DPDP ACT 2023 COMPLIANCE
Where DPDP erasure rights collide with RBI and IRDAI retention mandates. Consent capture, audit records, Compliance Vault. Operational in 30 days.
From ₹2,999 per month with a one-time implementation fee. Starter covers readiness tooling. Consent capture starts at Growth.
RBI KYC Directions, 2025 · retained 5 years · documented override
Sector regulators inspect today
RBI, IRDAI, SEBI, CERT-In
Consent Manager registration mandatory
… days remaining
Penalty provisions take effect
… days remaining
No DPDP penalty is being issued today. As of November 2026 we have not located any Gazette notification establishing the Data Protection Board of India or appointing its Chairperson or Members. On 7 October 2026 the Central Government told the Kerala High Court that the Board is constituted but not yet functional (2026:KER:77409). The demand for evidence arrives from a different direction.
RBI, IRDAI, SEBI, and CERT-In already ask for the consent record, the retention basis, and the rights request log in the current inspection cycle. In May 2026, the Supreme Court directed the Ministry of Electronics and IT to examine a petition on the recovery of stolen personal data held on foreign servers.
The Act's obligations on Data Fiduciaries and its penalty provisions take effect on 13 May 2027. Companies that build compliance infrastructure now avoid the cost and disruption of acting late against a fixed date.
New to India's data protection law? Read the DPDP Act 2023 compliance guide: what it requires, who it applies to, and the enforcement timeline. Or browse all DPDP compliance guides, or compare platforms in the 2026 buyer's guide.
44
DPDP compliance guides published
26
Obligations tracked in the free checklist
4
Sector regulators covered
RBI · IRDAI · SEBI · DPBI
Every sector below carries the same collision: a sector regulator mandates retention, while the DPDP Act mandates erasure once consent is withdrawn or the purpose ends, unless another law requires the record to be kept. ConsentOS documents that override on a single audit trail.
Select your sector to see your specific DPDP obligations.
KYC Retention Conflict
The RBI KYC Directions, 2025 mandate KYC record retention for five years after the relationship ends; DPDP Act Section 8(7) requires erasure when consent is withdrawn or the specified purpose is no longer served, and Section 12(3) when the Data Principal asks, unless the specified purpose or another law still requires the record to be kept. ConsentOS classifies statutory-hold data under the Compliance Vault's documented override and flags any erasure request that touches it.
Credit Bureau Consent (Section 6)
Sharing credit history with bureaus requires free, specific, informed consent under Section 6 of the DPDP Act. Bundled consent forms fail that test and carry penalty exposure of up to Rs 50 crore under the Act's Schedule.
Data Localisation
RBI requires payment system providers to store payment data only in India. The DPDP Act permits other transfers outside India unless the Central Government restricts a country by notification. Record each transfer.
UPI / BNPL Consent Flows
Every payment mandate and lending decision requires a separate, granular consent record. Pre-checked authorisation boxes are explicitly non-compliant under DPDP Section 6.
Breach Notification and the 72-Hour Report (Section 8(6))
A personal data breach triggers notice to affected Data Principals and initial intimation to the Data Protection Board without delay, with a detailed Board report within 72 hours under Rule 7. Incident response plans and notification templates must be drafted and approved in advance.
AML Retention vs DPDP Erasure
PMLA 2002 mandates 5-year transaction record retention. Erasure requests must be evaluated against this statutory obligation before deletion. The evaluation itself must be documented.
SEBI KYC vs DPDP Erasure
SEBI requires a stock broker's books of account and records to be kept for a minimum of eight years under regulation 16 of the SEBI (Stock Brokers) Regulations, 2026. DPDP erasure requests cannot override this statutory obligation, but the rationale for withholding deletion must be documented and communicated to the investor.
Purpose Limitation for Research
Investor profile data collected for trade execution cannot be reused for research recommendations or cross-sell without separate, purpose-specific consent under Section 6. Co-mingling purposes breaches purpose limitation and carries exposure under the Act's Schedule.
