DPDP for the Internal audit department in BFSI

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · RBI KYC Master Direction · RBI · RBI · RBI

The internal audit team in BFSI runs branch, IT and outsourcing audits. DPDP checks can be folded into each of them.

Written for: Internal audit department, Banking, financial services and insurance. Open this seat in the interactive tool

What is different here

Branch audits can check notices on forms, locked KYC copies and logged walk-in requests. IT audits can check log retention and masking of card numbers. Outsourcing audits can check data schedules and deletion certificates from partners.

The first four things to sort out

Add a DPDP section to the branch audit checklist.
Check that card and account numbers are masked in logs.
Ask partners for signed data schedules and deletion certificates.
Sample walk-in privacy requests for same-day logging.

A worked example

Internal audit department

DPDP checks in a routine branch audit

Day 1Auditors check that account and loan forms carry the current notice. Two bundles of old forms are found and withdrawn.
Day 1KYC photocopies are found in an unlocked drawer. The branch head locks them away and the DPO is told.
Day 2The privacy request register shows one walk-in request logged three days late.
AfterFindings go into the branch audit report with owners and dates, and are checked at the next audit.

Evidence kept

Branch checklist
Findings with photos
Branch head response
Follow-up audit result

DPDP fits into the branch audit you already run.

What others in the sector usually do. Many audit teams start with the branch checklist, because it is short and the findings are easy to fix.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Scheduled commercial bank	Cross-selling insurance and mutual funds on account terms; Business correspondent devices and paper forms in villages; Old core banking archives with no deletion path
Co-operative bank (urban or rural)	Vendor-run core banking with admin access from the vendor's office; Member and share registers kept on open shelves; Directors and staff who are also members and relatives of borrowers
NBFC and digital lender	Apps asking for contacts, photos and call logs; Collection agents sharing borrower details with family or employers; Leads bought from aggregators with no consent record
Insurance company (life, general or health)	Medical reports passed to TPAs and hospitals by email; Agent and broker access to policyholder data; Claims data kept long after the claim is closed
Broking, depository and wealth	Authorised persons with client lists on personal phones; Research-tip calls to people who never consented; Client KYC copies shared over email with partners
Payments and fintech	Card numbers in logs and support tickets; Merchant onboarding documents in shared drives; Fraud models that use data beyond what users were told

10 questions the Internal audit department asks, answered in full

One incident, many regulators: how do we meet every clock?

Short answer: Six hours for CERT-In; regulator as its rules say; DPDP without delay and 72 hours

Most BFSI incidents need a CERT-In report within six hours, a report to your regulator as its rules require (IRDAI asks within 24 hours of the CERT-In report), and DPDP messages to customers and the Data Protection Board without delay, with a detailed Board report in 72 hours. One playbook with one timeline avoids missed steps.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. CERT-In and your regulator set the others. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps

Put every clock on one page.
Name who files each report.
Keep templates ready.
Rehearse with all filers present.
Log the time each report went.

Evidence to keep

Clock page
Templates
Drill record

Common mistakes

Separate playbooks per regulator
DPO told last
No customer message template

What can collection agents do with borrower data?

Short answer: Only what is needed, under your contract and RBI conduct rules

Collection agents act for you, so you are responsible for what they do. They should get only the data needed to contact the borrower, use it only for collection, and never share the debt with family, friends or employers. RBI's rules on recovery conduct, including calling hours, apply alongside DPDP.

What the law says

Section 8(1) and 8(2) make you responsible for processors. Section 8(5) needs safeguards. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 6

Steps

Share only name, contact details and the amount due.
Put data terms and conduct rules in every agency contract.
Record calls and review a sample.
Ban use of the borrower's phone contacts.
Take back or delete data when the account closes.

Evidence to keep

Agency contracts
Call review records
Data return certificates

Common mistakes

Sending full loan files to agencies
Agents calling relatives
No deletion after the account closes

Can a policy show that a control actually works?

Short answer: No; operation needs records

No. A policy shows what an organisation intends. It does not show that the control runs. To show operation you need records: a deletion log, an access review sign-off, a drill report, a sample of requests answered on time. Auditors and regulators look for these.

From your seat: Internal audit department. Test five samples end to end.

What the law says

Section 8(4) asks for appropriate technical and organisational measures to ensure compliance. Being able to show those measures work is part of meeting that duty. Section 8(5) · Rule 6 · Section 8(1)–(2)

Steps

For each policy, write the record that would show it working.
Check whether that record exists for the last quarter.
Where it does not, start producing it.
Sample a few records every quarter.
Keep the samples with the policy.

Evidence to keep

Policy-to-record map
Quarterly samples
Gaps and actions

Common mistakes

Approving policies with no record behind them
Showing a policy when asked for evidence
Records that exist only before an audit

What evidence should exist before management accepts that we are ready?

Short answer: Evidence for each duty, not status colours

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

From your seat: Internal audit department. Ask for the evidence list first.

What the law says

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(9)–(10) · Rules 9, 14

Steps

List the duties that apply.
For each, name the piece of evidence that would satisfy an auditor.
Ask owners to attach it.
Mark duties without evidence as open, not ready.
Review the list before each management sign-off.

Evidence to keep

Duty-to-evidence list
Attached evidence
Sign-off record

Common mistakes

Accepting 'done' without seeing anything
Counting policies as evidence
One sign-off and no review after

Which logs must we keep, for how long, and where?

Short answer: At least one year; 180 days of ICT logs in India

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

From your seat: Internal audit department. Check logs exist for the period.

Example in BFSI

Core banking, internet banking and card systems already log heavily. Check retention and that logs stay in India.

