Ask any CISO in banking what keeps them up at night, and cash isn’t the answer anymore. Data is. And with the DPDP Act now in force, protecting it just became a legal obligation, not a best practice.
India’s BFSI sector has spent years chasing digital scale, UPI, video KYC, instant lending, AI-driven underwriting. That growth is real; according to a report, digital payment transactions have jumped from around 2,071 crore in FY18 to over 18,737 crore in FY24. But scale like that also means more data flowing through more systems, and more ways for things to go wrong. The Digital Personal Data Protection (DPDP) Act, 2023 exists to make sure that growth doesn’t come at the cost of customer trust.
Here’s what BFSI leaders actually need to know about it.
Data Has Quietly Become the Sector’s Biggest Liability
For years, the BFSI mindset around data was simple: collect more, understand customers better, sell smarter. DPDPA flips that logic. It treats every piece of personal data an institution holds as something it’s accountable for, not something it owns outright.
Practically, that means:
- Consent can no longer be bundled. A customer approving fraud alerts hasn’t automatically approved marketing emails.
- Customers can ask to see, correct, or delete their data, and institutions have to be able to act on that request without breaking other systems.
- Data has to be collected for a specific, justified reason, not just because it might be useful someday.
None of this is optional anymore. And for institutions still running on decades-old core banking platforms, none of it is simple to implement either.
The Threat Landscape Makes This Urgent
If DPDPA feels like an abstract legal exercise, the breach numbers make it concrete. A ransomware attack on a core banking services provider in 2024 disrupted operations at roughly 300 cooperative banks in one shot. A major brokerage suffered a breach that made national headlines. And these are just the incidents that became public.
The broader picture is equally alarming. The BFSI sector continues to be one of the most targeted industries for cyberattacks. According to recent industry reports, financial institutions accounted for 17.38% of all cyberattacks in India during 2024-25.
As digital banking, fintech partnerships, and cloud adoption continue to grow, attackers are increasingly using phishing, ransomware, credential theft, and AI-powered attacks to target sensitive financial data. This expanding threat landscape makes stronger data protection more critical than ever.
DPDPA responds to exactly this reality by making certain security controls mandatory rather than aspirational:
- Encryption for data at rest, in transit, and in use
- A hard 72-hour window to report breaches
- Routine audits and stricter access governance
This is where solid Data Encryption and Tokenization practices become a regulatory requirement. Pairing that with tighter Identity and Access Management solutions, it gives institutions a way to actually prove, not just claim, that sensitive financial data is only reachable by the people who need it.
Three Regulators, One New Rulebook, Zero Room for Contradiction
BFSI institutions already answer to RBI, SEBI, IRDAI, plus AML and PMLA requirements. DPDPA doesn’t clear any of that away, it adds a new layer that sometimes pulls in the opposite direction.
The clearest example: PMLA wants more data collected for anti-money-laundering checks. DPDPA wants less data collected overall, sticking to strict minimization. Neither law bends for the other, which means compliance teams end up making judgment calls case by case, balancing both obligations instead of picking one.
The financial risk of getting this wrong isn’t small either. DPDPA penalties can go up to ₹250 crore per violation. Stack that against RBI’s own fine record, which touched ₹56 crore across 304 cases in a single year, largely tied to cybersecurity and data protection lapses, and it’s clear this isn’t a risk anyone can afford to deprioritize.
What Actually Makes This Hard to Implement
Talk to anyone building this out inside a bank, and three problems come up again and again.
Old systems weren’t designed for granular consent.
Core banking platforms built decades ago have no concept of tracking, storing, or honoring revocable, purpose-specific consent. Retrofitting that is neither fast nor cheap.
Consent has to be consistent across every channel.
A customer might interact through a branch, a mobile app, an ATM, or a call center. Whatever choice they make in one place has to reflect everywhere else, instantly.
Vendors are now the bank’s problem too.
Fintech partners, payment processors, and outsourced providers all touch customer data. Under DPDPA, the bank stays accountable even when a third party mishandles it, which means contracts, audits, and monitoring all need to get sharper.
