DPDP for the CFO / Finance head in BFSI

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · RBI KYC Master Direction · RBI · RBI · RBI

DPDP reaches finance in two places in BFSI: cross-sell income that now rests on consent, and partner contracts that now need data terms.

Written for: CFO / Finance head, Banking, financial services and insurance. Open this seat in the interactive tool

What is different here

Insurance, card and mutual fund cross-selling can run only on specific consent, so some fee income will depend on how many customers say yes. Contracts with BCs, DSAs, collection agencies and fintech partners need a data schedule, and some partners will ask for fee changes to meet it. Much of the security spend is already funded under RBI rules, so the new cost sits mostly in consent records, request handling and contracts.

The first four things to sort out

Ask business heads which fee income depends on cross-selling and partner sharing.
Plan that income on consented customers, not the whole book.
Budget time and money to renegotiate BC, DSA and collection agency contracts.
Fund the consent store and request process before new campaign tools.

A worked example

CFO / Finance head

Re-planning bancassurance income on consented customers

Month 1Finance finds that next year's insurance commission plan assumes offers to the whole savings book.
Month 2The DPO confirms offers can go only to customers with specific consent. The business head re-plans on the consented base, plus a consent drive in the app and at branches.
Month 3DSA and collection agency contracts come up for renewal with the new data schedule. Two agencies ask for higher fees; finance compares that with the cost of switching.
QuarterlyCommission income and partner costs are reported against consent numbers, not account numbers.

Evidence kept

Revised income plan with consent basis
Contract renewal tracker
Partner fee decisions
Quarterly finance note

Plan cross-sell income on the customers who said yes.

What others in the sector usually do. Many finance teams start by tagging fee income by whether it depends on customer consent, so the effect shows early in the plan.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Scheduled commercial bank	Cross-selling insurance and mutual funds on account terms; Business correspondent devices and paper forms in villages; Old core banking archives with no deletion path
Co-operative bank (urban or rural)	Vendor-run core banking with admin access from the vendor's office; Member and share registers kept on open shelves; Directors and staff who are also members and relatives of borrowers
NBFC and digital lender	Apps asking for contacts, photos and call logs; Collection agents sharing borrower details with family or employers; Leads bought from aggregators with no consent record
Insurance company (life, general or health)	Medical reports passed to TPAs and hospitals by email; Agent and broker access to policyholder data; Claims data kept long after the claim is closed
Broking, depository and wealth	Authorised persons with client lists on personal phones; Research-tip calls to people who never consented; Client KYC copies shared over email with partners
Payments and fintech	Card numbers in logs and support tickets; Merchant onboarding documents in shared drives; Fraud models that use data beyond what users were told

10 questions the CFO / Finance head asks, answered in full

Can we cross-sell insurance, cards or mutual funds to existing customers?

Short answer: Only with separate, specific consent

Only with specific consent for that purpose. Account opening terms do not count as consent to receive offers or to have data shared with a partner insurer or fund house. Service messages about the customer's own account are different and do not need marketing consent.

What the law says

Section 6 needs specific consent for each purpose. Section 5 needs a notice that names the purpose. Section 6 · Section 5 · Rule 3 · Section 8(1)–(2)

Steps

Separate service messages from offers in your systems.
Ask consent for offers and partner sharing separately, by channel.
Record consent by purpose and partner.
Check the record before each campaign.
Pass withdrawals to partners the same day.

Evidence to keep

Consent records by purpose and partner
Campaign approval with consent check
Withdrawal logs

Common mistakes

Using account terms as consent
Partners calling from their own lists
Withdrawal not reaching partners

What can collection agents do with borrower data?

Short answer: Only what is needed, under your contract and RBI conduct rules

Collection agents act for you, so you are responsible for what they do. They should get only the data needed to contact the borrower, use it only for collection, and never share the debt with family, friends or employers. RBI's rules on recovery conduct, including calling hours, apply alongside DPDP.

What the law says

Section 8(1) and 8(2) make you responsible for processors. Section 8(5) needs safeguards. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 6

Steps

Share only name, contact details and the amount due.
Put data terms and conduct rules in every agency contract.
Record calls and review a sample.
Ban use of the borrower's phone contacts.
Take back or delete data when the account closes.

Evidence to keep

Agency contracts
Call review records
Data return certificates

Common mistakes

Sending full loan files to agencies
Agents calling relatives
No deletion after the account closes

How much effort and time will it take to be ready by 13 May 2027?

