SECTOR COMPLIANCE CHECKLIST

Banking

Comprehensive statutory controls framework mapped under the Digital Personal Data Protection Act 2023 for Banking data fiduciaries.

What DPDP compliance looks like in practice: a mid-size private bank

Consider Meridian Bank, a mid-size private sector bank with 180 branches across six states, two million savings account holders, and an active mobile banking app processing 40,000 daily transactions. Meridian collects personal data at every touchpoint: KYC documents at account opening, transaction metadata, credit bureau queries, insurance cross-sell consent, and location data from its mobile app.

Under the DPDP Act 2023, every one of those data flows requires a lawful basis — and for a bank, "lawful basis" is not a single answer. KYC data collected under the Prevention of Money Laundering Act (PMLA) and RBI Master Directions falls under Section 7(b) legitimate use (compliance with a law). But the same data used for cross-selling a home loan or sharing with an insurance partner requires explicit Section 6 consent — specific, granular, and as easy to withdraw as it was to give.

Meridian's first DPDP gap is not in KYC — it's in the secondary use of KYC data for marketing purposes without a separate consent layer. Its second gap is in erasure: when a customer closes their account, PMLA requires Meridian to retain KYC records for five years — but the customer's marketing consent data, mobile app behavioural logs, and cross-sell interaction history must be erased once the retention period for those specific purposes expires.

The DPDP compliance challenge for a bank like Meridian is not whether to comply — it's building systems that can simultaneously satisfy multiple retention timelines under multiple laws, for the same customer record.

Critical Priority

High Priority

Medium Priority

Low Priority

For a bank operating at scale, DPDP penalty exposure is compounded by volume. A single consent failure — say, processing marketing data for two million customers without valid consent — is not treated as one violation but potentially as a per-Data-Principal breach. The Data Protection Board may assess penalties up to ₹250 crore per type of violation under Section 33(2), and up to ₹550 crore for a significant data breach (Section 33(1)). For a bank that already faces RBI supervisory action, a concurrent DPDP Board proceeding amplifies both reputational and financial risk. Banks holding Significant Data Fiduciary (SDF) designation will face additional obligations: mandatory annual DPIA, a resident DPO, and enhanced security standards.

Critical (Immediate Audit Required)

High (Core DPDP Mandate)

Medium (Operational Control)

Low (Documentation)

Banking - Industry-Specific 16 Controls

BANK-01

KYC/CDD notice and consent alignment

🔍 Verification: Confirm the notice shown during account opening/KYC clearly identifies what identity, address, financial and biometric (e-KYC) data is collected and why, distinguishing data collected to satisfy the RBI Master Direction on KYC (a legal-obligation basis) from any optional data collected for other purposes (which needs its own consent).

Critical

Sections 5, 6, 7(d)

BANK-02

Aadhaar data handling - masking and Aadhaar Data Vault

🔍 Verification: Where the bank collects Aadhaar numbers (e.g., for e-KYC), confirm Aadhaar numbers are stored only in a UIDAI-compliant Aadhaar Data Vault, displayed/printed only in masked form, and that this sits alongside (not instead of) the DPDP security-safeguard obligations for the same data.

Critical

Aadhaar Act, 2016 (Section 29) and UIDAI Aadhaar Data Vault requirements; overlaps with DPDP Rule 6(1)(a) security safeguards

BANK-03

Government ID and financial identifier security

🔍 Verification: Confirm PAN, passport, voter ID, account numbers, and other financial identifiers are encrypted/masked/tokenised in storage and display, consistent with the Rule 6(1)(a) security safeguard standard, with access restricted to a need-to-know basis.

Critical

Rule 6(1)(a)

BANK-04

Credit Information Company (CIC) reporting - lawful basis review

🔍 Verification: Banks are statutorily required to furnish credit information to Credit Information Companies under CICRA. Confirm with counsel which DPDP lawful basis supports this mandatory disclosure (it may not cleanly fit Section 7(d), which refers to disclosure obligations owed to 'the State or any of its instrumentalities', since CICs are private licensed entities) - do not assume consent alone is a sufficient or necessary basis, and do not assume Section 7(d) applies without legal confirmation.

