What is the DPDP Act? A plain-English guide for BFSI

India's Digital Personal Data Protection Act (the DPDP Act) is the country's first comprehensive data-protection law. For BFSI institutions — which handle some of the most sensitive personal data in the economy — it changes how customer data can be collected, used, stored and shared. This guide explains the Act in plain English and what it means for banks, NBFCs, insurers and fintechs.

At its core, the DPDP Act governs the processing of 'digital personal data' — any data about an identifiable individual that is collected or stored digitally. The individual the data is about is the 'Data Principal'. The organization that decides why and how the data is processed is the 'Data Fiduciary'. In BFSI, you are almost always the Data Fiduciary, and your customers are Data Principals.

Consent is the foundation of the Act. A Data Fiduciary must obtain the Data Principal's free, informed, specific and unambiguous consent before processing their personal data, and must tell them — in clear language — what data is collected and for what purpose. Consent must be as easy to withdraw as it is to give. Crucially, consent is purpose-bound: data collected for onboarding cannot be silently reused for marketing, collections or credit-bureau reporting without fresh consent for that purpose.

The Act also gives Data Principals a set of rights: the right to access a summary of their data and how it's processed, the right to correction and erasure, the right to grievance redressal, and the right to nominate someone to exercise these rights on their behalf. BFSI institutions must be able to respond to these requests within reasonable, defined timelines — which is impossible without a current map of where personal data lives across systems.

Data Fiduciaries have specific obligations. You must implement reasonable security safeguards to prevent data breaches, notify the Data Protection Board and affected individuals in the event of a breach, limit retention to as long as the purpose requires (then erase), and ensure any processors (vendors) you use are bound by contract to the same standards. Some organizations may be classified as 'Significant Data Fiduciaries' with additional duties such as appointing a Data Protection Officer and conducting Data Protection Impact Assessments.

For processing children's data (under 18), the Act requires verifiable parental consent and prohibits tracking, behavioral monitoring and targeted advertising directed at children — relevant for any BFSI product with younger users.

Non-compliance carries real financial risk. The Act provides for penalties of up to ₹250 crore per instance for failures such as inadequate security safeguards leading to a breach. Penalties are decided by the Data Protection Board based on the nature and gravity of the violation.

What should a BFSI institution actually do? Start with three things. First, fix consent: capture it per purpose, with a clear record of what each customer agreed to, and make withdrawal easy. Second, map your data: know where personal data lives across your loan origination, servicing, collections and analytics systems, so you can honor access and erasure requests. Third, build compliance into the workflow, not as a one-time audit — every verification and onboarding step should capture consent and write to an auditable trail.

This is exactly what a DPDP governance platform is for. Rather than retrofitting consent and audit onto each system, FinHub captures purpose-bound consent on every verification, maintains a live data map, and produces an audit-ready record automatically — so DPDP readiness is a property of your onboarding flow, not a separate project.

The DPDP Act is not just a legal checkbox; for BFSI it's a trust and operational-resilience issue. Institutions that treat it as part of how they build products — not as paperwork bolted on afterward — will move faster and carry less risk.