Registered Broker
DPDP Readiness Infrastructure for SEBI-Registered Brokers
Your compliance officer will be asked for a documented DPDP position, prepared alongside the cyber resilience controls SEBI's Cybersecurity and Cyber Resilience Framework already requires of a stock broker. SEBI requires a stock broker's books of account and records to be kept for a minimum of eight years under regulation 16 of the SEBI (Stock Brokers) Regulations, 2026. KYC Record Agency (KRA) data creates independent consent obligations. The DPDP Act gives your clients the right to erasure. Your firm records the Regulation 16 retention period in the conflict-of-law register. The Legal Obligation Override then flags erasure requests against it and logs each refusal in a denial register, giving your compliance officer a printable, verifiable answer.
- DPDP obligations on Data Fiduciaries take effect
- 13 May 2027
- Books and records retention, SEBI (Stock Brokers) Regulations 2026, Regulation 16
- 8 years
- Maximum penalty under the DPDP Act
- 250 Cr
Compliance Readiness
The SEBI Cybersecurity and Cyber Resilience Framework, circular of 20 August 2024, already sets the cyber resilience controls a stock broker must evidence. The DPDP position is prepared alongside it. The answer "we are still assessing our obligations" is not a defensible compliance position. For brokers with concurrent RBI exposure, RBI Advisory No. 3/2026 (March 25, 2026) directs regulated entities toward centralized consent management, and the RBI Responsible Business Conduct Second Amendment Directions, 2026, notified on 15 June 2026, require explicit consent for each product or service and ban compulsory bundling. They come into effect on 1 January 2027. ConsentOS gives your compliance officer a printable readiness report and a documented, verifiable consent position.
Obligations
Your DPDP Obligations as a Registered Broker Company
The DPDP Act 2023 imposes specific requirements based on how your organisation processes personal data. These are the obligations most relevant to registered broker operations.
Ref 01
SEBI / DPDP Retention Conflict
SEBI requires a stock broker's books of account and records to be kept for a minimum of eight years under regulation 16 of the SEBI (Stock Brokers) Regulations, 2026. The DPDP Act requires erasure on demand. Legal Obligation Override documents the statutory exception and generates denial evidence for each rejected erasure request.
Ref 02
KYC Record Agency (KRA) Consent
KRA (CKYC) data sharing requires documented consent chains independent of SEBI KYC compliance. Each data access event by a KRA must be traceable to a specific, purpose-limited consent record under the DPDP Act.
Ref 03
Client Data Rights vs SEBI Records
DPDP erasure and access rights apply to all client personal data. Data held under SEBI statutory mandate is exempted from erasure, but the exemption must be documented and communicated to the client on request.
Ref 04
Trading Data Purpose Limitation
Trading data collected for order execution and portfolio management cannot be repurposed for research, marketing, or third-party analytics without documented, purpose-specific consent under Section 5.
Ref 05
Demat Account and Depository Data
CDSL/NSDL depository participant records carry independent retention obligations. Erasure requests that conflict with depository record-keeping requirements must be handled via documented Legal Obligation Override.
Ref 06
Algorithmic Trading and SDF Risk
Brokers using algorithmic or AI-driven trading systems that profile client behaviour at scale may be designated as Significant Data Fiduciaries, triggering DPO appointment, DPIA requirements, and enhanced audit obligations.
Ref 07
Breach Notification
A client trading data breach triggers both SEBI incident reporting and DPDP breach notification obligations simultaneously. Build a single incident response workflow that satisfies both deadlines.
Timeline
Your Compliance Roadmap
Key milestones between now and 13 May 2027, when the Act's obligations on Data Fiduciaries take effect.
Now
Build your readiness position
Map all personal data processing across trading, KYC, KRA, demat, and communication records. Document your DPDP posture alongside the cyber resilience controls the SEBI Cybersecurity and Cyber Resilience Framework (circular of 20 August 2024) requires.