Critical

DPDP Act Section 7; Credit Information Companies (Regulation) Act, 2005, Section 17

BANK-07

IT/data outsourcing due diligence aligned with RBI outsourcing norms

🔍 Verification: Confirm vendor/processor contracts for any function involving customer personal data meet both the DPDP DPA requirements (Section 8(2), Rule 6(1)(f)) and RBI's outsourcing due-diligence, audit-rights, data-ownership/retrieval and (for material outsourcing) prior-intimation requirements, and that offshore/cross-border outsourcing preserves the bank's and RBI's access to data and records.

Critical

RBI Master Direction on Outsourcing of IT Services, 2023; overlaps with DPDP Section 8(2) and Rule 6(1)(f)

BANK-08

Coordination of DPDP breach reporting with RBI cyber-incident reporting

🔍 Verification: RBI requires banks to report cyber-security incidents to RBI on a much shorter timeline (as prescribed by RBI, historically within a few hours) than the DPDP Rule 7(2)(b) 72-hour Board report. Confirm the incident-response plan triggers both notifications from a single incident record, with consistent facts, and that the shorter RBI timeline does not get treated as satisfying the separate DPDP Board-intimation and Data-Principal-intimation obligations.

Critical

RBI Cyber Security Framework for Banks (2016 circular and successors); overlaps with DPDP Rule 7

BANK-09

Payment-system data localisation screening

🔍 Verification: Where the bank operates or participates in a payment system (card issuance, UPI handle, wallet, etc.), confirm payment-system data is stored only in India as required by the RBI circular, independent of and in addition to any future DPDP cross-border transfer restrictions.

Critical

RBI circular on Storage of Payment System Data (DPSS.CO.OD No.2785, 6 April 2018)

BANK-10

Reconcile PMLA/KYC record-retention periods with DPDP erasure triggers

🔍 Verification: Confirm the retention schedule reflects that KYC records and transaction records must be retained for the periods mandated under the PMLA Rules (generally five years from the end of the business relationship/transaction, as prescribed) even where a DPDP erasure trigger (e.g., consent withdrawal) would otherwise apply - PMLA retention is a 'compliance with law' ground that overrides the erasure obligation for that data during the mandated period.

Critical

DPDP Act Section 8(7); Prevention of Money-Laundering (Maintenance of Records) Rules, 2005

BANK-05

Credit-scoring and underwriting automation - algorithmic due diligence

🔍 Verification: Where credit-scoring, fraud-detection, or underwriting decisions are wholly or partly automated, assess (even ahead of any SDF designation) whether the model poses a risk to Data Principal rights, and maintain documentation of model inputs, logic, and human-review points for adverse-decision explainability.

High

Rule 13(3) (SDF-specific, applied here as best practice)

BANK-06

Marketing/cross-sell consent segregated from account-opening consent

🔍 Verification: Confirm consent to receive marketing/cross-sell communications (credit cards, insurance bancassurance, wealth products) is captured separately from, and is not a precondition to, account opening or loan sanction.

High

Section 6(1)

BANK-12

Joint accounts, guarantors and co-borrowers - multiple Data Principals

🔍 Verification: Confirm notice and consent are captured from every individual whose personal data is processed in a product (joint account holders, guarantors, co-borrowers, authorised signatories) - not only the primary applicant - and that rights requests are handled per Data Principal.

High

Sections 5, 6

BANK-16

Significant Data Fiduciary readiness given data volume/sensitivity

🔍 Verification: Given the volume and sensitivity of personal and financial data typically processed by a bank, treat SDF designation as a plausible (though not yet notified) future outcome, and consider voluntarily preparing DPO appointment, audit and DPIA capability ahead of any Central Government notification, without asserting SDF status in customer communications until actually notified.

High

Section 10(1)

BANK-11

Distinguish Banking Regulation Act nominee from DPDP Section 14 nominee

🔍 Verification: Confirm customer-facing material does not conflate the statutory bank-account nominee (who receives account proceeds on death, under Section 45ZA of the Banking Regulation Act) with the DPDP Section 14 nominee (who may exercise the deceased/incapacitated Data Principal's data protection rights) - these serve different purposes and may be different people.

