DPDP for the Company secretary in BFSI

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · RBI KYC Master Direction · RBI · RBI · RBI

You prepare the papers the risk, audit and IT strategy committees see. DPDP should appear there with evidence, next to the RBI items you already track.

Written for: Company secretary, Banking, financial services and insurance. Open this seat in the interactive tool

What is different here

In BFSI, DPDP sits in the same committees as RBI IT governance, outsourcing and fraud reporting. Large banks, insurers and payment companies are likely candidates for SDF notification, which would add a yearly impact assessment and an independent data audit to the calendar. One incident can go to CERT-In, the regulator and the Data Protection Board, so the papers should show it as one timeline.

The first four things to sort out

Add DPDP as a standing item on the risk or IT strategy committee agenda.
Record the DPO appointment and reporting line in a resolution.
Minute the evidence seen: partner list, requests answered, last drill.
Keep yearly assessment and audit dates in the calendar if notified as an SDF.

A worked example

Company secretary

Minuting DPDP alongside the regulator's items

BeforeThe secretary asks the DPO and CISO for a two-page note: owner, partners without a data schedule, requests answered on time and the last incident drill.
MeetingThe committee asks whether the drill covered CERT-In, the RBI report and the Data Protection Board together. The CISO shows the drill timeline.
MinutesThe minutes record the questions asked, the evidence shown and two actions with owners and dates.
Next meetingThe action list is the first item. One action is closed with evidence; the other is moved with a reason.

Evidence kept

Committee note
Minutes listing evidence seen
Action tracker

Minutes that list the evidence seen are proof of oversight.

What others in the sector usually do. Many company secretaries start by adding a short DPDP note to the committee papers that already go up for RBI IT governance.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Scheduled commercial bank	Cross-selling insurance and mutual funds on account terms; Business correspondent devices and paper forms in villages; Old core banking archives with no deletion path
Co-operative bank (urban or rural)	Vendor-run core banking with admin access from the vendor's office; Member and share registers kept on open shelves; Directors and staff who are also members and relatives of borrowers
NBFC and digital lender	Apps asking for contacts, photos and call logs; Collection agents sharing borrower details with family or employers; Leads bought from aggregators with no consent record
Insurance company (life, general or health)	Medical reports passed to TPAs and hospitals by email; Agent and broker access to policyholder data; Claims data kept long after the claim is closed
Broking, depository and wealth	Authorised persons with client lists on personal phones; Research-tip calls to people who never consented; Client KYC copies shared over email with partners
Payments and fintech	Card numbers in logs and support tickets; Merchant onboarding documents in shared drives; Fraud models that use data beyond what users were told

What a good answer from management sounds like

Question to ask	A good answer sounds like	Effort and time
One incident, many regulators: how do we meet every clock?	“One playbook covers CERT-In, our regulator and the Data Protection Board. It was rehearsed this year with every filer.”	Light · 3 to 6 weeks
Can we cross-sell insurance, cards or mutual funds to existing customers?	“Every campaign is checked against consent by purpose. Partners receive only consented customers, and withdrawals reach them within a day.”	Medium · 8 to 12 weeks
What should the board of directors ask management about DPDP?	“DPDP is a standing quarterly item. Management brings a short note with names, numbers and evidence.”	Light · one agenda item every quarter
Can management trust the DPDP position it is shown?	“The position we see separates what was tested from what was only stated, and we look at samples each quarter.”	Light · each review
Who owns accountability for personal data in practice?	“Every duty and major system has an owner who accepted it in writing, and we review the list when people move.”	Light · 2 to 4 weeks
Do we need a DPO?	“We have named an accountable person with a deputy, published the contact, and that person reports to management every month.”	Light · 2 to 4 weeks
Could we be a Significant Data Fiduciary?	“We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.”	Medium if you are a likely candidate
Something has gone wrong. What happens in the first 72 hours?	“We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.”	Medium · 4 to 8 weeks, then a yearly drill
Police, a court or a regulator asks for someone's data. What do we do?	“All authority requests go through Legal. We check the power, share only what is needed, and keep a log.”	Light · 2 to 3 weeks
How much effort and time will it take to be ready by 13 May 2027?	“We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.”	Programme · six to nine months

10 questions the Company secretary asks, answered in full

One incident, many regulators: how do we meet every clock?

