InfraVeritas360DPDPiq

DPDP Insights › Banking, financial services and insurance

Types of organisation

• Scheduled commercial bankA large bank holds data for crores of people across many products. The hard part is one view of consent and sharing across retail, cards, loans and bancassurance.
• Co-operative bank (urban or rural)Most co-operative banks run core banking through a vendor or a shared service. That makes the vendor contract the most important DPDP document you have. Paper ledgers, member registers and loan files in branches also count once scanned.
• NBFC and digital lenderRBI's Digital Lending Directions, 2025 already limit what apps may collect and require explicit consent with an audit trail. DPDP adds the rights and the breach clock on top.
• Insurance company (life, general or health)Insurers hold health data from proposals and claims, and share it with TPAs, hospitals, reinsurers and surveyors. Each hand-off needs a clear purpose and a contract.
• Broking, depository and wealthSEBI's Cybersecurity and Cyber Resilience Framework (2024) already covers most security duties. The DPDP-specific work is notices, consent for marketing and research calls, and requests.
• Payments and fintechPayment system data must be stored only in India under RBI's 2018 direction, and only card issuers and networks may store actual card numbers. Your DPDP work sits on top of those two rules.

Whose data you hold

• Customers and applicants
• Guarantors, nominees and co-borrowers
• Employees and branch staff
• Agents, business correspondents and DSAs
• Visitors and CCTV at branches

Read it from your seat

• DPO / Privacy leadYou sit between what the regulator already expects and what customers can now ask for themselves.
• CISO / Security headYou already run one of the most regulated security set-ups in the country. DPDP adds customer rights and one more reporting clock.
• CIO / IT headYour systems decide whether a customer request can be answered in days or in months.
• CEO / MDYour customers trust you with their money and their identity. DPDP makes that trust something you can be asked to prove.
• DirectorYou already oversee compliance with the regulator. DPDP adds the customer's own voice to that oversight.
• HR headBranch staff, relationship managers and call centre agents handle customer data every hour, and their own data needs the same care.
• Legal & complianceYour documents decide whether consent holds up and whether partners carry the right duties.
• Operations headBranches, service centres and back offices are where most customer data is collected, printed, scanned and filed.
• Branch / business headAs a branch or business head, your team meets customers face to face and holds their papers.
• Chief risk officerYou keep one register for every regulator. DPDP becomes one more set of lines in it.

By department

• IT department
• Administration department
• HR department
• Finance department
• Marketing department
• Customer service department
• Legal department
• Procurement department

Questions specific to this sector

• Can we cross-sell insurance, cards or mutual funds to existing customers?
• How long must we keep KYC and transaction records, and what happens after?
• What can collection agents do with borrower data?
• What can our lending or banking app collect from a phone?
• One incident, many regulators: how do we meet every clock?

Practical examples

Notice, request log, retention schedule, vendor clause and breach notice.

Rules that sit alongside DPDP