Medium

DPDP Act Section 14; Banking Regulation Act, 1949, Section 45ZA

BANK-13

Branch CCTV and biometric access-control data

🔍 Verification: Where branch CCTV footage or biometric attendance/access-control data is digitised and individuals are identifiable, confirm notice signage, a defined retention period, and restricted access are in place, consistent with the general Notice, Security and Retention sections above.

Medium

Sections 3(c), 5, 8

BANK-14

Call-centre and IVR call-recording consent and retention

🔍 Verification: Confirm customers are notified that calls are recorded, that recordings are used only for the stated purpose (service quality, dispute resolution, fraud investigation), and that a defined retention/deletion period applies to recordings.

Medium

Sections 5, 6, 8(7)

BANK-15

Data shared with RBI and other regulators for supervisory purposes

🔍 Verification: Confirm supervisory data-sharing with RBI, financial intelligence authorities, and other regulators is documented as relying on the Section 7(c)-(d) legitimate-use grounds (State function under law / statutory disclosure obligation) rather than consent, and is reflected in the ROPA's third-party disclosure record for Section 11 access-request purposes.

Medium

Section 7(c)-(d)

Children's & PwD Data 4 Controls

COM-CHD-02

Verifiable parental consent mechanism

🔍 Verification: Where applicable, confirm a technical/organisational mechanism exists to obtain verifiable consent from a parent before processing a child's personal data, with due diligence to confirm the parent is an identifiable adult (via reliable existing identity/age details, voluntarily provided details, or a virtual token via a Digital Locker service provider).

Critical

Section 9(1); Rule 10

COM-CHD-04

No detrimental processing, tracking or targeted advertising to children

🔍 Verification: Confirm the organisation does not process children's personal data in a way likely to cause a detrimental effect on their well-being, and does not undertake behavioural tracking/monitoring or targeted advertising directed at children.

Critical

Section 9(2)-(3)

COM-CHD-01

Screen whether the organisation processes children's personal data

🔍 Verification: Determine whether any Data Principal is, or may be, under 18 years of age (a 'child' under Section 2(f)) - e.g., minor nominees/beneficiaries, guardian-operated minor accounts/policies, or joint applicants. If not applicable, mark this section Not Applicable and document the basis for that conclusion.

High

Section 2(f), Section 9

COM-CHD-03

Verifiable guardian consent for persons with disability

🔍 Verification: Where applicable, confirm due diligence is performed to verify a lawful guardian of a person with disability is validly appointed (by a court, designated authority, or local level committee) before obtaining their consent for processing.

High

Rule 11

Consent 7 Controls

COM-CON-01

Consent meets the statutory standard

🔍 Verification: Confirm consent capture is free, specific, informed, unconditional and unambiguous, involves a clear affirmative act (no pre-ticked boxes, no bundling consent to a loan/policy/account with consent to marketing), and is limited to personal data necessary for the specified purpose.

Critical

Section 6(1)

COM-CON-04

Consent withdrawal is as easy as giving consent

🔍 Verification: Confirm the mechanism to withdraw consent is comparably easy to the mechanism used to give it; confirm that upon withdrawal, processing based on that consent ceases within a reasonable time (including by Data Processors), without affecting the legality of prior processing or the continuation of the underlying contract (e.g., loan/policy) to the extent it relies on Section 7 rather than consent.

Critical

Section 6(4)-(6)

COM-CON-02

No invalid consent clauses

🔍 Verification: Review consent language, loan/policy/account-opening agreements and terms of use for clauses that would be invalid to the extent they infringe the Act/Rules or other law - e.g., purported waivers of the right to complain to the Board.

High

Section 6(2)

COM-CON-03

Consent request presented in plain language with contact details

🔍 Verification: Confirm every consent request is in clear and plain language, offers English/Eighth Schedule language options, and provides the business contact details of the DPO (if applicable) or the person authorised to respond to Data Principal communications.

High

Section 6(3)

COM-CON-06

Consent and notice records retained for burden of proof

🔍 Verification: Confirm the organisation can produce evidence, for any Data Principal, that a compliant notice was given and that consent was validly obtained, since the Data Fiduciary bears the burden of proof in any Board proceeding.

