Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsKYC turns identity documents, Aadhaar, PAN and biometrics into the front door of every financial relationship, from banks to NBFCs and fintechs.
In short
KYC processes some of the most sensitive identifiers there are. The Act demands consent and strict purpose limitation for that data, while RBI KYC rules set retention periods you must reconcile with the right to erasure. Penalties reach ₹250 crore.
What changes for this sub-sector.
KYC data collected to verify identity cannot be reused for marketing or unrelated products without fresh consent.
Aadhaar, PAN and biometrics need strong safeguards and minimal collection; capture only what verification requires.
RBI mandates KYC-record retention; the erasure right yields to that legal obligation, so document why you keep what you keep.
KRAs, video-KYC vendors and onboarding SDKs are processors; their mishandling is your liability.
An identity-data breach must be reported to the affected people and the Board.
Niche guides for this area, each naming the specific regulation.
Lock down purpose and retention first, then vendors.
The readiness check flags purpose-creep, retention conflicts and vendor gaps in KYC.
Take the readiness check →Consultant-led and partner-backed.