DPDP Insights › Questions › Can we cross-sell insurance, cards or mutual funds to existi

Question · Banking, financial services and insurance

Can we cross-sell insurance, cards or mutual funds to existing customers?

Short answer: Only with separate, specific consent

Only with specific consent for that purpose. Account opening terms do not count as consent to receive offers or to have data shared with a partner insurer or fund house. Service messages about the customer's own account are different and do not need marketing consent.

What the law says

Section 6 needs specific consent for each purpose. Section 5 needs a notice that names the purpose.

Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.

Steps

Separate service messages from offers in your systems.
Ask consent for offers and partner sharing separately, by channel.
Record consent by purpose and partner.
Check the record before each campaign.
Pass withdrawals to partners the same day.

Evidence to keep

Consent records by purpose and partner
Campaign approval with consent check
Withdrawal logs

Common mistakes

Using account terms as consent
Partners calling from their own lists
Withdrawal not reaching partners

From each seat

DPO / Privacy lead: Own the consent-by-purpose record. It answers most cross-sell complaints.
CEO / MD: Back the rule even when it slows a campaign; mis-selling complaints cost more.
Legal & compliance: Draft separate consent wording for each partner product.
Branch / business head: Branch targets often push cross-selling. Check that each lead has consent.
Chief risk officer: Mis-selling and consent are linked risks; track them together.
Marketing department: No campaign leaves without a consent check.

What a good answer from management sounds like

“Every campaign is checked against consent by purpose. Partners receive only consented customers, and withdrawals reach them within a day.” Effort and time: Medium · 8 to 12 weeks.