High

Section 6(10)

COM-CON-07

'Certain legitimate uses' basis is documented separately from consent

🔍 Verification: Where the organisation relies on a Section 7 legitimate use (e.g., 7(a) voluntarily provided data for a specified purpose, 7(b) State-provided subsidy/benefit/service, 7(i) employment-related processing) instead of consent, document the specific limb relied upon and why - do not blend legitimate-use processing into general consent language.

High

Section 7

COM-CON-05

Consent Manager readiness (if using/planning to use one)

🔍 Verification: If the organisation intends to route consent through a Consent Manager (including for Account Aggregator-linked financial data flows), confirm the Consent Manager is (or will be) registered with the Board once Rule 4 becomes active (13 Nov 2026), and that data-sharing arrangements with it are documented.

Medium

Section 6(7)-(9); Rule 4

Cross-Border Processing 3 Controls

COM-CB-01

Map jurisdictions, vendors and cloud regions receiving personal data

🔍 Verification: Identify every country/territory in which personal data is stored or processed, including cloud-hosting regions and offshore support/processing centres, and every foreign vendor/sub-processor involved.

High

Section 16

COM-CB-02

Monitor Central Government country-restriction notifications

🔍 Verification: The DPDP Act follows a 'restricted-country' (blacklist) approach, not a whitelist/adequacy approach - transfers are permitted by default except to countries or territories the Central Government specifically notifies as restricted. No such notification has been issued as of publication. Do not assume any particular country is either blocked or pre-approved; monitor for notifications.

Medium

Section 16(1)-(2)

COM-CB-03

Document cross-border transfer contractual arrangements

🔍 Verification: Confirm contracts with foreign vendors/group entities receiving personal data address security safeguards, breach notification and data-return/deletion consistent with the organisation's own obligations under the Act.

Medium

Section 16

Data Principal Rights 6 Controls

COM-DPR-02

Right to correction, completion, updating and erasure

🔍 Verification: Confirm a process exists to correct inaccurate/misleading data, complete incomplete data, update data, and erase data on request (unless retention is necessary for the specified purpose, an active contract, or legal/regulatory compliance).

Critical

Section 12

COM-DPR-01

Right to access information about processing

🔍 Verification: Confirm a process exists to give a Data Principal, on request, a summary of personal data processed and processing activities undertaken, plus the identities of other Data Fiduciaries/Data Processors with whom it has been shared (subject to the law-enforcement-sharing carve-out in Section 11(2)).

High

Section 11

COM-DPR-03

Right to grievance redressal

🔍 Verification: Confirm readily available means of grievance redressal exist, and that Data Principals are informed they must exhaust this internal route before approaching the Board.

High

Section 13

COM-DPR-05

Published rights-exercise mechanism and identity verification

🔍 Verification: Confirm the website/app prominently publishes the means to make a rights request and the identifying particulars (customer/policy/account/folio number, email, mobile number, etc.) needed to verify the requester, and that requests are only actioned for Data Principals who previously gave consent to that Data Fiduciary.

High

Rule 14(1)-(2), (5)

COM-DPR-04

Right to nominate

🔍 Verification: Confirm a mechanism exists for a Data Principal to nominate another individual to exercise their rights in the event of death or incapacity.

Medium

Section 14; Rule 14(4)

COM-DPR-06

Internal SLA and recordkeeping for rights requests

🔍 Verification: Confirm requests are logged, tracked to resolution within a defined internal SLA, and that records are retained to demonstrate timely handling.

Medium

Sections 11-14; Rule 14

Governance & Applicability 6 Controls

COM-GOV-01

Determine DPDP Act applicability to the organisation

🔍 Verification: Confirm whether the organisation processes digital personal data of individuals within India, personal data collected in non-digital form and later digitised, or processes personal data of Data Principals in India from outside India in connection with offering goods or services to them. Confirm whether any processing falls under the personal/domestic-purpose exclusion or the publicly-available-data exclusion under Section 3(c).

Critical

Section 3

COM-GOV-02

Identify Data Fiduciary and Data Processor role(s)

🔍 Verification: For each processing activity, determine whether the organisation determines the purpose and means of processing (Data Fiduciary) or processes personal data on behalf of another entity (Data Processor) under a contract. An organisation can be both, for different activities.

