DPDP for the Facilities and physical security department in BFSI

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · RBI KYC Master Direction · RBI · RBI · RBI

Branches, ATMs, data centres and record rooms all have cameras, guards and visitor registers that collect personal data.

Written for: Facilities and physical security department, Banking, financial services and insurance. Open this seat in the interactive tool

What is different here

Branch CCTV records customers at counters and lockers, and ATM cameras record every user. Guards and housekeeping staff usually come from agencies. Data centres and record rooms hold KYC files and backups, so entry logs matter for both security and DPDP.

The first four things to sort out

Put CCTV notices at branches and ATMs.
Set footage retention and who may view it.
Log entry to record rooms, server rooms and strong rooms.
Add data terms to guard and housekeeping agency contracts.

A worked example

Facilities and physical security department

A request to view branch CCTV footage

Day 1A customer's relative asks the branch to show footage of a cash dispute at the counter.
Day 1The branch explains that footage is shown only to the customer after an identity check, or given to police on a written request.
Day 2The customer comes in. The relevant clip is shown at the branch and the viewing is logged.
AfterThe clip is kept with the complaint. The rest of the footage is overwritten on its schedule.

Evidence kept

Viewing request form
Identity check
Viewing log
Footage retention setting

Footage goes only to the right person, and every viewing is logged.

What others in the sector usually do. Many banks start by using one CCTV notice and one footage viewing form across all branches.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Scheduled commercial bank	Cross-selling insurance and mutual funds on account terms; Business correspondent devices and paper forms in villages; Old core banking archives with no deletion path
Co-operative bank (urban or rural)	Vendor-run core banking with admin access from the vendor's office; Member and share registers kept on open shelves; Directors and staff who are also members and relatives of borrowers
NBFC and digital lender	Apps asking for contacts, photos and call logs; Collection agents sharing borrower details with family or employers; Leads bought from aggregators with no consent record
Insurance company (life, general or health)	Medical reports passed to TPAs and hospitals by email; Agent and broker access to policyholder data; Claims data kept long after the claim is closed
Broking, depository and wealth	Authorised persons with client lists on personal phones; Research-tip calls to people who never consented; Client KYC copies shared over email with partners
Payments and fintech	Card numbers in logs and support tickets; Merchant onboarding documents in shared drives; Fraud models that use data beyond what users were told

7 questions the Facilities and physical security department asks, answered in full

How long must we keep KYC and transaction records, and what happens after?

Short answer: At least five years after the relationship ends; then erase

Under PMLA and RBI's KYC Master Direction, keep identity records for at least five years after the relationship ends, and transaction records for at least five years from the transaction. During that time, keep them only for that legal purpose. After it, erase or anonymise unless another law requires more.

What the law says

Section 8(7) allows retention where a law requires it. PMLA and RBI's KYC rules are such laws. Section 8(7) · Rule 8 · Section 7

Steps

List KYC and transaction record types.
Set the start date: end of relationship or date of transaction.
Restrict access to closed-account records.
Erase or anonymise after the period.
Explain this in erasure replies.

Evidence to keep

Retention schedule
Access restrictions on closed accounts
Deletion logs

Common mistakes

Keeping everything for ever
Deleting before the legal period
Using closed-account data for marketing

What about CCTV, visitor registers and biometric attendance?

Short answer: Yes, with notice, limits and a deletion period

All three are personal data. Put a clear notice where people are recorded, collect only what you need at reception, keep footage and registers for a set period, and protect biometric templates carefully. Do not keep copies of ID documents unless you must.

From your seat: Facilities and physical security department. Notices, retention and viewing rights.

Example in BFSI

Branch and ATM CCTV needs notices and limited retention.

What the law says

Section 5 needs notice. Section 8(5) needs safeguards. Section 8(7) needs erasure after the purpose. For staff, Section 7(i) can cover security and attendance. Section 5 · Rule 3 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 7

Steps

Put notices at CCTV points and reception, in the local language.
Ask visitors only for name, phone and whom they are meeting, unless security needs more.
Set a period for footage and registers, then delete.
Restrict who can view footage, and log viewing.
Check the vendor contracts for CCTV, guards and attendance systems.

Evidence to keep

Notices in place
Retention settings on the recorder
Viewing log

Common mistakes

Photocopying visitor IDs as routine
Footage kept until the disk fills
Biometric systems with vendor default passwords

Are contract and agency workers our responsibility?

Short answer: Yes, for the data you decide about

Their data is your responsibility when you decide why and how it is used, for example gate passes, attendance, biometrics and safety records. The agency holds payroll and personal files, so your contract with the agency must cover how it protects that data.

From your seat: Facilities and physical security department. Guard and housekeeping staff data.

Example in BFSI

Branch guards, housekeeping and data entry operators are often agency staff.

What the law says

Section 7(i) covers employment purposes. Section 8(1) and 8(2) make you responsible for processors such as manpower agencies working on your behalf. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6

Steps

List what you hold about contract workers: ID copies, photos, biometrics, attendance, medical fitness.
Decide who is the Data Fiduciary for each item: you or the agency.
Put data terms in every manpower contract.
Give a short notice in the workers' language at the gate or induction.
Delete gate and ID records on a schedule.