What the law says

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Sync clocks and review alerts every day.

Evidence to keep

Log source list
Retention settings
Alert review records

Common mistakes

Logging only failures, not who viewed a record
Logs stored on the same server they describe
Clocks out of sync, so timelines cannot be built

Who should be able to see personal data in our systems?

Short answer: Only those who need it, reviewed every quarter

Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.

From your seat: Internal audit department. Compare access lists with leavers.

Example in BFSI

Mark staff and VIP accounts so only a small team can view them.

What the law says

Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6

Steps

Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Review access every quarter with each manager.
Remove access on the last working day.

Evidence to keep

Role matrix
Quarterly review sign-offs
Leaver removal report

Common mistakes

Generic logins on shared machines
Access that only grows
No review of vendor accounts

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: Internal audit department. Read the top contracts.

Example in BFSI

Collection agencies, BCs, DSAs, KYC vendors, card processors and the core banking vendor all need data schedules aligned with RBI outsourcing rules.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

How long can we keep personal data?

Short answer: For the legal or business period, then erase

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

From your seat: Internal audit department. Check one deletion run.

Example in BFSI

PMLA and RBI KYC rules set the floor at five years for identity and transaction records.

What the law says

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

Steps

List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.

Evidence to keep

Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates

Common mistakes

'Keep everything forever' because storage is cheap
Deleting before the legal minimum
Forgetting email, shared drives and backups

How do we put DPDP into the risk register?

Short answer: One line per duty, with owner and evidence

Turn each duty into a risk line with an owner, a control, evidence and a review date. Map controls you already run for your regulator, auditors or certifications, so the same evidence serves several purposes. Track vendor risk separately.

From your seat: Internal audit department. Test each control.

Example in BFSI

Link RBI IT governance and outsourcing controls as evidence.

What the law says

The Act sets duties in Sections 5 to 12. A risk register shows management where each duty stands. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 10 · Rule 13

Steps

List the duties that apply to you.
For each, write the risk in plain words, the control and the owner.
Link existing controls and audits as evidence.
Rate likelihood and impact in your usual way.
Review every quarter with management.

Evidence to keep

Risk register extract
Linked evidence
Quarterly review minutes

Common mistakes

One line saying 'DPDP compliance'
No owners
Evidence that is only a policy document

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Internal audit department. Ask for drill findings.

Example in BFSI

A partner API leak may need CERT-In in six hours, your regulator's report, and the DPDP messages.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

The sections you will use most

Section 8(5) · Rule 6: Security safeguards. Core banking, policy and trading systems are already under regulator security rules. DPDP adds a duty owed to the customer.
Section 8(1)–(2): Responsibility for vendors. Collection agencies, KYC vendors, BCs, DSAs, call centres and cloud providers work for you. RBI, SEBI and IRDAI outsourcing rules apply alongside.
Section 8(6) · Rule 7: Telling people about a breach. One incident may go to CERT-In, your regulator and the Data Protection Board, each with its own clock.
Section 8(7) · Rule 8: Erasure and retention. PMLA and KYC periods set the floor. After them, erase.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Prevention of Money-laundering Act, 2002 and RBI KYC Master Direction, 2016	Keep transaction records for at least five years from the transaction, and identity records for at least five years after the relationship ends.	These periods override an erasure request. Explain the retention to the customer and stop every other use.	RBI KYC Master Direction
RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023	In force from 1 April 2024 for commercial banks, larger NBFCs, credit information companies and all-India financial institutions. Requires IT governance under the board, audit trails, logging and incident reporting to CERT-In and RBI.	Most of the DPDP security duty is already here. Map controls once and use the evidence for both.	RBI
RBI Master Direction on Outsourcing of IT Services, 2023	The regulated entity stays responsible for outsourced IT, with contracts, audit rights and exit plans.	Line up DPDP processor contracts with this direction, so one schedule meets both.	RBI
RBI direction on storage of payment system data, 2018	All data relating to payment systems must be stored only in India.	This is stricter than DPDP Section 16, and it continues to apply.	RBI
RBI rules on card storage and tokenisation (from 1 October 2022)	Only card issuers and card networks may store actual card data. Others use tokens, created with the cardholder's explicit consent.	Check logs, call recordings and support tickets for card numbers.	RBI
RBI (Digital Lending) Directions, 2025	Collect only need-based data with prior explicit consent and an audit trail. Apps should not access contacts, files, media or call logs; one-time access to camera, microphone or location is allowed for onboarding or KYC with consent.	Your app permissions and lending partner contracts are where DPDP and RBI meet.	RBI
IRDAI Information and Cyber Security Guidelines, 2023	Report cyber incidents to CERT-In within six hours, and to IRDAI within 24 hours of the CERT-In report.	One incident plan should run the CERT-In, IRDAI and Data Protection Board steps together.	IRDAI
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), 2024	Security, logging and incident-reporting duties for SEBI-regulated entities. Stock brokers and depository participants report cyber incidents within six hours.	Use CSCRF evidence for DPDP security, then add notices, consent and rights.	SEBI
CERT-In Directions, 28 April 2022	Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to Indian time sources.	Applies to every BFSI entity in addition to the regulator's own clock.	CERT-In
Credit Information Companies (Regulation) Act, 2005	Governs what credit information is shared with credit bureaus and how errors are corrected.	Credit bureau sharing has its own law; DPDP rights requests about bureau data should point to that process too.	Act
RBI Integrated Ombudsman Scheme, 2021	Customers can escalate unresolved complaints to the RBI Ombudsman.	Privacy complaints may reach both the Ombudsman and the Data Protection Board. One complaint log helps.	RBI