Critical

Section 2(i), 2(k)

COM-GOV-03

Complete an initial personal-data processing map

🔍 Verification: Before assessing any other control, produce a first-pass map of what personal data is processed, for what purpose, and by which function - this map is the basis for the Data Inventory section below and for every subsequent control.

Critical

Sections 4-8 (foundational)

COM-GOV-04

Assign internal privacy governance responsibility

🔍 Verification: Nominate an accountable owner (formal Data Protection Officer if a Significant Data Fiduciary; otherwise a designated privacy/compliance owner) with authority to run this programme, coordinate with IT/HR/Legal/Vendor Management, and respond to Board or Data Principal communications.

High

Section 8(1), 8(9)-(10)

COM-GOV-05

Adopt an internal DPDP compliance policy/framework

🔍 Verification: Document an internal policy covering notice/consent standards, security safeguards, breach response, retention/erasure, Data Principal rights handling, and vendor management, consistent with this checklist.

High

Section 8(4) (general obligation to implement measures)

COM-GOV-06

Track commencement notifications and regulatory developments

🔍 Verification: Because the Act and Rules commence in phases (13 Nov 2025 / 13 Nov 2026 / 13 May 2027) and several matters are pending further Central Government notification (e.g., cross-border restricted-country list, Significant Data Fiduciary designation, data-localisation categories), assign someone to monitor the Official Gazette and MeitY announcements and update this checklist accordingly.

Medium

Section 1(2); Rule 1

Grievance Management 4 Controls

COM-GRI-01

Publish DPO/contact person business contact information

🔍 Verification: Confirm the business contact information of the DPO (if applicable) or another person able to answer Data Principal questions about processing is prominently published on the website/app, and included in every response to a rights-related communication.

High

Section 8(9); Rule 9

COM-GRI-02

Effective grievance redressal mechanism, distinguished from sectoral ombudsman/grievance routes

🔍 Verification: Confirm an effective mechanism exists to redress Data Principal grievances relating to processing of their personal data specifically (as distinct from, and in addition to, any sectoral customer-grievance or ombudsman mechanism already in place).

High

Section 8(10)

COM-GRI-03

Published response timeline not exceeding the prescribed period

🔍 Verification: Confirm the published grievance-response timeline does not exceed the period prescribed for the relevant class of Data Fiduciary, and that operational capacity exists to meet it.

Medium

Rule 14(3)

COM-GRI-04

Grievance tracking and escalation records

🔍 Verification: Maintain a log of grievances received, actions taken, and time to resolution, including escalation where the internal route is exhausted and the Data Principal may approach the Board.

Medium

Supports Section 8(10) and 13(2)-(3)

Notice 5 Controls

COM-NOT-01

Notice content meets statutory minimum

🔍 Verification: Verify every consent-seeking notice discloses, in clear and plain language: (a) an itemised description of the personal data being collected; (b) the specified purpose(s) and specific description of the goods/services or uses enabled; (c) how to exercise rights under Section 6(4) and Section 13; and (d) how to complain to the Board.

Critical

Section 5(1); Rule 3(b)

COM-NOT-02

Notice is presented independently and understandably

🔍 Verification: Confirm the notice can be understood on its own, without needing to cross-refer to other documents (e.g., a separate terms-of-service, loan agreement, or policy wording) to make sense of what is being collected and why.

High

Rule 3(a)

COM-NOT-03

Notice accompanies or precedes every consent request

🔍 Verification: Confirm the onboarding/application workflow shows the notice to the Data Principal at or before the point consent is sought - not buried afterwards, in fine print, or only on request.

High

Section 5(1)

COM-NOT-04

Legacy (pre-commencement) consents re-notified

🔍 Verification: For Data Principals who gave consent before the relevant provisions commenced (e.g., existing customers/policyholders/account holders), plan to notify them, as soon as reasonably practicable after commencement, describing the personal data and purpose of processing, their rights, and how to complain to the Board. Consent given earlier remains valid until withdrawn.

High

Section 5(2)

COM-NOT-05

Notice available in English and Eighth Schedule languages

🔍 Verification: Confirm the Data Principal has the option to access the notice in English or any language listed in the Eighth Schedule to the Constitution of India, at least on request.