Evidence to keep

Contract-worker data list
Agency contracts with data terms
Notice at the gate

Common mistakes

Photocopies of Aadhaar kept in open files
No terms in the agency contract
Biometric data with no deletion date

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: Facilities and physical security department. Security agency contracts.

Example in BFSI

Collection agencies, BCs, DSAs, KYC vendors, card processors and the core banking vendor all need data schedules aligned with RBI outsourcing rules.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

How long can we keep personal data?

Short answer: For the legal or business period, then erase

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

From your seat: Facilities and physical security department. Visitor registers and footage periods.

Example in BFSI

PMLA and RBI KYC rules set the floor at five years for identity and transaction records.

What the law says

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

Steps

List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.

Evidence to keep

Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates

Common mistakes

'Keep everything forever' because storage is cheap
Deleting before the legal minimum
Forgetting email, shared drives and backups

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Facilities and physical security department. A lost register is a breach.

Example in BFSI

A partner API leak may need CERT-In in six hours, your regulator's report, and the DPDP messages.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

What should our privacy notice say, and where must people see it?

Short answer: Yes, at every point where you collect data

A notice must tell people, in plain words, what data you collect, why, how they can withdraw consent, how they can use their rights and how they can complain to the Data Protection Board. It has to stand on its own, separate from long terms and conditions, and be shown at the point where data is collected.

From your seat: Facilities and physical security department. Notice at the gate.

Example in BFSI

A bank's account opening form, its mobile app sign-up and its loan application each need their own short notice, separate from the terms and conditions.

What the law says

Section 5 and Rule 3 ask for a notice that can be understood on its own, with an itemised list of the data and the purpose for each item. Data you already hold from before the Act also needs a notice, as soon as reasonably practicable. Section 5 · Rule 3 · Section 6 · Sections 11–14 · Rule 14

Steps

List every point where personal data comes in: forms, apps, counters, calls, emails, partner feeds.
Write one short notice per collection point, with the data items and purpose side by side.
Add how to withdraw consent, how to make a request and the DPO or contact person's details.
Offer the notice in English and in the languages your customers actually use.
Keep each version with the date it went live.

Evidence to keep

Screenshots or copies of the notice at each collection point, with dates
Notice version history
Translations, where used

Common mistakes

Hiding the notice inside terms and conditions
One notice for everything, with no link between data items and purposes
Forgetting old data collected before the Act

The sections you will use most

Section 5 · Rule 3: Notice. Account opening, loan applications, insurance proposals, app sign-ups and branch forms each need a notice, separate from the long terms and conditions.
Section 8(5) · Rule 6: Security safeguards. Core banking, policy and trading systems are already under regulator security rules. DPDP adds a duty owed to the customer.
Section 8(7) · Rule 8: Erasure and retention. PMLA and KYC periods set the floor. After them, erase.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Prevention of Money-laundering Act, 2002 and RBI KYC Master Direction, 2016	Keep transaction records for at least five years from the transaction, and identity records for at least five years after the relationship ends.	These periods override an erasure request. Explain the retention to the customer and stop every other use.	RBI KYC Master Direction
RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023	In force from 1 April 2024 for commercial banks, larger NBFCs, credit information companies and all-India financial institutions. Requires IT governance under the board, audit trails, logging and incident reporting to CERT-In and RBI.	Most of the DPDP security duty is already here. Map controls once and use the evidence for both.	RBI
RBI Master Direction on Outsourcing of IT Services, 2023	The regulated entity stays responsible for outsourced IT, with contracts, audit rights and exit plans.	Line up DPDP processor contracts with this direction, so one schedule meets both.	RBI
RBI direction on storage of payment system data, 2018	All data relating to payment systems must be stored only in India.	This is stricter than DPDP Section 16, and it continues to apply.	RBI
RBI rules on card storage and tokenisation (from 1 October 2022)	Only card issuers and card networks may store actual card data. Others use tokens, created with the cardholder's explicit consent.	Check logs, call recordings and support tickets for card numbers.	RBI
RBI (Digital Lending) Directions, 2025	Collect only need-based data with prior explicit consent and an audit trail. Apps should not access contacts, files, media or call logs; one-time access to camera, microphone or location is allowed for onboarding or KYC with consent.	Your app permissions and lending partner contracts are where DPDP and RBI meet.	RBI
IRDAI Information and Cyber Security Guidelines, 2023	Report cyber incidents to CERT-In within six hours, and to IRDAI within 24 hours of the CERT-In report.	One incident plan should run the CERT-In, IRDAI and Data Protection Board steps together.	IRDAI
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 2024	Security, logging and incident-reporting duties for SEBI-regulated entities. Stock brokers and depository participants report cyber incidents within six hours.	Use CSCRF evidence for DPDP security, then add notices, consent and rights.	SEBI
CERT-In Directions, 28 April 2022	Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to Indian time sources.	Applies to every BFSI entity in addition to the regulator's own clock.	CERT-In
Credit Information Companies (Regulation) Act, 2005	Governs what credit information is shared with credit bureaus and how errors are corrected.	Credit bureau sharing has its own law; DPDP rights requests about bureau data should point to that process too.	Act
RBI Integrated Ombudsman Scheme, 2021	Customers can escalate unresolved complaints to the RBI Ombudsman.	Privacy complaints may reach both the Ombudsman and the Data Protection Board. One complaint log helps.	RBI