Trading Data Minimisation
Only data necessary for trade execution and regulatory compliance may be collected and retained. Collecting excess demographic or behavioural data without a stated purpose creates exposure under the Act's Schedule.
Health & Medical Data
Health records, medical history, and biometric data used in underwriting are personal data under the DPDP Act and sit under the ABDM Health Data Management Policy as well. Consent must be specific to the underwriting purpose, and processing is bounded by both regimes.
Claims Data Retention
IRDAI requires claims documentation to be retained for 3 years post-settlement. This creates a statutory retention override that must be logged in the Compliance Vault before honouring erasure requests.
Policyholder Marketing Consent
Consent for marketing communications must be captured separately from service and policy consent. Pre-ticked opt-in checkboxes are explicitly banned under DPDP Section 6(1).
The Conflict
RBI mandates 5-year KYC retention. DPDP requires erasure on request. Many fintechs are building consent systems that satisfy neither regulator. They have no audit trail to prove otherwise.
DPDP Act, Sections 8(7) and 12(3)
Erase personal data when consent is withdrawn or the purpose is served, unless a law requires retention. On request, erase unless the specified purpose or a law still needs it.
RBI KYC Directions, 2025
Retain KYC and customer identification records for five years after the end of the business relationship.
The Resolution
Every consent is captured at the point of collection, with the timestamp and the actor on the record. Data held under a statutory mandate is governed by a documented Legal Obligation Override. Every other category follows DPDP erasure on request. One audit trail proves both obligations to either regulator.
ConsentOS supports resolution of this conflict via the Compliance Vault. Your team does not choose between two regulators.
Every consent record is logged, timestamped, and attributed at the moment of capture. Withdrawals update the audit trail in real time. The record of what was consented to, and when it changed, persists.
Integrates into existing data flows without requiring product teams to rebuild core features. The compliance layer runs alongside your product, not against it.
A withdrawal changes the record's status and signs the event in one database transaction. A receipt then opens for every destination your team has registered. Each receipt moves to dispatched, then verified, when your team confirms that system has stopped processing.
Product evidence
{
"artifact": {
"id": "d30ff832-66cf-42c8-811b-2421badbebcd",
"org_id": "d7b5f6a4-43f5-4b1c-9648-6ca57d5cae6a",
"principal_email": "principal-two@sandbox.invalid",
"purpose_code": "service_delivery",
"consent_status": "withdrawn",
"mechanism": "import",
"schema_version": "1.0",
"granted_at": "2026-09-09T22:30:35.383+00:00",
"withdrawn_at": "2026-09-16T18:46:40.651+00:00",
"artifact_hash": "a0f8c3d0884dfb5010f1d220d9d4d7119812c831ff529f483811f013595e4bb8",
"signing_key_version": 1,
"created_at": "2026-09-11T22:30:35.849309+00:00",
"child_record": false
},
"events": [
{
"id": "0e4ada26-f331-45b4-ade8-3c1ea064835c",
"artifact_id": "d30ff832-66cf-42c8-811b-2421badbebcd",
"event_type": "granted",
"actor": "system",
"mechanism": "import",
"event_hash": "fcfc3deef6d5abf360c3f415a60b027628f361d51c16eb81af734f56a297249c",
"created_at": "2026-09-09T22:30:35.383+00:00",
"hash_valid": true
},
{
"id": "71e40070-8d8a-4465-b685-f9c2427e00cf",
"artifact_id": "d30ff832-66cf-42c8-811b-2421badbebcd",
"event_type": "withdrawn",
"actor": "data_fiduciary",
"mechanism": "withdrawal_form",
"event_hash": "908d3db4d4132d70161fe1f0ec11fe9a04412f792afa26aea03bfed9a405ffb6",
"created_at": "2026-09-16T18:46:40.651+00:00",
"request_context": {},
"hash_valid": true
}
],
"verification": {
"hash_valid": true,
"events_total": 2,
"events_valid": 2,
"events_unverifiable": 0,
"integrity": "valid"
}
}ConsentOS is built for India's regulated sectors, and nothing else. If your compliance challenge is different, we will tell you directly.