Medium

Section 5(3)

Personal Data Breach 6 Controls

COM-BR-01

Breach detection and internal escalation workflow

🔍 Verification: Confirm an incident-response process exists to detect a personal data breach and escalate it internally without delay to the accountable privacy/security owner.

Critical

Section 8(6)

COM-BR-02

Data Principal intimation - content and channel

🔍 Verification: Confirm the breach-notification template covers: description of the breach (nature, extent, timing), consequences relevant to the Data Principal, mitigation measures taken/being taken, safety measures the Data Principal can take, and business contact details for queries - and that it can be delivered via the Data Principal's user account or registered communication channel without delay.

Critical

Rule 7(1)

COM-BR-03

Board intimation - immediate description

🔍 Verification: Confirm a process exists to intimate the Board without delay of the breach's nature, extent, timing, location of occurrence and likely impact upon becoming aware of it.

Critical

Rule 7(2)(a)

COM-BR-04

Board intimation - detailed report within 72 hours

🔍 Verification: Confirm a process exists to provide the Board, within 72 hours of becoming aware of the breach (or such longer period as the Board allows on written request): updated/detailed description, facts/circumstances/reasons, mitigation measures, findings on the cause, remedial measures taken, and a report of the intimations given to affected Data Principals.

Critical

Rule 7(2)(b)

COM-BR-05

Breach register and evidence preservation

🔍 Verification: Confirm all actual and suspected breaches are logged in a central register with timeline, actions taken, and outcomes, and that relevant forensic evidence is preserved for investigation.

High

Section 8(6); Rule 7

COM-BR-06

Coordination with sectoral breach/incident reporting

🔍 Verification: Where the organisation is separately required to report cyber incidents/breaches to a sector regulator or CERT-In, confirm the DPDP breach workflow and the sectoral incident-reporting workflow are coordinated so timelines and facts are consistent across both filings.

High

See sector regulator's cyber-security/incident-reporting framework

Personal Data Inventory 5 Controls

COM-INV-01

Maintain a Record of Processing Activities (ROPA)

🔍 Verification: Document, per processing activity: categories of personal data processed, categories of Data Principals, purpose, and source of collection (direct from Data Principal, third party, public record, etc.).

Critical

Sections 4, 5, 8 (implied by notice/consent/accountability obligations)

COM-INV-04

Document lawful basis per processing activity

🔍 Verification: For each processing activity in the ROPA, record whether the lawful basis is Data Principal consent (Section 6) or one of the 'certain legitimate uses' (Section 7, e.g., voluntarily provided data for a specified purpose, employment purposes, compliance with law, medical emergency). Do not default every activity to 'consent' - Section 7 uses have distinct conditions.

Critical

Sections 4, 6, 7

COM-INV-02

Map storage systems and internal access

🔍 Verification: Identify which systems (core banking/policy admin/trading systems, CRM, cloud storage, on-prem servers, email) store each category of personal data, and which internal roles/departments have access.

High

Section 8(4)-(5) (security accountability)

COM-INV-03

Map external recipients, processors and cross-border flows

🔍 Verification: List every third party (Data Fiduciary or Data Processor) that receives personal data, including technology vendors, KYC/verification agencies, credit bureaus, reinsurers, auditors, and group companies, and note the country/jurisdiction in which each holds or processes the data.

High

Sections 8(2)-(3), 11(1)(b), 16

COM-INV-05

Map retention periods and deletion triggers

🔍 Verification: For each data category, record the intended retention period, the event that triggers deletion (purpose fulfilled, consent withdrawn, statutory retention period under another law), and whether the organisation falls within any class specified in the Third Schedule to the Rules.

High

Section 8(7)-(8); Rule 8

Processors & Vendors 6 Controls

COM-PROC-02

Valid written contract with every processor

🔍 Verification: Confirm engagement of a Data Processor for any activity related to offering goods/services to Data Principals is under a valid written contract, since the Data Fiduciary remains responsible for compliance regardless of any contrary agreement (Section 8(1)).

Critical

Section 8(2)

COM-PROC-05

Processor breach-escalation obligations

🔍 Verification: Confirm DPAs require the processor to notify the Data Fiduciary promptly of any personal data breach, with enough detail to allow the Data Fiduciary to meet its own Board/Data Principal intimation timelines.

