough?

Because RBI already regulates most of the same activities. The KYC Master Direction says what identity data to collect and how long to keep it; the RBI (Digital Lending) Directions, 2025 already require explicit, need-based borrower consent; outsourcing directions already demand vendor due diligence. The difference is purpose. RBI rules protect the financial system and the customer's money. DPDPA protects the individual's control over their personal data, whatever the sector, and adds obligations no RBI direction currently imposes.

Where do RBI rules and DPDPA overlap, and where do they diverge?

Area	What RBI already requires	What DPDPA adds
KYC and AML data	Collect prescribed identity data; retain records for five years after the relationship ends (PMLA Rules)	Itemised notice of data and purpose (Section 5, Rule 3); erase once the purpose is served unless retention is required by law (Section 8(7))
Digital lending consent	Explicit, need-based consent; no access to contacts, media or call logs; borrower can revoke; data stored in India	Consent must be free, specific, informed, unconditional and unambiguous (Section 6); withdrawal as easy as giving; Consent Manager interoperability from 13 Nov 2026
Vendors and DSAs	Outsourcing due diligence, audit rights, confidentiality clauses	Written Data Processor contracts (Section 8(2)); the bank remains liable as Data Fiduciary whatever the processor does
Incident reporting	CERT-In: report cyber incidents within six hours; RBI incident reporting under the cyber security framework	Notify every affected individual and the Data Protection Board; detailed report within 72 hours (Rule 7); no "low-risk" exemption
Security safeguards	IT governance and cyber security directions, IS audits	Rule 6 minimum safeguards: encryption, masking or tokenisation, access control, logs retained at least one year; ₹250 crore penalty cap
Grievances	Internal grievance redressal; escalation to the RBI Integrated Ombudsman if unresolved in 30 days	Published grievance mechanism with a response ceiling of up to 90 days (Rule 14); appeal lies to the Data Protection Board

What does DPDPA require that no RBI direction does?

Consent for non-mandated purposes. KYC, AML and fraud checks can be framed under Section 7 legitimate uses. Marketing, cross-sell, analytics, co-lending data shares and partner referrals cannot. Each needs specific, withdrawable consent under Section 6.
Data Principal rights. Sections 11 to 14 give every customer the right to access, correct and erase their data, and to nominate someone to exercise these rights after death or incapacity. Most core banking and CRM stacks have no erasure or nomination workflow today. See our guide to handling access, correction and erasure requests.
Children under 18. Section 9 requires verifiable parental consent and bans tracking and targeted advertising for anyone under 18. Minor accounts, education loans and student cards sit inside this rule.
Significant Data Fiduciary duties. Section 10 lets the government designate fiduciaries by volume and sensitivity of data. Designation brings an India-based Data Protection Officer, an independent data auditor and periodic Data Protection Impact Assessments.
Breach notice to every affected customer. CERT-In and RBI reporting go to regulators. DPDPA also requires telling each affected individual what happened and what the bank is doing about it. Read inside the 72-hour window.

Which DPDPA penalties does a bank actually face?

The Schedule to the Act sets fixed caps per breach type, and the Data Protection Board can stack them where several obligations fail at once:

Failure	Maximum penalty
Reasonable security safeguards (Section 8(5))	₹250 crore
Breach notification to the Board or affected individuals (Section 8(6))	₹200 crore
Children's data obligations (Section 9)	₹200 crore
Significant Data Fiduciary obligations (Section 10)	₹150 crore
Any other provision of the Act or Rules	₹50 crore

A single breach that combines weak safeguards with a late notification exposes two heads at once. More on how the Board weighs penalties in the real cost of waiting.

What should a bank or NBFC do before 13 May 2027?