Short answer: Six hours for CERT-In; regulator as its rules say; DPDP without delay and 72 hours

Most BFSI incidents need a CERT-In report within six hours, a report to your regulator as its rules require (IRDAI asks within 24 hours of the CERT-In report), and DPDP messages to customers and the Data Protection Board without delay, with a detailed Board report in 72 hours. One playbook with one timeline avoids missed steps.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. CERT-In and your regulator set the others. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

What a good answer from management sounds like: “One playbook covers CERT-In, our regulator and the Data Protection Board. It was rehearsed this year with every filer.” Effort and time: Light · 3 to 6 weeks.

Steps

Put every clock on one page.
Name who files each report.
Keep templates ready.
Rehearse with all filers present.
Log the time each report went.

Evidence to keep

Clock page
Templates
Drill record

Common mistakes

Separate playbooks per regulator
DPO told last
No customer message template

Can we cross-sell insurance, cards or mutual funds to existing customers?

Short answer: Only with separate, specific consent

Only with specific consent for that purpose. Account opening terms do not count as consent to receive offers or to have data shared with a partner insurer or fund house. Service messages about the customer's own account are different and do not need marketing consent.

What the law says

Section 6 needs specific consent for each purpose. Section 5 needs a notice that names the purpose. Section 6 · Section 5 · Rule 3 · Section 8(1)–(2)

What a good answer from management sounds like: “Every campaign is checked against consent by purpose. Partners receive only consented customers, and withdrawals reach them within a day.” Effort and time: Medium · 8 to 12 weeks.

Steps

Separate service messages from offers in your systems.
Ask consent for offers and partner sharing separately, by channel.
Record consent by purpose and partner.
Check the record before each campaign.
Pass withdrawals to partners the same day.

Evidence to keep

Consent records by purpose and partner
Campaign approval with consent check
Withdrawal logs

Common mistakes

Using account terms as consent
Partners calling from their own lists
Withdrawal not reaching partners

What should the board of directors ask management about DPDP?

Short answer: Five plain questions, asked every quarter

Directors do not need technical detail. They need to know who is accountable, how the organisation would handle a breach, which outside parties hold data, and whether the plan to May 2027 is on track with evidence.

From your seat: Company secretary. Put DPDP on the board calendar and minute the questions asked and answers given.

Example in BFSI

Ask how DPDP fits into the existing IT strategy and risk committee reports.

What the law says

The Act places duties on the Data Fiduciary, the organisation itself. Directors oversee whether management has put those duties into practice. Section 8(1)–(2) · Section 8(6) · Rule 7 · Section 10 · Rule 13

What a good answer from management sounds like: “DPDP is a standing quarterly item. Management brings a short note with names, numbers and evidence.” Effort and time: Light · one agenda item every quarter.

Steps

Ask who is accountable for personal data, by name.
Ask when the breach plan was last rehearsed and what was learnt.
Ask for the list of vendors holding the most personal data.
Ask how many requests and complaints came in, and how fast they were answered.
Ask for the plan to May 2027 with evidence, not colours.

Evidence to keep

Quarterly note to the board
Minutes showing the questions asked
Management responses

Common mistakes

Discussing DPDP once and then never again
Accepting 'IT is handling it'
No date for the breach rehearsal

Can management trust the DPDP position it is shown?

Short answer: Only as far as the evidence behind it

Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.

From your seat: Company secretary. Minutes should record what evidence the board saw, not only what it was told.

What the law says

Accountability under the Act sits with the organisation; management oversight is how that accountability becomes real. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 10 · Rule 13

What a good answer from management sounds like: “The position we see separates what was tested from what was only stated, and we look at samples each quarter.” Effort and time: Light · each review.

Steps

Ask for the position split into tested, stated and not looked at.
Ask for two or three samples you can see.
Ask who reviewed the evidence.
Ask what changed since the last review.
Record the answers in minutes.