A Realistic Way Forward
Institutions that treat this as a one-time compliance sprint will keep struggling. The ones that build it into how they operate will be fine. A workable approach looks like this:
- Know exactly what data you hold and why. Map it across onboarding, lending, marketing, and payments.
- Replace static consent forms with real infrastructure. Enterprise-grade consent platforms that update and revoke in real time, not spreadsheets.
- Put governance structures in place. A Data Protection Officer, regular audits, and a privacy committee that spans IT, legal, and business teams.
- Train beyond the security team. Every department that touches customer data needs to understand the basics.
- Use privacy-preserving techniques where possible. Differential privacy and federated learning let teams keep generating insights without exposing raw personal data.
On the infrastructure side, this is also a good moment to shore up the basics. Solid Backup and Disaster Recovery planning means a breach or outage doesn’t also cost you data integrity or blow your reporting deadlines. And ongoing visibility through Data Security Posture Management tools helps security teams actually know where sensitive data sits and how exposed it is, instead of finding out during an audit.
The Upside Nobody Talks About
Most conversations around DPDPA focus on the risk of getting it wrong. But there’s a real opportunity here too. Customers are more privacy-aware than they’ve ever been, and they notice which institutions treat their data carefully.
Attackers keep getting more sophisticated, which makes strong security posture a genuine market differentiator, not just a defensive checkbox. And regulators clearly aren’t slowing down, so institutions that move early avoid the scramble everyone else will eventually face.
That shift is already visible in the numbers. BFSI cybersecurity investment in India more than tripled between 2019 and 2023, going from roughly $518 million to $1.7 billion. That’s not a temporary spike, it’s the new baseline.
Where This Leaves BFSI Institutions
DPDPA isn’t asking banks and insurers to do less with data. It’s asking them to do it responsibly, with proof to back it up. Institutions that modernize their systems, rebuild consent from the ground up, and treat security as core infrastructure rather than an afterthought won’t just avoid penalties. They’ll earn the kind of trust that keeps customers from walking to a competitor.
Data protection isn’t slowing banking down. It’s what makes the next phase of digital banking possible without it collapsing under its own risk.
Not sure where your institution’s gaps actually are? At Know All Edge, we help BFSI organizations implement the right security solutions, from encryption and access controls to continuous monitoring, and stay with you afterward through ongoing support that keeps your compliance posture current as the regulatory landscape shifts.
FAQs of DPDPA for BFSI
What is the DPDP Act, and when does it apply to BFSI institutions?
The Digital Personal Data Protection (DPDP) Act, 2023 is India’s core law governing how personal data is collected, processed, and stored. It applies to any organization, including banks, NBFCs, and insurers, that handles the personal data of Indian residents, whether that processing happens in India or abroad.
Does DPDPA replace RBI, SEBI, or IRDAI regulations?
No. DPDPA works alongside existing sectoral regulators rather than replacing them. RBI, SEBI, and IRDAI continue to govern their respective domains, and BFSI institutions are expected to comply with DPDPA on top of those frameworks. In a few areas, such as AML data retention under PMLA, the requirements can pull in different directions, which means institutions need a case-by-case approach rather than a single blanket policy.
What happens if a bank fails to report a data breach in time?
Institutions have a 72-hour window to notify the Data Protection Board of India and affected customers once a breach is identified. Missing that window, or failing to disclose a breach altogether, can trigger penalties, and DPDPA allows fines of up to ₹250 crore for serious violations. Beyond the financial hit, delayed disclosure tends to do lasting damage to customer trust, which is often harder to rebuild than the fine itself.
Can BFSI companies still use customer data for things like fraud detection or personalized offers?
Yes, but with conditions attached.
- Fraud detection, risk scoring, and similar uses generally fall under legitimate processing purposes, though institutions still need to justify why that data is necessary.
- Personalised offers and marketing typically require separate, explicit consent, since bundling them with essential services like fraud monitoring isn’t allowed anymore.
- Anonymized or pseudonymized data can be used more freely for analytics and product development, since it carries lower privacy risk.
The short version: DPDPA doesn’t shut down data-driven innovation, it just requires institutions to be upfront about what they’re using data for and get the right consent before doing it.
