DPDP · Fintech
DPDP compliance for fintech companies
Fintechs already answer to the RBI on data. The DPDP Act adds a second set of duties for every customer you onboard. We assess where you stand and give you a lawyer reviewed roadmap.
What the law asks of fintech businesses
Fintech businesses handle some of the most sensitive personal data there is: identity documents, bank account details, income, credit history and transaction records. The DPDP Act applies to all of it, in addition to the RBI directions you already follow. Section 38 makes the Act additional to other laws, and where there is a conflict, the DPDP Act prevails to the extent of that conflict.
Each customer must receive a clear notice before their data is collected (Rule 3), and consent for anything beyond the service they asked for must be free, specific and as easy to withdraw as to give. Customers can ask to see, correct and erase their data. Lending and payment journeys often share data with banks, credit bureaus, KYC providers and collection agents, and each of them needs a contract that meets section 8(2).
Where a law or an RBI direction requires you to keep data, for example records under the KYC directions, that requirement continues. The DPDP Act asks you to know which rule applies to each kind of data and to erase the rest once its purpose is served. Most obligations apply from 13 May 2027.
Where to start · Entry A
DPDP Readiness Programme
Most fintechs have strong security and KYC processes but have not yet mapped them to DPDP duties such as notice, consent, rights and retention. The Readiness Programme assesses your position against the Act and the Rules, and gives you a lawyer reviewed report with a score, confirmed findings and a prioritised roadmap.
₹15,000 – ₹75,000+
Lawyer reviewed. 3–5 business days after payment, complete information and any evidence requested are received.
Also relevant: Privacy Contract & Vendor Review (₹5,000 – ₹15,000+).
Already certified to ISO 27001? Ask us about the DPDP Gap Overlay, which reuses those controls. Your agreements with lending partners, bureaus and KYC providers can be reviewed for privacy terms under Privacy Contract and Vendor Review.
Questions we are often asked
We already follow RBI rules on data. Do we still need to look at the DPDP Act?
Yes. RBI directions and the DPDP Act cover overlapping ground but are not the same. The DPDP Act applies in addition to them, and adds duties such as notice, consent management, rights handling and breach notice to the Data Protection Board.
Can a customer ask us to delete their data while a loan is outstanding?
A customer can ask for erasure, but you may keep data you still need for the service or that another law requires you to keep. We help you set a retention period for each kind of data, so you can answer these requests consistently.
Do we need consent for KYC and credit bureau checks?
It depends on the purpose and the law that requires the step. Some processing can rely on a legitimate use under section 7 of the Act, and some needs consent. The assessment looks at each customer journey and records which ground applies.
A lawyer checks for conflicts and sends you an engagement letter with the exact fee, usually within one business day.
Start DPDP Readiness