Evidence to keep

Position with tested and stated parts
Samples seen
Minutes

Common mistakes

Trusting a single summary slide
No difference between stated and tested
No record of what management saw

Who owns accountability for personal data in practice?

Short answer: Named owners, accepted by them, for each duty

The organisation is accountable under the Act, and management decides who answers for each duty inside it. In practice that means a named owner for each duty and each major system, written down and accepted by that person. An owner whose name was typed in by someone else, without their agreement, is not really an owner.

From your seat: Company secretary. Board-approved roles avoid arguments about who owns what during an incident.

What the law says

Section 8(1) puts responsibility on the Data Fiduciary. Section 8(9) asks for a published contact person. Section 8(1)–(2) · Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

What a good answer from management sounds like: “Every duty and major system has an owner who accepted it in writing, and we review the list when people move.” Effort and time: Light · 2 to 4 weeks.

Steps

List duties and major systems.
Propose an owner for each.
Ask each owner to accept in writing.
Publish the overall contact person.
Review owners when people move.

Evidence to keep

Owner register with acceptances
Published contact
Review dates

Common mistakes

Owners assigned without telling them
One person owning everything
Owners who left the organisation

Do we need a DPO?

Short answer: Not required by law unless notified as an SDF, but name one person

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

From your seat: Company secretary. Record the appointment and the reporting line in a board or committee resolution.

Example in BFSI

Large banks and insurers are likely candidates for SDF notification. Name a DPO now.

What the law says

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

What a good answer from management sounds like: “We have named an accountable person with a deputy, published the contact, and that person reports to management every month.” Effort and time: Light · 2 to 4 weeks.

Steps

Name one accountable person, with a deputy.
Publish the contact on your website, app and notices.
Give the role time, a budget line and a route to management.
Set a short monthly report: requests, complaints, incidents, actions.
Review the role if you are notified as an SDF.

Evidence to keep

Appointment letter
Published contact
Monthly report

Common mistakes

Giving the job to IT as a side task
A contact email nobody reads
No authority to make changes

Could we be a Significant Data Fiduciary?

Short answer: Only by notification; none notified yet

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

From your seat: Company secretary. If notified, the board will need to see the impact assessment and audit each year.

Example in BFSI

Large banks, insurers and payment companies hold sensitive financial data for crores of people. Plan as a likely candidate.

What the law says

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

What a good answer from management sounds like: “We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.” Effort and time: Medium if you are a likely candidate.

Steps

Estimate how many people's data you hold and how sensitive it is.
Note any public or security role your data plays.
If you are a likely candidate, run a trial impact assessment this year.
Identify an auditor you could appoint.
Watch MeitY notifications.

Evidence to keep

Volume and sensitivity note
Trial impact assessment
Board note

Common mistakes

Assuming 'not notified' means 'never'
Waiting for notification to start
Thinking only tech companies will be notified

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Company secretary. Know when the board must be told about an incident, and who tells it.

Example in BFSI

A partner API leak may need CERT-In in six hours, your regulator's report, and the DPDP messages.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

What a good answer from management sounds like: “We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.” Effort and time: Medium · 4 to 8 weeks, then a yearly drill.

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

Police, a court or a regulator asks for someone's data. What do we do?

Short answer: Yes, when the request is lawful and in writing

Check that the request is in writing, comes from the right authority and cites the legal power. Share only what is asked for, record what you sent and to whom, and keep the request on file. The Act allows processing to meet a legal duty, but it does not mean sharing everything on a phone call.

From your seat: Company secretary. Authority requests that reach the secretarial team need the same log as others.

Example in BFSI

Banks receive many police and tax requests. Route them all through one desk.

What the law says

Section 7(d) and 7(e) allow processing to meet a legal duty to disclose to the State, or to comply with a judgment or order. Section 17(1)(c) exempts processing for preventing, detecting or investigating offences. Section 7 · Section 8(5) · Rule 6

What a good answer from management sounds like: “All authority requests go through Legal. We check the power, share only what is needed, and keep a log.” Effort and time: Light · 2 to 3 weeks.

