DPDP ACT 2023 COMPLIANCE
Where DPDP erasure rights collide with RBI and IRDAI retention mandates. Consent capture, audit records, Compliance Vault. Operational in 30 days.
From ₹2,999 per month with a one-time implementation fee. Starter covers readiness tooling. Consent capture starts at Growth.
RBI KYC Master Direction · retained 5 years · documented override
Sector regulators inspect today
RBI, IRDAI, SEBI, CERT-In
Consent Manager registration mandatory
… days remaining
Penalty enforcement begins
… days remaining
No DPDP penalty is being issued today. The Data Protection Board has no Chairperson or Members appointed. The demand for evidence arrives from a different direction.
RBI, IRDAI, SEBI, and CERT-In already ask for the consent record, the retention basis, and the rights request log in the current inspection cycle. In May 2026, the Supreme Court directed the Ministry of Electronics and IT to examine a petition on the recovery of stolen personal data held on foreign servers.
Penalty enforcement begins 13 May 2027. Companies that build compliance infrastructure now avoid the cost and disruption of acting under enforcement pressure.
New to India's data protection law? Read the DPDP Act 2023 compliance guide: what it requires, who it applies to, and the enforcement timeline. Or browse all DPDP compliance guides, or compare platforms in the 2026 buyer's guide.
44
DPDP compliance guides published
26
Obligations tracked in the free checklist
4
Sector regulators covered
RBI · IRDAI · SEBI · DPBI
Every sector below carries the same collision: a sector regulator mandates retention, while the DPDP Act mandates erasure once consent is withdrawn or the purpose ends, unless another law requires the record to be kept. ConsentOS documents that override on a single audit trail.
Select your sector to see your specific DPDP obligations.
KYC Retention Conflict
The RBI KYC Master Direction mandates KYC record retention for five years after the relationship ends; DPDP Act Section 8(7) requires erasure when consent is withdrawn or the specified purpose is no longer served, unless another law requires the record to be kept. ConsentOS classifies statutory-hold data under the Compliance Vault's documented override and flags any erasure request that touches it.
Credit Bureau Consent (Section 6)
Sharing credit history with bureaus requires free, specific, informed consent under Section 6 of the DPDP Act. Bundled consent forms fail that test and carry penalty exposure of up to Rs 50 crore under the Act's Schedule.
Data Localisation
Personal financial data must be processed on servers located in India. Cross-border transfers for co-lending or co-origination partnerships require documented transfer safeguards.
UPI / BNPL Consent Flows
Every payment mandate and lending decision requires a separate, granular consent record. Pre-checked authorisation boxes are explicitly non-compliant under DPDP Section 6.
72-Hour Breach Notification (Section 8(6))
A personal data breach triggers notice to affected Data Principals and initial intimation to the Data Protection Board without delay, with a detailed Board report within 72 hours under Rule 7. Incident response plans and notification templates must be drafted and approved in advance.
AML Retention vs DPDP Erasure
PMLA 2002 mandates 5-year transaction record retention. Erasure requests must be evaluated against this statutory obligation before deletion. The evaluation itself must be documented.
SEBI KYC vs DPDP Erasure
SEBI mandates 7-year retention of trading records and client communications. DPDP erasure requests cannot override this statutory obligation, but the rationale for withholding deletion must be documented and communicated to the investor.
Purpose Limitation for Research
Investor profile data collected for trade execution cannot be reused for research recommendations or cross-sell without separate, purpose-specific consent under Section 6. Co-mingling purposes breaches purpose limitation and carries exposure under the Act's Schedule.
Trading Data Minimisation
Only data necessary for trade execution and regulatory compliance may be collected and retained. Collecting excess demographic or behavioural data without a stated purpose creates exposure under the Act's Schedule.
Health & Medical Data
Health records, medical history, and biometric data used in underwriting are personal data under the DPDP Act and sit under the ABDM Health Data Management Policy as well. Consent must be specific to the underwriting purpose, and processing is bounded by both regimes.
Claims Data Retention
IRDAI requires claims documentation to be retained for 3 years post-settlement. This creates a statutory retention override that must be logged in the Compliance Vault before honouring erasure requests.
Policyholder Marketing Consent
Consent for marketing communications must be captured separately from service and policy consent. Pre-ticked opt-in checkboxes are explicitly banned under DPDP Section 6(1).
The Conflict
RBI mandates 5-year KYC retention. DPDP requires erasure on request. Many fintechs are building consent systems that satisfy neither regulator. They have no audit trail to prove otherwise.
DPDP Act, Section 8(7)
Erase personal data when the Data Principal withdraws consent or the specified purpose is no longer served, unless another law requires retention.