Critical

Section 8(6); Rule 7

COM-PROC-01

Inventory of all Data Processors/vendors

🔍 Verification: Cross-check the vendor list (core system providers, cloud hosting, KYC/verification agencies, collections agencies, marketing platforms, IT support, auditors, etc.) against the personal-data map to identify every processor handling personal data on the organisation's behalf.

High

Section 2(k)

COM-PROC-03

Contractual security and confidentiality flow-down

🔍 Verification: Confirm DPAs contain appropriate provisions requiring the processor to take reasonable security safeguards and maintain confidentiality, and address sub-processor engagement and oversight - particularly for outsourced/offshored processing, consistent with applicable outsourcing directions of the sector regulator.

High

Rule 6(1)(f)

COM-PROC-04

Contractual erasure/return obligations

🔍 Verification: Confirm DPAs require the processor to erase personal data made available to it when the Data Fiduciary is required to erase it (on consent withdrawal or purpose fulfilment), unless retention is required by law.

High

Section 8(7)(b)

COM-PROC-06

Pre-onboarding and periodic vendor security due diligence

🔍 Verification: As good practice supporting the Section 8(5) security obligation (and typically required separately under sector-regulator outsourcing norms), assess a vendor's security posture before onboarding and periodically thereafter.

Medium

Not mandated by name in the Act/Rules

Retention & Deletion 4 Controls

COM-RET-01

Erasure on consent withdrawal or purpose fulfilment

🔍 Verification: Confirm personal data is erased once the Data Principal withdraws consent, or once it is reasonable to assume the specified purpose is no longer being served, unless retention is necessary for compliance with law (including sectoral record-retention directions - see industry-specific section).

Critical

Section 8(7)(a), 8(8), 8(11)

COM-RET-02

Cause processors to erase data in parallel

🔍 Verification: Confirm that when the organisation is required to erase personal data, it also causes each engaged Data Processor to erase the personal data made available to it for processing.

High

Section 8(7)(b)

COM-RET-04

Documented retention schedule reconciled with sectoral retention law

🔍 Verification: Confirm a retention schedule exists mapping each data category to a retention period justified by either ongoing purpose or a specific other-law requirement, reconciling any tension between DPDP erasure triggers and mandatory sectoral record-keeping periods (see industry-specific section), and that deletion (including from backups, where feasible) is actually carried out on schedule once permitted.

High

Section 8(7)

COM-RET-03

General minimum one-year data/log retention

🔍 Verification: Rule 8(3) requires a Data Fiduciary to retain personal data, associated traffic data and other processing logs for a minimum of one year for the purposes specified in the Seventh Schedule, after which they must be erased unless further retention is required by law. Confirm scope with counsel rather than assuming it does or does not apply.

Medium

Rule 8(3); Seventh Schedule

Security Safeguards 7 Controls

COM-SEC-01

Data security measures (encryption/masking/tokenisation)

🔍 Verification: Confirm appropriate data security measures are in place, such as encryption, obfuscation, masking, or use of virtual tokens mapped to personal data, at a minimum - particularly for financial identifiers, government ID numbers and account/policy numbers.

Critical

Rule 6(1)(a)

COM-SEC-02

Access control to computer resources

🔍 Verification: Confirm appropriate measures control access to the computer resources used to process personal data (role-based access, least privilege, dual control for sensitive financial data, authentication).

Critical

Rule 6(1)(b)

COM-SEC-06

Documented technical and organisational measures generally

🔍 Verification: Confirm an overarching information-security programme documents the technical and organisational measures taken to ensure effective observance of the Act and Rules and prevent personal data breach.

Critical

Section 8(4)-(5); Rule 6(1)(g)

COM-SEC-03

Logging, monitoring and review for unauthorised access

🔍 Verification: Confirm appropriate logs, monitoring and review processes are in place to enable detection, investigation and remediation of unauthorised access.

High

Rule 6(1)(c)

COM-SEC-04

Backup and continuity measures

🔍 Verification: Confirm reasonable measures (e.g., data backups) exist for continued processing in the event confidentiality, integrity or availability of personal data is compromised through destruction or loss of access.