Steps

Route every such request to Legal.
Check the authority, the legal power and the scope.
Share only what is asked, by a secure method.
Log the request, what was sent, by whom and when.
Tell the person, unless the law or the authority says you must not.

Evidence to keep

Authority request log
Copies of requests
Record of what was sent

Common mistakes

Sharing on a phone call
Sending whole files when a few lines were asked
No log

How much effort and time will it take to be ready by 13 May 2027?

Short answer: Six to nine months of steady work for most

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

From your seat: Company secretary. A dated plan, approved by the board, makes progress easy to review.

Example in BFSI

Much security work is done; budget time for consent records, partner contracts and request handling.

What the law says

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

What a good answer from management sounds like: “We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.” Effort and time: Programme · six to nine months.

Steps

Month 1: name the owner, set a budget line, start the inventory.
Months 2 to 3: notices, consent records, contact person, request register.
Months 3 to 6: vendor contracts, access control, logs, retention schedule.
Months 6 to 8: breach rehearsal, training, internal review.
Month 9: management review with evidence.

Evidence to keep

Programme plan with owners
Monthly status with evidence
Management minutes

Common mistakes

Leaving it to the last quarter
Buying a tool before knowing the gaps
Status colours with no evidence behind them

The sections you will use most

Section 8(6) · Rule 7: Telling people about a breach. One incident may go to CERT-In, your regulator and the Data Protection Board, each with its own clock.
Section 10 · Rule 13: Significant Data Fiduciaries.
Section 8(9)–(10) · Rules 9, 14: Contact person and complaints.
Sections 18–26: The Data Protection Board.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Prevention of Money-laundering Act, 2002 and RBI KYC Master Direction, 2016	Keep transaction records for at least five years from the transaction, and identity records for at least five years after the relationship ends.	These periods override an erasure request. Explain the retention to the customer and stop every other use.	RBI KYC Master Direction
RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023	In force from 1 April 2024 for commercial banks, larger NBFCs, credit information companies and all-India financial institutions. Requires IT governance under the board, audit trails, logging and incident reporting to CERT-In and RBI.	Most of the DPDP security duty is already here. Map controls once and use the evidence for both.	RBI
RBI Master Direction on Outsourcing of IT Services, 2023	The regulated entity stays responsible for outsourced IT, with contracts, audit rights and exit plans.	Line up DPDP processor contracts with this direction, so one schedule meets both.	RBI
RBI direction on storage of payment system data, 2018	All data relating to payment systems must be stored only in India.	This is stricter than DPDP Section 16, and it continues to apply.	RBI
RBI rules on card storage and tokenisation (from 1 October 2022)	Only card issuers and card networks may store actual card data. Others use tokens, created with the cardholder's explicit consent.	Check logs, call recordings and support tickets for card numbers.	RBI
RBI (Digital Lending) Directions, 2025	Collect only need-based data with prior explicit consent and an audit trail. Apps should not access contacts, files, media or call logs; one-time access to camera, microphone or location is allowed for onboarding or KYC with consent.	Your app permissions and lending partner contracts are where DPDP and RBI meet.	RBI
IRDAI Information and Cyber Security Guidelines, 2023	Report cyber incidents to CERT-In within six hours, and to IRDAI within 24 hours of the CERT-In report.	One incident plan should run the CERT-In, IRDAI and Data Protection Board steps together.	IRDAI
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 2024	Security, logging and incident-reporting duties for SEBI-regulated entities. Stock brokers and depository participants report cyber incidents within six hours.	Use CSCRF evidence for DPDP security, then add notices, consent and rights.	SEBI
CERT-In Directions, 28 April 2022	Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to Indian time sources.	Applies to every BFSI entity in addition to the regulator's own clock.	CERT-In
Credit Information Companies (Regulation) Act, 2005	Governs what credit information is shared with credit bureaus and how errors are corrected.	Credit bureau sharing has its own law; DPDP rights requests about bureau data should point to that process too.	Act
RBI Integrated Ombudsman Scheme, 2021	Customers can escalate unresolved complaints to the RBI Ombudsman.	Privacy complaints may reach both the Ombudsman and the Data Protection Board. One complaint log helps.	RBI