| If you need… | Better fit | ConsentOS is for… |
|---|---|---|
| Privacy compliance across many jurisdictions | OneTrust (price quoted per customer) | India-regulated fintech with RBI + DPDP dual obligations |
| Just a cookie consent banner for your website | CookieYes (free plan, paid from US$10 a month per domain) | Full compliance infrastructure: consent, vault, audit, Breach Incident Register with the CERT-In and Rule 7 clocks. Automated breach alerts on the roadmap |
| A human compliance advisor or part-time DPO | Tsaaro or a Big 4 firm | Software your team runs: the Legal Obligation Override flags each retention conflict and supports its resolution, an administrator decides, and ConsentOS records the decision. |
| ABDM-aligned patient consent without a second compliance system | A hospital-specific IT vendor | Hospitals where ABDM consent and DPDP data rights are the same patient record |
ConsentOS serves NBFCs, fintech lenders, registered brokers, insurance companies, and hospitals. The common condition: DPDP obligations and a sector regulator's mandates govern the same records, and the two conflict. If that is not your situation, one of the options above will serve you better.
From your first assessment to an ongoing audit trail, ConsentOS handles each stage.
Complete the free DPDP Gap Assessment. Ten questions across five compliance areas. Takes less than ten minutes. You receive a scored PDF report with your compliance score and the exact gaps you need to close.
ConsentOS integrates into your existing consent flows. Your engineering team makes targeted changes. Nothing is rebuilt from scratch. Your consent framework is operational within 30 days.
Every consent record can be withdrawn from the moment it is captured. Each withdrawal is signed on arrival and opens a receipt for every system your team has registered, so the stop is tracked destination by destination.
The Digital Personal Data Protection Act 2023 is India's first dedicated data protection law. It requires businesses to collect personal data with valid consent, honour Data Principal rights, and notify affected Data Principals and the Data Protection Board of personal data breaches under Rule 7. Penalties are tiered by obligation and reach up to ₹250 crore for failures of security safeguards.
ConsentOS handles DPDP Act compliance for regulated BFSI entities: consent capture, Compliance Vault for RBI and PMLA retention conflicts, audit records, and withdrawal processing. Built for NBFCs, fintech lenders, insurance companies, and registered brokers operating under dual regulatory obligations.
Operational compliance in 30 days: consent capture, audit records, and the Compliance Vault configured against your sector's retention mandates. Ongoing obligations run under the monthly retainer.
A Consent Manager is an entity registered with the Data Protection Board that lets Data Principals give, manage, review, and withdraw consent through a single platform. Registration requires meeting the conditions in the DPDP Rules 2025, including a ₹2 crore minimum net worth. Registration becomes mandatory on 13 November 2026, when Rule 4 comes into force; the Board is expected to publish the application process before then. ConsentOS operates as consent management infrastructure today. A network API for working with registered Consent Managers is on the roadmap.
Plans start at ₹2,999 per month with a one-time implementation fee. Starter covers readiness tooling. Consent capture starts at Growth. Four tiers cover NBFCs, fintech lenders, brokers, insurance companies, and Significant Data Fiduciaries. Compare plans on the pricing page.
ConsentOS is built for India's regulated sectors: NBFCs, fintech lenders, registered brokers, insurance companies, and hospitals managing ABDM consent alongside DPDP obligations. Each carries dual obligations where a sector regulator and the DPDP Act govern the same records.
The free DPDP Gap Assessment covers five compliance areas under the DPDP Act 2023. Your compliance score appears on screen. The scored PDF report with a prioritised action list follows by email.
Start the Free DPDP Gap AssessmentNo commitment. Delivered within minutes.