Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsWhat the Act means for banks, NBFCs and fintechs, and how it sits on top of your existing RBI and NPCI obligations.
In short
Most banks, NBFCs and fintechs are Data Fiduciaries under the DPDP Act, though the same entity can be a Data Processor when it handles data on another organisation’s behalf. Each purpose needs its own lawful basis: consent under Section 6, or a Section 7 legitimate use such as a customer-requested service or a legal obligation. Collect only what a purpose needs, honour customer rights and report breaches, while continuing to meet RBI and NPCI requirements. The core obligations are scheduled to commence on 13 May 2027; penalties can reach ₹250 crore.
The obligations that shape compliance in this sector.
Give a plain-language notice and take clear, purpose-specific consent before processing customer data.
Collect only what a product or transaction needs, nothing extra from the device.
Put reasonable technical and organisational safeguards around financial records.
Report personal-data breaches to affected users and the Board without delay.
Let customers access, correct and erase their data, and offer grievance redressal.
The Act runs alongside RBI and NPCI rules, including localization; it does not replace them.
Each sub-sector has its own data flows and its own version of the rules.
Wherever you are, start there and move through to a certifiable posture.
Run the free readiness check for a sector-specific gap report.
Understand. Check. Connect.
We match you with the right DPDP implementation partner, only when you ask.
Consultant-led and partner-backed.