Navigating the Dual Mandate: DPDPA and RBI Norms for Indian Fintech

The Digital Personal Data Protection Act, 2023 (DPDPA), now fully operational as of June 2026, has ushered in a new era of data governance in India. For the burgeoning fintech sector, this means navigating a complex compliance landscape, not just under the DPDPA and its accompanying Rules, but also in conjunction with the Reserve Bank of India’s (RBI) stringent regulatory framework. Fintech entities, by their very nature, process vast quantities of sensitive financial data, making them prime candidates for enhanced scrutiny under both regimes.

Harmonising Consent and Purpose: A Fintech Balancing Act

At the heart of DPDPA lies the principle of lawful processing, primarily driven by consent. Section 6 mandates that personal data can only be processed for a lawful purpose for which a Data Principal has given clear, affirmative, and informed consent. This is a significant shift for many fintechs, moving beyond implied consent to requiring explicit opt-in mechanisms for various data uses, including onboarding, product recommendations, and sharing with third parties. Section 5 further reinforces purpose limitation and data minimisation, requiring data fiduciaries to collect only data “as is necessary for the specified purpose.”

This DPDPA mandate must be harmonised with RBI’s existing norms, which often require extensive data collection and retention for purposes like Know Your Customer (KYC), Anti-Money Laundering (AML), and fraud prevention. While DPDPA Section 6(4) permits data retention “as required by any law for the time being in force,” clearly accommodating RBI’s directives, fintechs must still ensure transparency with data principals about these retention periods. Furthermore, DPDPA Section 7 outlines certain “legitimate uses” where consent is not required, such as for “prevention, detection, investigation, or prosecution of any offence or contravention of any law.” This provision offers a crucial avenue for fintechs to continue essential fraud prevention activities without explicit consent, provided they adhere to strict transparency and necessity principles.

Data Principal Rights vs. Financial Sector Obligations

Chapter III of the DPDPA grants Data Principals significant rights, including the right to access information about their personal data (Section 10), the right to correction and erasure (Section 11), and the right to grievance redressal (Section 13). For fintechs, implementing these rights presents unique challenges. For instance, a Data Principal’s request for erasure under Section 11 must be carefully balanced against RBI-mandated data retention periods for transactional records, audit trails, and regulatory reporting.

Fintechs must establish robust internal processes to differentiate between data that can be erased and data that must be retained due to other legal obligations. The DPDPA Rules, which specify procedures for exercising these rights, are critical here. Comprehensive grievance redressal mechanisms, as per Section 13, are also paramount, requiring fintechs to appoint a contact person and establish clear channels for Data Principals to raise concerns, aligning with existing RBI customer service guidelines.

Security, Breaches, and Cross-Border Data Flows

DPDPA Section 8(5) mandates Data Fiduciaries to implement “reasonable security safeguards to prevent personal data breach.” This aligns well with RBI’s comprehensive cybersecurity frameworks for banks, NBFCs, and payment system operators, which already prescribe robust technical and organisational measures. However, DPDPA adds a new layer of urgency with its mandatory data breach notification requirements under Section 16, compelling Data Fiduciaries to notify both the Data Protection Board of India (DPBI) and affected Data Principals in the event of a breach. Fintechs must integrate these DPDPA notification timelines and formats into their existing incident response plans.

A critical area of intersection is cross-border data transfers. DPDPA Section 17 permits the transfer of personal data outside India to such countries or territories as may be notified by the Central Government. However, this general permission does not override specific sectoral mandates. RBI’s circular on “Storage of Payment System Data” (2018), for example, explicitly requires all payment system operators to ensure that the entire data relating to payment systems operated by them is stored only in India. This means that for payment-related data, RBI’s localisation requirements will continue to take precedence, regardless of DPDPA’s notified jurisdictions.

Accountability and Penalties: The Cost of Non-Compliance

The DPDPA introduces substantial penalties for non-compliance, detailed in Chapter VI (Sections 33-35), with fines potentially reaching up to INR 250 crores for data breaches. Given the volume and sensitivity of data they handle, most fintechs will likely be designated as “Significant Data Fiduciaries” (SDFs) under Section 10(1). This designation brings enhanced obligations, including the appointment of a Data Protection Officer (DPO) (Section 10(2)(a)), conducting Data Protection Impact Assessments (DPIAs) (Section 10(2)(b)), and undertaking periodic independent data audits. These requirements necessitate a significant investment in governance, technology, and personnel.

The DPBI (Chapter V) will serve as the primary enforcement body, adjudicating complaints and imposing penalties. Fintechs must proactively demonstrate accountability and establish a robust compliance framework that can withstand scrutiny from both the DPBI and the RBI.

Practical Takeaway

Indian fintechs must move beyond viewing DPDPA as a standalone compliance exercise. A holistic approach is essential, integrating DPDPA requirements with existing RBI guidelines. This involves conducting a thorough gap analysis between both frameworks, overhauling consent management systems, updating privacy policies for transparency, and establishing robust mechanisms for Data Principal rights requests. Investing in strong data security infrastructure, comprehensive employee training, and a dedicated DPO (if an SDF) are no longer optional but critical for mitigating risk and fostering trust in India’s dynamic digital economy.