Q3 2026
Implement Legal Obligation Override
Deploy the Compliance Vault: classify SEBI-retained data, flag it at erasure time, configure the denial register.
Nov 2026
Rule 4 applies
From 13 November 2026, registration with the Data Protection Board is mandatory for entities that operate as Consent Managers. A Data Fiduciary is not required to register, or to route consent through one.
Q1 2027
Client data rights workflows
Implement access, correction, and erasure workflows with SEBI statutory exemption handling.
May 2027
Obligations and penalties take effect
The maximum penalty, 250 crore, is for failing to take reasonable security safeguards under Section 8(5).
Penalty Exposure for Registered Broker Companies
Section 33 of the DPDP Act prescribes penalties based on violation type. Each amount is the ceiling for that category of breach.
Recommended Plan
Compliance Vault for Registered Broker
Regulation 16 of the SEBI (Stock Brokers) Regulations, 2026 requires books of account and records to be kept for a minimum of eight years, and a DPDP erasure request does not override that. The Compliance Vault tier records each refusal in the denial register, applies the Legal Obligation Override, and schedules the eventual erasure on the retention dashboard (Roadmap: H2 2026).
₹5,00,000 one-time
- Legal Obligation Override (RBI / PMLA)
- Retention schedule dashboard, per data category (Roadmap: H2 2026)
- Denial register for statutory erasure exceptions
- DPBI-ready audit evidence packs
- 72-hour breach notification pipeline (Roadmap: H2 2026)
- Dedicated compliance support manager
Resources
Essential Reading for Registered Broker
The DPDP provisions that bear most on your sector, in detail.
Fintech DPDP Compliance: RBI Data Localisation and Payment Rules
How a fintech complies with the DPDP Act 2023: data inventory across payment flows, purpose-specific consent, security safeguards, and breach readiness, alongside RBI data localisation mandates.
10 min read
Regulatory UpdatesWhat Is the DPDP Act 2023? Guide for Indian Business Compliance
India's Digital Personal Data Protection Act 2023 decoded: 7 obligations for every Data Fiduciary, the Data Principal rights, penalties up to ₹250 crore.
6 min read
Regulatory UpdatesDPDP Penalties: ₹250 Crore Risk and Enforcement Tiers in India
A breakdown of every penalty provision in the DPDP Act 2023. Understand the financial exposure, the enforcement mechanism, and what triggers each penalty tier.
7 min read
FAQ
Registered Broker compliance, answered.
Can a broker refuse a DPDP erasure request for trading records?
Yes. SEBI requires a stock broker's books of account and records to be kept for a minimum of eight years under regulation 16 of the SEBI (Stock Brokers) Regulations, 2026. Where data is held under this statutory obligation, the DPDP Act's erasure right does not override the mandate. ConsentOS documents this exception in a denial register with DPBI-ready justification.
How does KRA data sharing interact with the DPDP Act?
KRA (CKYC) data access events are personal data processing activities under the DPDP Act. Each KRA data sharing instance must be traceable to a specific, purpose-limited consent record. ConsentOS captures and maintains these consent chains, ensuring both SEBI KYC compliance and DPDP consent requirements are met simultaneously.
Do depository participant records count as personal data under DPDP?
Yes. Demat account records, holdings data, and transaction histories containing personal identifiers are personal data under the DPDP Act. Retention mandated by CDSL/NSDL rules is covered by the Legal Obligation Override, but only for the specific data and period required by the depository.
Could our brokerage be classified as a Significant Data Fiduciary?
Section 10 lets the Central Government notify a Data Fiduciary as a Significant Data Fiduciary, having regard to factors that include the volume and sensitivity of the personal data it processes and the risk to the rights of Data Principals. A large broker's client financial data bears on both. No entity had been notified as of September 2026. The Compliance Vault tier is built for SDF compliance. DPO support, DPIA workflows, and enhanced audit trails included.
When Your Compliance Officer Is Asked, Have the Answer Ready
The free DPDP Gap Assessment takes less than ten minutes. You receive a scored compliance report with a prioritised action list.