MeitY notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, giving organisations an 18-month runway. For fintechs, which handle identity, financial and behavioural data at scale, that runway is shorter than it looks.
The timeline
- 13 Nov 2025 – Data Protection Board of India provisions in force
- 13 Nov 2026 – Consent Manager framework in force
- 13 May 2027 – core obligations commence: notice and consent, security safeguards, breach notification, retention and erasure, and data principal rights
What matters most for fintechs
- Consent and notice: itemised, plain-language notices, with consent as easy to withdraw as to give. Map every place you collect data, including SDKs and partner journeys
- Reasonable security safeguards: encryption, masking or tokenisation, access control, monitoring, and logs that can detect and investigate a breach
- Breach notification: inform affected individuals and the Board, with a detailed report to the Board within 72 hours. Fold this into your existing CERT-In 6-hour and RBI/SEBI reporting playbooks rather than running a parallel process
- Log retention: keep personal data processing logs for at least one year
- Processors and partners: your contracts with KYC vendors, cloud providers, collection agencies and lending partners must flow down DPDP obligations
- Sector rules still apply: RBI and SEBI retention and localisation requirements sit alongside DPDP, so reconcile them in one retention schedule
A phased plan
Now to Q1 2027: discover and design
- Build a personal data inventory and data-flow maps covering apps, back office, analytics and vendors
- Gap-assess against the Act and Rules; decide whether you are likely to be a Significant Data Fiduciary
- Redesign consent and notice flows; choose whether you will integrate with Consent Managers
Q1 to May 2027: build and test
- Implement retention and erasure jobs, data principal request handling and grievance redressal
- Update vendor contracts and run a breach-notification tabletop exercise
- Train customer-facing and engineering teams
Penalties of up to ₹250 crore per instance make DPDP a board-level risk. Start now and use the runway well.
Practitioner’s summary, not legal advice. Refer to the notified Act and Rules.
Leave a Reply