RBI KYC Master Direction, 2016
Retain KYC and customer identification records for five years after the end of the business relationship.
The Resolution
Every consent is captured at the point of collection, with the timestamp and the actor on the record. Data held under a statutory mandate is governed by a documented Legal Obligation Override. Every other category follows DPDP erasure on request. One audit trail proves both obligations to either regulator.
ConsentOS supports resolution of this conflict via the Compliance Vault. Your team does not choose between two regulators.
Every consent record is logged, timestamped, and attributed at the moment of capture. Withdrawals update the audit trail in real time. The record of what was consented to, and when it changed, persists.
Integrates into existing data flows without requiring product teams to rebuild core features. The compliance layer runs alongside your product, not against it.
The moment consent is withdrawn, ConsentOS records the withdrawal, signs the event, and flags every downstream purpose as withdrawn. This is not an error state. It is a recorded boundary, and it is by design.
ConsentOS is built for India's regulated sectors, and nothing else. If your compliance challenge is different, we will tell you directly.
| If you need… | Better fit | ConsentOS is for… |
|---|---|---|
| Global compliance across 50+ countries | OneTrust (~₹84L/year minimum) | India-regulated fintech with RBI + DPDP dual obligations |
| Just a cookie consent banner for your website | CookieYes ($25/month) | Full compliance infrastructure: consent, vault, audit. Breach notification on the roadmap |
| A human compliance advisor or part-time DPO | Tsaaro or a Big 4 firm | Automated compliance workflows that run without your team's ongoing intervention |
| ABDM-aligned patient consent without a second compliance system | A hospital-specific IT vendor | Hospitals where ABDM consent and DPDP data rights are the same patient record |
Global compliance across 50+ countries
Just a cookie consent banner for your website
A human compliance advisor or part-time DPO
ABDM-aligned patient consent without a second compliance system
ConsentOS serves NBFCs, fintech lenders, registered brokers, insurance companies, and hospitals. The common condition: DPDP obligations and a sector regulator's mandates govern the same records, and the two conflict. If that is not your situation, one of the options above will serve you better.
From your first assessment to an ongoing audit trail, ConsentOS handles each stage.
Step 1
Complete the free DPDP Gap Assessment. Ten questions across five compliance areas. Takes less than ten minutes. You receive a scored PDF report with your compliance score and the exact gaps you need to close.
Step 2
ConsentOS integrates into your existing consent flows. Your engineering team makes targeted changes. Nothing is rebuilt from scratch. Your consent framework is operational within 30 days.
Step 3
Every consent record is withdrawal-ready from the moment of capture. Each withdrawal is recorded and signed as it arrives, and every downstream purpose is flagged for your team to act on.
The Digital Personal Data Protection Act 2023 is India's first comprehensive data protection law. It requires businesses to collect personal data with valid consent, honour Data Principal rights, and notify affected Data Principals and the Data Protection Board of personal data breaches under Rule 7. Penalties are tiered by obligation and reach up to ₹250 crore for failures of security safeguards.
ConsentOS handles DPDP Act compliance for regulated BFSI entities: consent capture, Compliance Vault for RBI and PMLA retention conflicts, audit records, and withdrawal processing. Built for NBFCs, fintech lenders, insurance companies, and registered brokers operating under dual regulatory obligations.
Operational compliance in 30 days: consent capture, audit records, and the Compliance Vault configured against your sector's retention mandates. Ongoing obligations run under the monthly retainer.
A Consent Manager is an entity registered with the Data Protection Board that lets Data Principals give, manage, review, and withdraw consent through a single platform. Registration requires meeting the conditions in the DPDP Rules 2025, including a ₹2 crore minimum net worth. Registration becomes mandatory on 13 November 2026, when Rule 4 comes into force; the Board is expected to publish the application process before then. ConsentOS operates as consent management infrastructure today and is built to interoperate with registered Consent Managers.
Plans start at ₹2,999 per month with a one-time implementation fee. Starter covers readiness tooling. Consent capture starts at Growth. Four tiers cover NBFCs, fintech lenders, brokers, insurance companies, and Significant Data Fiduciaries. Compare plans on the pricing page.
ConsentOS is built for India's regulated sectors: NBFCs, fintech lenders, registered brokers, insurance companies, and hospitals managing ABDM consent alongside DPDP obligations. Each carries dual obligations where a sector regulator and the DPDP Act govern the same records.
The free DPDP Gap Assessment covers five compliance areas under the DPDP Act 2023. Your compliance score appears on screen. The scored PDF report with a prioritised action list follows by email.
Start the Free DPDP Gap AssessmentNo commitment. Delivered within minutes.