DPDP Compliance for Banks: RBI KYC Retention vs Erasure Rights

Two Mandates Govern the Same Customer Record

A customer closes a savings account and submits a request to erase their personal data. The Digital Personal Data Protection Act 2023 gives them that right. The RBI Master Direction on KYC and the Prevention of Money Laundering Act require the bank to keep the same records for years after the account is closed. Both obligations bind the bank. Both carry penalties. They point in opposite directions over the same data.

This is the structural compliance problem every scheduled commercial bank in India now holds. It is not resolved by choosing one law over the other. The DPDP Act provides a defined mechanism, the legal-obligation carve-out in Section 8(7), that lets a bank retain data where a law mandates it. The carve-out is not a blanket exemption. It applies field by field, purpose by purpose, and every retention decision must be recorded with a documented justification.

This guide is written for compliance officers, Data Protection Officers, and technology heads at banks. It covers what each framework requires, where the override applies, how a bank’s specific data maps to its retention basis, and the Significant Data Fiduciary duties that apply to banks before substantive enforcement begins in May 2027.

What a Bank Must Do Now

Five actions decide a bank’s DPDP position. Each is covered in depth below.

1. Map every customer data field to its retention basis. KYC and transaction records sit under the RBI Master Direction and PMLA Rules. Everything else sits under consent. Start with a personal data inventory; no other step works without it.
2. Separate consent for non-mandated processing. Cross-selling, marketing, and analytics need purpose-specific consent records. The RBI Business Conduct Directions, in force since July 1, 2026, already prohibit bundled consent for banks.
3. Decide erasure requests field by field under Section 8(7). Erase what no law requires. Register what is retained, naming the instrument and the retention period. The KYC retention matrix maps the instruments and clocks.
4. Prepare dual breach reporting. CERT-In’s 6-hour reporting obligation is in force today. The 72-hour notification to the Data Protection Board becomes enforceable in May 2027. Build one workflow that satisfies both.
5. Assume Significant Data Fiduciary designation. An India-based Data Protection Officer, periodic impact assessments, and an independent data audit follow from SDF status. Most scheduled commercial banks should plan for it.

For the same conflict viewed from the lending side, see DPDP compliance for NBFCs. For the full field-by-field resolution framework, see the RBI-DPDP retention conflict guide.

What Each Framework Requires

The DPDP Act erasure obligation

Section 8(7) of the DPDP Act requires a Data Fiduciary to erase personal data when the purpose of processing is no longer served or when the Data Principal withdraws consent, “unless retention of such personal data is necessary for compliance with any law for the time being in force.” Section 12(3) gives the Data Principal the right to request that erasure directly.

The carve-out is the operative phrase. Where another law requires retention, the bank has a lawful basis to keep the covered data. Where no law requires it, the data must be erased on request.

RBI KYC and PMLA retention

The RBI Master Direction on Know Your Customer (KYC) Direction, 2016 requires regulated entities to preserve customer identity records for at least five years after the business relationship ends. The Prevention of Money Laundering (Maintenance of Records) Rules, 2005 set the same five-year minimum: identity records for five years from the cessation of the relationship, and transaction records for five years from the date of the transaction.

A ten-year figure circulates in industry guidance. It is not the current KYC minimum. It traces to legacy PMLA rules amended in 2012, to the Payment and Settlement Systems Act, 2007 for certain system operators, or to a bank’s own conservative policy. For standard KYC identity and transaction records, the statutory floor under the RBI and the PMLA is five years.

The conflict is therefore precise. A customer’s erasure request arrives. The RBI and the PMLA say the KYC and transaction records must stay for five years. Neither obligation is optional.

The Override Lives in Section 8(7)

The resolution is the carve-out itself, applied with discipline. A general claim of “RBI requirements” does not satisfy the Act. To rely on Section 8(7), a bank must identify the exact statutory provision that mandates retention of a specific data category, record the retention period that provision sets, isolate that data from the standard erasure workflow, and tell the Data Principal which fields were retained and on what basis.

This classify-isolate-document pattern is the same mechanism the industry applies across regulated finance. The RBI-DPDP retention conflict guide sets out the full framework: the three retention classes, the separate retention tracks, and the denial register that records every refused erasure request. Rather than repeat that framework here, this guide applies it to a bank’s specific data.

A Bank’s Data, Mapped to Its Retention Basis

The override covers only the fields a law requires a bank to retain. Everything else follows the ordinary erasure rule. The grey zone between the two is where audit risk sits, so each category must be mapped to a named provision.

Bank data field	Retention basis	Period	Override applies
Account-opening KYC (PAN, identity, address proof)	RBI KYC Master Direction; PMLA Rules	5 years post-closure	Yes
Customer photograph and CDD records	RBI KYC Master Direction	5 years post-closure	Yes
Deposit and transaction history	PMLA (Maintenance of Records) Rules	5 years from transaction	Yes
SWIFT and cross-border wire transfer records	PMLA Rules; RBI wire transfer requirements	5 years (10 only for PSS Act system operators)	Yes
Safe-deposit locker agreements and access logs	RBI locker directions; contract law	Per applicable mandate	Partial
Net-banking and mobile-app usage logs	None	None mandated	No, erase on request
Marketing preferences and campaign history	DPDP consent	Duration of purpose	No, erase on request
Cross-sell and behavioural analytics	DPDP consent	Duration of purpose	No, erase on request

Two failure modes follow from getting this wrong. Over-erasure deletes records the PMLA requires, which the bank discovers during an inspection. Over-retention keeps everything to avoid the first error, which breaches the DPDP Act’s storage limitation. A bank needs both tracks running, with the classification driving system behaviour rather than sitting in a policy document. Build the map first through a personal data inventory.

