Fintech
DPDP Compliance for Fintech Companies
RBI mandates 5-year KYC retention. The DPDP Act requires erasure on demand. Most fintechs have consent systems that satisfy neither regulator. ConsentOS supports resolution of both obligations simultaneously.
- DPDP obligations on Data Fiduciaries take effect
- 13 May 2027
- KYC record retention, RBI KYC Directions 2025
- 5 years
- Maximum penalty under the DPDP Act
- 250 Cr
Obligations
Your DPDP Obligations as a Fintech Company
The DPDP Act 2023 imposes specific requirements based on how your organisation processes personal data. These are the obligations most relevant to fintech operations.
Ref 01
RBI / DPDP Retention Conflict
RBI and PMLA require KYC and financial records to be retained for five years, with longer periods for contested records. The DPDP Act requires erasure when the stated purpose is fulfilled. The Compliance Vault supports resolution of this conflict: statutory-override data is held under a documented Legal Obligation Override, classified and documented against consent-based data, and never erroneously erased.
Ref 02
Granular Consent Mechanisms
Section 6 requires consent that is free, specific, informed, and unconditional. Each processing purpose (KYC, transaction monitoring, marketing, credit scoring) needs separate consent with clear withdrawal options.
Ref 03
Data Principal Rights
Section 11-14 grant data principals the right to access, correct, and erase personal data. KYC records held for RBI compliance must be reconciled with erasure requests through documented legal basis exceptions.
Ref 04
Breach Notification
Section 8 mandates notification to both the Data Protection Board and affected data principals. Financial data breaches carry reputational and regulatory consequences beyond DPDP penalties.
Ref 05
RBI Data Localisation
RBI requires payment system data to be stored within India. DPDP cross-border transfer provisions create an additional layer. Dual compliance is not optional.
Ref 06
Purpose Limitation
Section 5 restricts data processing to stated purposes. Transaction data collected for payment processing cannot be repurposed for credit scoring or marketing without fresh consent.
Ref 07
Security Safeguards
Section 8 requires reasonable security measures. For fintech, this means encryption at rest and in transit, access controls, and audit trails for all personal data processing.
Timeline
Your Compliance Roadmap
Key milestones between now and 13 May 2027, when the Act's obligations on Data Fiduciaries take effect.
Now
Map your data flows
Identify all personal data processing across KYC, payments, lending, and marketing systems.
Q3 2026
Implement consent framework
Deploy granular consent collection with purpose-specific opt-in for each processing activity.
Nov 2026
Rule 4 applies
From 13 November 2026, registration with the Data Protection Board is mandatory for entities that operate as Consent Managers. A Data Fiduciary is not required to register, or to route consent through one.
Q1 2027
Rights fulfilment system
Implement automated access, correction, and erasure workflows with RBI exemption handling.
May 2027
Obligations and penalties take effect
The maximum penalty, 250 crore, is for failing to take reasonable security safeguards under Section 8(5).
Penalty Exposure for Fintech Companies
Section 33 of the DPDP Act prescribes penalties based on violation type. Each amount is the ceiling for that category of breach.
Recommended Plan
Growth for Fintech
Growth covers up to 500K data principals and records every consent against the purpose it was given for, with the audit trail an RBI-supervised lender has to produce on request.
₹1,25,000 one-time
- Up to 500K data principals
- Consent capture via API and dashboard, HMAC-signed
- Rights Management Portal
- Breach Incident Register
- Priority email support
Resources
Essential Reading for Fintech
The DPDP provisions that bear most on your sector, in detail.
DPDP Consent Management: Technical Systems for Indian Businesses
The DPDP Act 2023 makes consent the legal foundation for data processing. This is what valid consent requires, how withdrawal works, and what your systems must support.
7 min read
Compliance Areas7 Data Fiduciary Obligations Under India's DPDP Act 2023
The DPDP Act imposes 7 obligations on every Data Fiduciary, with penalties reaching ₹250 crore at the top tier. What each obligation requires, section by section.
8 min read
Regulatory UpdatesDPDP Penalties: ₹250 Crore Risk and Enforcement Tiers in India
A breakdown of every penalty provision in the DPDP Act 2023. Understand the financial exposure, the enforcement mechanism, and what triggers each penalty tier.
7 min read
FAQ
Fintech compliance, answered.
How does the RBI KYC retention requirement interact with DPDP erasure?
They are in direct conflict. RBI and PMLA mandate retention of KYC and financial records for five years, longer for contested records. DPDP Section 8(7) requires erasure once the specified purpose is no longer served, unless retention is required by law, and Section 12(3) gives individuals the right to request erasure. The resolution is a Legal Obligation Override. Data held under a statutory mandate (RBI/KYC/AML) is documented separately and exempted from DPDP erasure requests. ConsentOS implements this as the Compliance Vault: a separate retention track for statutory-override data with a documented denial register for any erasure requests that would violate a legal retention obligation.
Does the DPDP Act apply to payment data?
Yes. Any personal data processed in connection with financial transactions, including KYC records, transaction histories, and account details, falls under the DPDP Act. This applies in addition to RBI data localisation requirements.
How does RBI localisation interact with DPDP?
RBI mandates that payment system data be stored in India. The DPDP Act adds consent and rights obligations on top. Fintech companies must comply with both frameworks simultaneously, which affects data architecture and consent flows.
Will fintech companies be classified as Significant Data Fiduciaries?
Large fintech companies processing high volumes of financial data are likely candidates for SDF classification. This triggers additional obligations including mandatory DPO appointment, periodic audits, and Data Protection Impact Assessments.
RBI requires the KYC record for five years. The erasure request arrives anyway.
The free DPDP Gap Assessment takes less than ten minutes. You receive a scored compliance report with a prioritised action list.