DPDPA for banks, insurers and lenders
Financial firms hold detailed personal data from onboarding to account closure, and share it with many partners. The Act asks you to show consent, purpose and retention at every step of that journey.
Customer journey
- 1OnboardingCONSENT
- 2KYCPURPOSE
- 3TransactionsSECURITY
- 4SupportRIGHTS
- 5Account closureRETENTION
Where BFSI gets hard
Retention versus erasure
Sector rules may require you to keep records that a customer asks you to delete.
Third-party sharing
Bureaus, agents and fintech partners all touch the same data.
Marketing consent
Cross-selling needs its own purpose and its own choice.
Legacy systems
Core banking platforms that were never built to delete.
How the three stages apply
Consulting
Map data across core banking, CRM and partners.
See consultingImplementation
Consent at onboarding, rights requests in the app.
See implementationGovernance
Vendor reviews and breach drills on a schedule.
See governance
BFSI questions
Sector rules still apply. Where both cover the same record, we list each duty against its source so your legal team can confirm which one governs.
A customer can ask, but rules that require you to keep KYC records may apply. Your data map should show which rule covers each record and how long it runs.
Often, when they handle data for you under your instructions. Some may be fiduciaries in their own right. The contract and the purpose decide, so we review each one.
It depends on the legal basis you rely on for each use. We map each use to its basis and check that the notice matches.
With a map of data across core banking, CRM and partners, then notices and consent at onboarding.
Get the BFSI checklist
One page: the duties that matter most for financial firms, in order.