High

Rule 6(1)(d)

COM-SEC-05

Minimum one-year retention of security logs

🔍 Verification: Confirm logs and personal data relevant to detecting/investigating unauthorised access and supporting continued processing are retained for at least one year, unless another law requires otherwise.

Medium

Rule 6(1)(e)

COM-SEC-07

Vulnerability management, testing and employee security training

🔍 Verification: As best practice supporting the general security obligation (and typically also required under sector-regulator IT/cyber-security directions), run periodic vulnerability assessments/penetration testing and employee security-awareness training.

Medium

Not mandated by name in the Act/Rules

Significant Data Fiduciary Screening 4 Controls

COM-SDF-01

Monitor for Central Government SDF notification

🔍 Verification: No general list of Significant Data Fiduciaries has been notified as of the publication date of this checklist. Monitor Central Government notifications, which will designate specific Data Fiduciaries or classes based on volume/sensitivity of data processed, risk to Data Principal rights, potential impact on sovereignty/integrity, risk to electoral democracy, security of the State, and public order. Given the volume and sensitivity of financial data typically processed, financial-sector entities are a plausible category for future designation - do NOT self-classify as an SDF without a notification or documented legal assessment.

High

Section 10(1)

COM-SDF-02

If designated - appoint India-based DPO

🔍 Verification: If and when notified as an SDF, appoint a Data Protection Officer based in India, reporting to the Board of Directors or equivalent governing body, who acts as the point of contact for grievance redressal.

High

Section 10(2)(a)

COM-SDF-03

If designated - appoint an independent data auditor

🔍 Verification: If and when notified as an SDF, appoint an independent data auditor to evaluate compliance with the Act.

High

Section 10(2)(b)

COM-SDF-04

If designated - periodic DPIA, audit and algorithmic due diligence

🔍 Verification: If and when notified as an SDF, undertake a Data Protection Impact Assessment and audit at least once every 12 months, furnish a report of significant observations to the Board, and observe due diligence that algorithmic/technical measures (e.g., credit-scoring or fraud-detection models) do not pose a risk to Data Principal rights.

High

Section 10(2)(c); Rule 13(1)-(3)

Regulatory overlap: Banking and related compliance frameworks

DPDP Act + RBI + PMLA: The three-way tension banks must manage

Obligation	DPDP Act 2023	RBI Master Direction / PMLA	Practical resolution
KYC data retention	Erase when purpose served and customer inactive (Section 8(7))	Retain for 5 years after account closure (PMLA Rule 10)	Legal retention wins — document the basis. Segregate KYC records from marketing data; erase marketing data on schedule.
Credit bureau data sharing	Requires a lawful basis — Section 7(b) (legal compliance) if CIBIL reporting is mandated by RBI	RBI mandates credit bureau reporting for regulated entities	Section 7(b) covers mandatory bureau reporting. Discretionary sharing (e.g. pre-approval screening) requires consent.
Consent for cross-sell / insurance bundling	Requires separate, specific consent — cannot bundle with account T&Cs (Section 6)	IRDAI and RBI Bancassurance guidelines require disclosure but do not replace DPDP consent requirement	Build a standalone consent flow for insurance/loan cross-sell. Pre-ticked boxes or bundled T&C consent is non-compliant.
Suspicious Transaction Reports (STR)	Section 17: Processing for prevention, detection, investigation of offence — exemption available	FIU-IND reporting is mandatory under PMLA Section 12	STR filing is exempt from consent and erasure obligations under DPDP Section 17. Document the exemption basis.

The erasure problem: building a multi-timeline retention system

Most core banking systems were not designed with granular data lifecycle management. A single customer record may contain KYC data (retain 5 years post-closure under PMLA), transaction metadata (retain per RBI guidelines), marketing consent history (erase on withdrawal), and mobile app behavioural data (erase on dormancy). Banks must build a data retention management layer that can tag each data element by its governing retention rule and enforce erasure independently for each category.

NEED PROFESSIONAL IMPLEMENTATION?

Get a Comprehensive Banking Compliance Audit

Our certified data protection lawyers & technical auditors deliver gap analysis, automated consent proof-chains, and custom notice draft packs.

Take Online Self-Assessment Request Full Audit Proposal →