Most Banks Will Be Significant Data Fiduciaries

This is where bank obligations exceed those of a smaller lender. The Central Government may notify any Data Fiduciary, or class of Data Fiduciaries, as a Significant Data Fiduciary based on the volume and sensitivity of personal data processed, the risk to Data Principals, and the potential effect on the security of the State. Scheduled commercial banks sit at the high end of every one of those factors.

A bank that is classified as a Significant Data Fiduciary carries the additional obligations in Section 10:

• Appoint a Data Protection Officer based in India, responsible to the board, who serves as the contact point for grievance redressal.
• Conduct periodic Data Protection Impact Assessments covering the processing activities that carry elevated risk to Data Principals.
• Engage an independent data auditor to evaluate compliance against the Act.

These duties run alongside the grievance-redressal mechanism every Data Fiduciary must establish under Section 8(10), with the Data Principal’s right to that redressal set out in Section 13. A bank should assume Significant Data Fiduciary status in its planning rather than wait for notification, because the lead time to stand up a DPO function and an audit cycle is measured in quarters. See the Significant Data Fiduciary guide for the full set of duties.

Dual Breach Reporting for Banks

A single security incident at a bank triggers reporting obligations under more than one framework, each with its own recipient and clock.

Trigger	Report to	Timeline	Basis
Cyber incident	CERT-In	6 hours	CERT-In Directions 2022
Cyber incident	RBI, on the DAKSH platform	6 hours from detection	RBI (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, para 182
Personal data breach	Data Protection Board	72 hours	DPDP Act Section 8(6)
Personal data breach	Affected Data Principals	Without delay	DPDP Act Section 8(6)

One breach can therefore set four notifications in motion, in different formats and on different clocks. The DPDP duty to notify the Board and affected individuals sits under Section 8(6). The full procedure is covered in the breach notification guide. A catch block that swallows a failed notification is itself a Section 8(6) exposure, so the reporting path must be instrumented, not assumed.

Penalty Exposure

DPDP penalties are independent of, and additional to, any RBI enforcement action. The Schedule to the Act sets the maximum financial penalty per category.

Violation	Maximum penalty
Failure to take reasonable security safeguards that results in a breach	₹250 crore
Failure to notify the Board or affected Data Principals of a breach	₹200 crore
Non-fulfilment of obligations relating to children’s data	₹200 crore
Non-fulfilment of a Significant Data Fiduciary’s additional obligations	₹150 crore
Non-fulfilment of any other obligation, including a Data Principal’s erasure right	₹50 crore

For a bank, two of these tiers are specific to its scale. The ₹150 crore Significant Data Fiduciary tier applies to the DPO, audit, and impact-assessment duties that smaller entities do not carry. The ₹50 crore tier attaches to each mishandled erasure request. Both run on top of any penalty the RBI may impose under its own framework. Estimate the exposure with the penalty calculator.

Common Errors Banks Make

Treating RBI compliance as a DPDP exemption. “We are already RBI-regulated, so the DPDP Act is covered” does not hold. RBI compliance addresses some retention. It does not address consent management, purpose limitation, breach notification to individuals, or the right to correction. The DPDP obligations run independently. RBI’s own July 2026 draft Data Governance Guidance removes any doubt: it requires the data governance framework to comply with the DPDP Act and Rules.

Retaining everything for the longest period. Holding all customer data for ten years to be safe breaches the DPDP Act’s storage limitation. Only the fields covered by a named statutory mandate qualify for the override. The rest must be erased when the purpose ends or on request.

No documented basis per field. During an inspection, the Data Protection Board will ask for the legal basis for retaining a specific field. “The RBI requires it” is not an answer. The bank needs per-field documentation naming the instrument and the retention period.

Ignoring consent for non-mandated processing. Cross-selling, marketing, and behavioural analytics are not covered by the legal-obligation carve-out. They require separate, purpose-specific consent records, each traceable to the notice version in force at the time.

How ConsentOS Handles This for Banks

ConsentOS is built for regulated entities where data protection duties collide with sector-specific retention mandates. Its Compliance Vault treats the Section 8(7) carve-out as operating infrastructure rather than policy text.

• Conflict-of-law register. Where an RBI or PMLA retention mandate collides with a DPDP obligation, the conflict is documented with the governing instrument and the retention period, so the legal basis exists before an inspector asks for it.
• Legal Obligation Override at erasure time. When a Data Principal requests erasure, the request is checked against the registered statutory-retention conflicts. A conflict is flagged and documented. The decision stays with the bank’s compliance officer.
• A denial register for audit. Every refused erasure request is recorded with the statutory basis and the retention expiry date, available for the Data Protection Board on inspection.
• Breach Incident Register on two clocks. Each incident is logged against the CERT-In six-hour window, which is in force today, and the DPDP Rule 7 72-hour clock, enforceable from 13 May 2027, with letter drafts for each. It records and tracks. Submission stays with the bank.

Start by finding where the current posture falls short. Run the free Compliance Gap Assessment to identify the retention, consent, and breach-readiness gaps specific to a banking operation, then map them to the DPDP compliance timeline.