Short answer: Six to nine months of steady work for most

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

From your seat: CFO / Finance head. Most cost is people's time and a few system changes. Budget by workstream, not by tool.

Example in BFSI

Much security work is done; budget time for consent records, partner contracts and request handling.

What the law says

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

Steps

Month 1: name the owner, set a budget line, start the inventory.
Months 2 to 3: notices, consent records, contact person, request register.
Months 3 to 6: vendor contracts, access control, logs, retention schedule.
Months 6 to 8: breach rehearsal, training, internal review.
Month 9: management review with evidence.

Evidence to keep

Programme plan with owners
Monthly status with evidence
Management minutes

Common mistakes

Leaving it to the last quarter
Buying a tool before knowing the gaps
Status colours with no evidence behind them

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: CFO / Finance head. Contract changes with vendors are where finance and DPDP meet. Track them with procurement.

Example in BFSI

Collection agencies, BCs, DSAs, KYC vendors, card processors and the core banking vendor all need data schedules aligned with RBI outsourcing rules.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

What evidence should exist before management accepts that we are ready?

Short answer: Evidence for each duty, not status colours

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

From your seat: CFO / Finance head. Fund evidence, not just policies. Evidence is what makes the spend count.

What the law says

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(9)–(10) · Rules 9, 14

Steps

List the duties that apply.
For each, name the piece of evidence that would satisfy an auditor.
Ask owners to attach it.
Mark duties without evidence as open, not ready.
Review the list before each management sign-off.

Evidence to keep

Duty-to-evidence list
Attached evidence
Sign-off record

Common mistakes

Accepting 'done' without seeing anything
Counting policies as evidence
One sign-off and no review after

How long can we keep personal data?

Short answer: For the legal or business period, then erase

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

From your seat: CFO / Finance head. Tax and audit periods are often the longest. Make sure finance records follow them and then go.

Example in BFSI

PMLA and RBI KYC rules set the floor at five years for identity and transaction records.

What the law says

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

Steps

List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.

Evidence to keep

Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates

Common mistakes

'Keep everything forever' because storage is cheap
Deleting before the legal minimum
Forgetting email, shared drives and backups

Could we be a Significant Data Fiduciary?

Short answer: Only by notification; none notified yet

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

From your seat: CFO / Finance head. If notification is possible, an auditor and a yearly assessment become recurring costs.

Example in BFSI

Large banks, insurers and payment companies hold sensitive financial data for crores of people. Plan as a likely candidate.

What the law says

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

Steps

Estimate how many people's data you hold and how sensitive it is.
Note any public or security role your data plays.
If you are a likely candidate, run a trial impact assessment this year.
Identify an auditor you could appoint.
Watch MeitY notifications.

Evidence to keep

Volume and sensitivity note
Trial impact assessment
Board note

Common mistakes

Assuming 'not notified' means 'never'
Waiting for notification to start
Thinking only tech companies will be notified

Can personal data be stored or accessed outside India?

Short answer: Yes, unless a sector rule says otherwise

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

From your seat: CFO / Finance head. Check where finance and payroll SaaS is hosted.

Example in BFSI

Payment system data must be stored only in India. Check overseas support access to core systems.

What the law says

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)

Steps

List where each system is hosted and where support teams log in from.
Check sector rules for localisation.
Put location and access terms in cloud and vendor contracts.
Keep the list current; new SaaS tools change it quietly.
Tell people in your notice if data goes abroad.

Evidence to keep

Hosting and access-location list
Contract clauses
Sector rule check

Common mistakes

Forgetting email, CRM and helpdesk SaaS
Ignoring overseas support logins
Assuming 'Indian vendor' means 'data in India'

Do we need consent for employee data?

Short answer: Not for employment purposes; yes for anything extra

Usually not for normal employment purposes. Section 7(i) lets you process employee data for employment, such as payroll, attendance, safety and preventing corporate espionage. Anything beyond that, such as wellness apps, photos for marketing or sharing with a bank for offers, needs consent.

From your seat: CFO / Finance head. Salary and bank details are among the most sensitive data you hold.

Example in BFSI

Background and credit checks on staff are employment purposes; explain them in the staff notice.

