DPDP for the Chief risk officer in BFSI

Most BFSI incidents need a CERT-In report within six hours, a report to your regulator as its rules require (IRDAI asks within 24 hours of the CERT-In report), and DPDP messages to customers and the Data Protection Board without delay, with a detailed Board report in 72 hours. One playbook with one timeline avoids missed steps.

Section 8(6) and Rule 7 set the DPDP steps. CERT-In and your regulator set the others. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Put every clock on one page.
2. Name who files each report.
3. Keep templates ready.
4. Rehearse with all filers present.
5. Log the time each report went.

• Clock page
• Templates
• Drill record

• Separate playbooks per regulator
• DPO told last
• No customer message template

• Something has gone wrong. What happens in the first 72 hours?
• Which logs must we keep, for how long, and where?
• What must a vendor contract say about personal data?

Collection agents act for you, so you are responsible for what they do. They should get only the data needed to contact the borrower, use it only for collection, and never share the debt with family, friends or employers. RBI's rules on recovery conduct, including calling hours, apply alongside DPDP.

Section 8(1) and 8(2) make you responsible for processors. Section 8(5) needs safeguards. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 6

1. Share only name, contact details and the amount due.
2. Put data terms and conduct rules in every agency contract.
3. Record calls and review a sample.
4. Ban use of the borrower's phone contacts.
5. Take back or delete data when the account closes.

• Agency contracts
• Call review records
• Data return certificates

• Sending full loan files to agencies
• Agents calling relatives
• No deletion after the account closes

• What must a vendor contract say about personal data?
• What about call recordings and customer service screens?
• How do we handle a privacy complaint within 90 days?

Only with specific consent for that purpose. Account opening terms do not count as consent to receive offers or to have data shared with a partner insurer or fund house. Service messages about the customer's own account are different and do not need marketing consent.

Section 6 needs specific consent for each purpose. Section 5 needs a notice that names the purpose. Section 6 · Section 5 · Rule 3 · Section 8(1)–(2)

1. Separate service messages from offers in your systems.
2. Ask consent for offers and partner sharing separately, by channel.
3. Record consent by purpose and partner.
4. Check the record before each campaign.
5. Pass withdrawals to partners the same day.

• Consent records by purpose and partner
• Campaign approval with consent check
• Withdrawal logs

• Using account terms as consent
• Partners calling from their own lists
• Withdrawal not reaching partners

• When do we need consent, and when can we rely on a legitimate use?
• Someone withdraws consent. What has to stop, and how fast?
• Can we send offers to past customers and leads?

Turn each duty into a risk line with an owner, a control, evidence and a review date. Map controls you already run for your regulator, auditors or certifications, so the same evidence serves several purposes. Track vendor risk separately.

Link RBI IT governance and outsourcing controls as evidence.

The Act sets duties in Sections 5 to 12. A risk register shows management where each duty stands. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 10 · Rule 13

1. List the duties that apply to you.
2. For each, write the risk in plain words, the control and the owner.
3. Link existing controls and audits as evidence.
4. Rate likelihood and impact in your usual way.
5. Review every quarter with management.

• Risk register extract
• Linked evidence
• Quarterly review minutes

• One line saying 'DPDP compliance'
• No owners
• Evidence that is only a policy document

• What must a vendor contract say about personal data?
• Something has gone wrong. What happens in the first 72 hours?
• Does ISO 27001 or NIST CSF cover our DPDP duties?

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

A partner API leak may need CERT-In in six hours, your regulator's report, and the DPDP messages.

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Name one incident lead and a back-up, with phone numbers that work at night.
2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
4. Decide in advance who signs off each message.
5. Rehearse once a year with the people who would actually be called.

• Incident plan with clocks
• Rehearsal record
• Incident log with times of each step

• Waiting to finish the investigation before telling anyone
• Treating a wrong email or a lost laptop as 'not a breach'
• Only IT knowing the plan

• Which logs must we keep, for how long, and where?
• What must a vendor contract say about personal data?
• Does deletion have to reach backups and test copies?