Map every processing activity to a lawful basis. Tag each one as RBI-mandated (legitimate use) or discretionary (consent). The discretionary list is your consent backlog.
Consolidate consent across channels. Branch forms, the mobile app, DSAs, call centres and co-lending partners must feed one consent record that can be withdrawn in one place.
Fix the processor chain. DSAs, recovery agents, KYC vendors, cloud providers and analytics partners need DPDPA-grade contracts, not just outsourcing clauses.
Run a dual-clock breach drill. Six hours to CERT-In, 72 hours to the Data Protection Board, and individual notices in between.
Stand up a rights desk. Access, correction, erasure and nomination requests need an owner, a system of record and a published timeline.
Keep evidence. Rule 6 asks for logs retained at least one year. Consent records, notices served and requests closed should be tamper-evident; the Board will ask for proof, not policy.

RBI appears to be moving the same way: an advisory to regulated entities reported in April 2026 is said to ask for centralised consent tracking, documented retention and deletion policies, and tamper-proof audit logs. Building for DPDPA now means building for the supervisor as well. Our DPDPA timeline sets out what falls due in each window.

How Qodequay helps BFSI teams close the gap

DAPro (Data Adhikaar), Qodequay's DPDPA compliance platform, gives banks and NBFCs consent notices in 22 Indian languages, a tamper-evident Evidence Vault for consent and request records, and 25+ connectors into core banking, CRM and lending systems. For institutions where model-risk review makes AI tooling hard to approve, a deterministic, rule-based edition is available. Qodequay is ISO 27001:2022 and ISO 9001:2015 certified. Book a 30-minute DPDPA gap review for your bank or NBFC.

Frequently asked questions

Is a bank automatically a Significant Data Fiduciary under DPDPA?

No. Section 10 lets the central government designate Significant Data Fiduciaries based on the volume and sensitivity of data processed and the risk to individuals. Large banks and NBFCs are likely candidates, but the status follows a government notification, not the banking licence itself. Prepare for the DPO, auditor and DPIA duties in advance.

Does KYC data need separate consent under DPDPA?

Generally no. Identity data a customer provides for an account or loan, and disclosures the law requires, fit the legitimate uses in Section 7. A clear notice is still required under Section 5. Using the same data for marketing, cross-sell or partner sharing is a different purpose and needs specific consent under Section 6.

Do DSAs and recovery agents need their own DPDPA compliance?

They are usually Data Processors acting for the bank, which stays liable as Data Fiduciary under Section 8. The bank must bind them by written contract, limit what they collect, and ensure they apply the Rule 6 safeguards. A co-lender or fintech that makes its own credit decisions may be a separate Data Fiduciary with its own duties.

How does DPDPA breach reporting differ from the CERT-In six-hour rule?

CERT-In requires cyber incidents to be reported to it within six hours. DPDPA separately requires the bank to inform the Data Protection Board without delay, file a detailed report within 72 hours under Rule 7, and notify every affected individual. There is no low-risk exemption, so the two clocks must run in parallel.

Can a bank keep customer data after the account is closed?

Only where law requires it. PMLA rules require KYC and transaction records to be kept for five years after the relationship ends, and Section 8(7) of DPDPA allows retention needed to comply with law. Data beyond that, such as marketing preferences or app analytics, must be erased once its purpose is served or consent is withdrawn.

This article is for general information and is not legal advice. Confirm obligations against the official texts of the DPDP Act, 2023, the DPDP Rules, 2025 and the applicable RBI directions, and consult qualified counsel for your situation.

Hemlata Kalsha

I am a founder director at Qodequay Technologies Pvt. Ltd., a leading digital transformation consulting firm that helps clients across industries to innovate, optimize, and grow their businesses. I have over two decades of experience in the digital domain, spanning product development, e-commerce, user experience, design thinking, web and app development, and business leadership. My core competencies include developing and executing digital transformation strategies, building teams globally, roadmaps, and solutions that leverage data, insights, and emerging technologies such as artificial intelligence, augmented reality, blockchain, and immersive experience. I also have expertise in digital commerce, supply chain integration, and product management, having worked with both B2B and B2C brands in various sectors. My mission is to create value for customers and stakeholders by delivering impactful and engaging digital experiences that drive growth and innovation.