DPDPA 2023: What Every NBFC Must Do Before the Rules Are Notified
The Digital Personal Data Protection Act 2023 is law. The Rules are being finalised. Most NBFCs are waiting. That is precisely the wrong posture.
Why Waiting Is a Risk, Not a Strategy
I have been through the GDPR implementation cycle at an institutional level, and I have now built the DPDPA compliance programme at Piramal Finance as designated Data Protection Officer. The single biggest mistake I see NBFCs making today is the same one European financial institutions made in 2017: assuming that because the subsidiary rules have not been notified, nothing needs to be done yet.
The Act itself — not the Rules — creates binding obligations. The Rules will govern the mechanics of compliance. The obligations are already in force. When the Rules land, institutions that have done the groundwork will have weeks to operationalise. Those that have not will have a compliance crisis.
Key fact for NBFCs
An NBFC that processes personal data of even one individual for lending, KYC, collections, or credit bureau reporting is a Data Fiduciary under the Act. There are no size thresholds. There are no asset-book exemptions. The Act applies to you.
Seven Obligations Every NBFC Must Prepare For Now
Lawful Consent Architecture
Every NBFC collects personal data at onboarding — name, PAN, Aadhaar, address, income, bank statements. Under DPDPA, each purpose for which this data is used must be supported by a specific, informed, unconditional, and unambiguous consent. Bundled consent buried in loan agreements will not be valid. You need a consent management layer embedded in your LOS — purpose-wise, product-wise, and auditable.
Notice in Plain Language
The Act requires a privacy notice that is itemised, clear, and accessible. Your current privacy policy — if it exists — is almost certainly a legal document written for lawyers. DPDPA requires a notice that a borrower can actually read and understand, specifying exactly what data you collect, for what purposes, shared with whom, and for how long.
Data Principal Rights Management
Your borrowers now have statutory rights — to access their data, correct it, erase it, and withdraw consent. These rights come with response timelines that will be set in the Rules. You need an operational workflow — not just a policy — for receiving, authenticating, processing, and responding to rights requests. This must be staffed and tested before the Rules land.
Data Processing Agreements with Third Parties
Every vendor who touches your borrowers' data — your LOS provider, credit bureau, KYC vendor, collections agency, cloud provider, analytics partner — is a Data Processor under the Act. You as the NBFC remain responsible for how they use that data. This means Data Processing Agreements with every processor, including data use restrictions, security obligations, breach notification timelines, and audit rights.
Data Breach Response Protocol
The Act mandates notification of personal data breaches to the Data Protection Board and to affected individuals. Notification timelines will be set by the Rules — and based on global precedent, they will be short. An NBFC that discovers a breach and has no documented incident response playbook will be unable to comply. Build and test your breach response protocol now — before you need it.
Data Protection Impact Assessment (DPIA)
Significant Data Fiduciaries — a category the Rules will define, likely including larger NBFCs — will be required to conduct DPIAs for high-risk processing activities. Even if your NBFC falls outside this category initially, a DPIA is sound risk governance. Credit scoring, Aadhaar-based eKYC, automated loan decisioning, and collections analytics are all activities that warrant a DPIA today.
Appointing a Data Protection Officer
Significant Data Fiduciaries must appoint a DPO based in India. But even NBFCs not in this category benefit from a designated DPO function — a single accountable role that owns the compliance programme, interfaces with the Data Protection Board, manages rights requests, and reports to the Board Risk Committee. A DPO is not just a regulatory requirement; it is an operational necessity for an institution that processes lakhs of borrower records.
The NBFC-Specific Complexity
What makes DPDPA compliance particularly complex for NBFCs is the intersection with existing RBI obligations. Your KYC data is governed by the Prevention of Money Laundering Act and RBI Master Directions. Your credit bureau data is governed by CICRA 2005. Your Aadhaar-based eKYC is governed by UIDAI regulations. DPDPA does not replace any of these — it layers on top of them.
This means your consent architecture, data retention policies, and third-party data sharing agreements must simultaneously satisfy DPDPA, RBI KYC norms, CICRA obligations, and UIDAI terms. Getting this right requires someone who understands all four regulatory frameworks — not just the data protection layer in isolation.
Penalty exposure under DPDPA
Failure to implement security safeguards
Up to ₹250 Crore
Failure to notify breach
Up to ₹200 Crore
Non-fulfilment of data principal rights
Up to ₹50 Crore
Violation of children's data provisions
Up to ₹200 Crore
Where to Start
The right starting point is a structured gap assessment — mapping your current data processing activities against DPDPA obligations, identifying the highest-risk gaps, and building a sequenced remediation roadmap. This is not a legal exercise alone. It requires someone who understands your LOS, your vendor contracts, your bureau data pipelines, and your RBI compliance obligations simultaneously.
The Rules will be notified. The question is not whether you need to comply — it is whether you will be ready when the clock starts.
Ready to assess your DPDPA readiness?
A 30-minute discovery call is all it takes to identify your highest-priority gaps.