What the law says

Section 7(i) covers employment purposes and safeguarding the employer from loss or liability. Notice, security, retention and rights still apply to employees. Section 7 · Section 5 · Rule 3 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14

Steps

List what you collect from staff and why.
Mark which items are employment purposes and which are extra.
Take consent for the extras, separately.
Give staff a short employee privacy notice.
Set retention for ex-employee records.

Evidence to keep

Employee data list with basis
Employee privacy notice
Consent for extras

Common mistakes

A blanket consent clause in the offer letter
Keeping candidate data forever
Sharing staff data with vendors without terms

Do we need a DPO?

Short answer: Not required by law unless notified as an SDF, but name one person

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

From your seat: CFO / Finance head. A named owner needs a budget line to be real.

Example in BFSI

Large banks and insurers are likely candidates for SDF notification. Name a DPO now.

What the law says

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

Steps

Name one accountable person, with a deputy.
Publish the contact on your website, app and notices.
Give the role time, a budget line and a route to management.
Set a short monthly report: requests, complaints, incidents, actions.
Review the role if you are notified as an SDF.

Evidence to keep

Appointment letter
Published contact
Monthly report

Common mistakes

Giving the job to IT as a side task
A contact email nobody reads
No authority to make changes

The sections you will use most

Section 8(1)–(2): Responsibility for vendors. Collection agencies, KYC vendors, BCs, DSAs, call centres and cloud providers work for you. RBI, SEBI and IRDAI outsourcing rules apply alongside.
Section 8(7) · Rule 8: Erasure and retention. PMLA and KYC periods set the floor. After them, erase.
Section 7: Uses allowed without consent. KYC, PMLA reporting and regulator returns are legal duties under Section 7. Fraud checks and loan servicing usually rest on the purpose the customer gave the data for.
Section 10 · Rule 13: Significant Data Fiduciaries.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Prevention of Money-laundering Act, 2002 and RBI KYC Master Direction, 2016	Keep transaction records for at least five years from the transaction, and identity records for at least five years after the relationship ends.	These periods override an erasure request. Explain the retention to the customer and stop every other use.	RBI KYC Master Direction
RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023	In force from 1 April 2024 for commercial banks, larger NBFCs, credit information companies and all-India financial institutions. Requires IT governance under the board, audit trails, logging and incident reporting to CERT-In and RBI.	Most of the DPDP security duty is already here. Map controls once and use the evidence for both.	RBI
RBI Master Direction on Outsourcing of IT Services, 2023	The regulated entity stays responsible for outsourced IT, with contracts, audit rights and exit plans.	Line up DPDP processor contracts with this direction, so one schedule meets both.	RBI
RBI direction on storage of payment system data, 2018	All data relating to payment systems must be stored only in India.	This is stricter than DPDP Section 16, and it continues to apply.	RBI
RBI rules on card storage and tokenisation (from 1 October 2022)	Only card issuers and card networks may store actual card data. Others use tokens, created with the cardholder's explicit consent.	Check logs, call recordings and support tickets for card numbers.	RBI
RBI (Digital Lending) Directions, 2025	Collect only need-based data with prior explicit consent and an audit trail. Apps should not access contacts, files, media or call logs; one-time access to camera, microphone or location is allowed for onboarding or KYC with consent.	Your app permissions and lending partner contracts are where DPDP and RBI meet.	RBI
IRDAI Information and Cyber Security Guidelines, 2023	Report cyber incidents to CERT-In within six hours, and to IRDAI within 24 hours of the CERT-In report.	One incident plan should run the CERT-In, IRDAI and Data Protection Board steps together.	IRDAI
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 2024	Security, logging and incident-reporting duties for SEBI-regulated entities. Stock brokers and depository participants report cyber incidents within six hours.	Use CSCRF evidence for DPDP security, then add notices, consent and rights.	SEBI
CERT-In Directions, 28 April 2022	Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to Indian time sources.	Applies to every BFSI entity in addition to the regulator's own clock.	CERT-In
Credit Information Companies (Regulation) Act, 2005	Governs what credit information is shared with credit bureaus and how errors are corrected.	Credit bureau sharing has its own law; DPDP rights requests about bureau data should point to that process too.	Act
RBI Integrated Ombudsman Scheme, 2021	Customers can escalate unresolved complaints to the RBI Ombudsman.	Privacy complaints may reach both the Ombudsman and the Data Protection Board. One complaint log helps.	RBI