The DPDP Act for UPI Apps

• Identity & VPA — name, mobile number and the Virtual Payment Address that identifies the user.
• Linked account data — bank account and IFSC, card tokens and mandate details.
• Transaction data — amounts, timestamps and the beneficiary VPAs a user pays, which together reveal spending patterns.
• Device & risk signals — device identifiers, IP and, where used for fraud checks, location.
• KYC data — often processed via a PSP bank; sensitive and subject to RBI KYC rules as well.

Transaction and beneficiary history is the sensitive part: it maps a person's financial relationships, so purpose limitation and retention discipline matter most here.

UPI apps already operate under NPCI's UPI Procedural Guidelines and the RBI's oversight of payment systems, including the RBI requirement to store payment system data in India. The DPDP Act adds a data-protection layer over all of that: a lawful basis and notice for the personal data you process, Data Principal rights, and breach notification to the Board and affected users under Section 8(6) and Rule 7.

Treat them as parallel regimes. Meeting an NPCI or RBI requirement does not discharge your DPDP duties, and a CERT-In cyber-incident report does not satisfy Rule 7. Test each obligation separately.

• Move consent to onboarding and mandate setup with clear, purpose-specific notices; avoid per-transaction prompts that cause fatigue.
• Collect only what a payment needs. Do not request the contact book, media or call logs to “find friends” unless the user separately and knowingly opts in.
• Separate KYC processing (often via your PSP bank) from app analytics, and document who is Data Fiduciary and who is Data Processor.
• Align retention with your RBI and NPCI obligations, then delete or de-identify beyond that; keep security logs under Rule 6.
• Publish a contact for rights requests and build flows for access, correction, erasure and grievance (a response within the Rule 14(3) period, not exceeding 90 days).
• Keep a breach playbook ready for the three Rule 7 clocks: notify affected users and the Board without delay, then the detailed Board report within 72 hours.