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

Collection agencies, BCs, DSAs, KYC vendors, card processors and the core banking vendor all need data schedules aligned with RBI outsourcing rules.

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

1. List vendors who receive or can see personal data.
2. Rank them by how much and how sensitive.
3. Add a data-protection schedule to each contract, starting with the top ten.
4. Ask for evidence: certificates, test results, deletion confirmations.
5. Review the top vendors every year.

• Vendor register
• Signed data-protection schedules
• Annual review notes

• Relying on the vendor's standard terms
• No incident-notice time
• No exit and deletion clause

• Something has gone wrong. What happens in the first 72 hours?
• Can personal data be stored or accessed outside India?
• Does deletion have to reach backups and test copies?

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

Large banks, insurers and payment companies hold sensitive financial data for crores of people. Plan as a likely candidate.

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

1. Estimate how many people's data you hold and how sensitive it is.
2. Note any public or security role your data plays.
3. If you are a likely candidate, run a trial impact assessment this year.
4. Identify an auditor you could appoint.
5. Watch MeitY notifications.

• Volume and sensitivity note
• Trial impact assessment
• Board note

• Assuming 'not notified' means 'never'
• Waiting for notification to start
• Thinking only tech companies will be notified

• Do we need a DPO?
• Can personal data be stored or accessed outside India?
• What should the board of directors ask management about DPDP?

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

Payment system data must be stored only in India. Check overseas support access to core systems.

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)

1. List where each system is hosted and where support teams log in from.
2. Check sector rules for localisation.
3. Put location and access terms in cloud and vendor contracts.
4. Keep the list current; new SaaS tools change it quietly.
5. Tell people in your notice if data goes abroad.

• Hosting and access-location list
• Contract clauses
• Sector rule check

• Forgetting email, CRM and helpdesk SaaS
• Ignoring overseas support logins
• Assuming 'Indian vendor' means 'data in India'

• What must a vendor contract say about personal data?
• Where does personal data live in our organisation?
• Which logs must we keep, for how long, and where?

They help a great deal with the security part. ISO/IEC 27001 and NIST CSF 2.0 are good evidence of reasonable security safeguards. They do not cover notice, consent, rights, complaints or children's data. ISO/IEC 27701 adds privacy controls, but no certificate replaces the Act.

RBI, SEBI and IRDAI frameworks plus ISO 27001 cover most of Rule 6.

Section 8(5) and Rule 6 ask for reasonable security safeguards. A recognised standard is strong evidence of that duty, and only of that duty. Section 8(5) · Rule 6

1. Map your current controls to Rule 6.
2. Add the DPDP-only items: notice, consent, rights, complaints, children, retention.
3. Use the same evidence for audits and for DPDP.
4. Include privacy in the scope of your next internal audit.
5. Consider ISO/IEC 27701 if clients ask for it.

• Control map
• Audit reports
• Gap list for DPDP-only items

• Treating a certificate as DPDP compliance
• Scope that leaves out the systems with the most personal data
• No owner for the non-security duties

• Which logs must we keep, for how long, and where?
• Who should be able to see personal data in our systems?
• What must a vendor contract say about personal data?

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

Much security work is done; budget time for consent records, partner contracts and request handling.

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

1. Month 1: name the owner, set a budget line, start the inventory.
2. Months 2 to 3: notices, consent records, contact person, request register.
3. Months 3 to 6: vendor contracts, access control, logs, retention schedule.
4. Months 6 to 8: breach rehearsal, training, internal review.
5. Month 9: management review with evidence.

• Programme plan with owners
• Monthly status with evidence
• Management minutes

• Leaving it to the last quarter
• Buying a tool before knowing the gaps
• Status colours with no evidence behind them

• Do we need a DPO?
• Where does personal data live in our organisation?
• What must a vendor contract say about personal data?