India's DPDP Countdown: How Fintech Firms Are Racing to Meet Compliance

When the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection (DPDP) Rules last year, it triggered a countdown. From public sector banks managing hundreds of millions of customer records to agile fintech lenders operating fully on the cloud, firms now have until May 13, 2027, to achieve full compliance or face penalties that can reach ₹250 crore per violation.

The DPDP Act fundamentally rewrites the rules on collecting customer data, obtaining consent, reporting breaches, and how long data can be held. In a sector already navigating overlapping mandates from the RBI, SEBI, IRDAI, and CERT-In, the new framework puts fintechs between a rock and a hard place. 

According to an EY survey, 71% of companies struggle to interpret the DPDP Act and Rules for their data privacy obligations.

BFSI’s Reckoning

The BFSI sector is uniquely exposed. As an analysis by legal intelligence platform Mondaq points out, financial entities process personal data at every stage of the customer lifecycle, including KYC, credit assessment, loan servicing, collections, grievance redressal, and analytics. Every touchpoint generates data, and under the DPDP Act, every touchpoint now carries compliance responsibility.

"The critical question is no longer just about compliance, but whether firms truly know where all their customer data resides. DPDP directly challenges data hoarding, lazy consent design, unchecked third-party integrations, and indefinite data retention for AI models," Pranav Koomar, Founder and CEO of PlusCash, tells AIM.

PlusCash is already adapting. Fintech is updating its application flow to strengthen data privacy, moving away from pulling data directly through APIs and instead redirecting users to the original data source. "In line with this shift, we are also rebuilding our data architecture to support automated deletion and implementing granular consent management," Koomar adds.

Consent and Data Minimisation Imperative

Phase 1 of the DPDP Act requires businesses to establish clear privacy and consent practices before collecting any personal data. Organisations must provide standalone privacy notices in English and regional languages, adhere to strict consent standards that prohibit pre-checked boxes, bundled consents, or confusing language, and enforce data minimisation—deleting data once its purpose is fulfilled or consent is withdrawn.

An analytical report by EY India clearly frames the implementation roadmap: "Phase 1 of implementation should focus on enterprise-wide data mapping, lawful purpose articulation, and third-party alignment, while later phases should test the maturity of embedded privacy controls, automated rights management and audit-ready infrastructure."

The compliance challenge, however, is not simply procedural. It cuts into the operational core of how financial institutions communicate with their customers. Every SMS alert, WhatsApp ping, email marketing message, or IVR call is a data event, and each one now sits within the ambit of the law.

The Consent Withdrawal Problem

One of the most operationally complex challenges is ensuring that consent withdrawal is enforced uniformly across all channels and third-party vendors. The gap between a customer's intent and what actually happens across a firm's vendor ecosystem remains wide.

"A customer who withdraws consent through the bank's app may still receive a marketing WhatsApp message from a third-party vendor the next morning. Hence, firms are working on building itemised, plain-language consent notices and to enforce consent withdrawals automatically across all channels and vendors simultaneously," says Moula Husain, a technical consultant for firms including Airpay and Olyv.

The concern is amplified by the sheer complexity of institutional data environments. As one senior compliance officer at a private sector bank told AIM candidly, "We have 20 vendors and 30 internal systems. A layer on top of the communication stack is a start, but it does not touch the core banking system, the analytics platform, or the collection CRM—where the data actually lives."

Digital lenders such as Lendingkart and Protium are addressing this by enabling real-time monitoring, end-to-end compliance tracking, and a single source of truth for governance. For many others, however, the work remains fragmented.

Infrastructure Transformation

Lawyers and compliance professionals working in the BFSI space have persistently raised concerns about a tendency to treat isolated, point solutions as substitutes for deep organisational transformation. The DPDP Act, in their view, demands far more than surface-level fixes.

Customer communication platforms such as Fyno are responding by creating unified, tamper-resistant records of every communication event. Sensitive fields in logs are automatically masked or hashed, and the platform processes messages in-memory without storing raw personal data. "We process messages in-memory and do not store raw personal data, addressing one dimension of DPDP's data minimisation principle," says Aniketh Jain, Co-founder and CEO of Fyno.

Jain notes that the law has moved privacy from the periphery to the core of data architecture. "Banks are breaking large data lakes into purpose-bound zones; fintechs are redesigning onboarding to capture granular, revocable consent; and NBFCs (non-banking financial companies) are mapping complex third-party data flows."

On data minimisation, firms are building tools to control what customer data is included in outbound messages and enforce masking and tokenisation at the template level, directly aligned with the DPDP Act's explicit requirement for encryption and virtual tokens as minimum security safeguards.

AI as Both Catalyst and Compliance Tool

Beyond infrastructure, AI is expected to play a central role in scaling DPDP compliance, from continuous consent monitoring and automated rights handling to rapid breach impact assessments. In the near term, its role in servicing, collections, underwriting support, and operational efficiency is already becoming apparent.

"AI has become crucial for organisations to follow for compliance and to be resilient. AI security tools can detect abnormal data access patterns in real time. This helps organisations automate compliance reports and be audit-ready. AI can also identify configuration drift, policy violations across cloud environments, and simulate attacks to strengthen proactive defences," says Sujatha S Iyer, AI Strategist at Zoho.

Customer-facing AI adoption, meanwhile, is expected to follow once the right safeguards are in place. "At the same time, improvements in KYC, authentication, and fraud prevention will continue to expand access and confidence in digital financial services," says Ankit Goel, a freelance AI and DPDP Act consultant.

A distinctive challenge for the BFSI sector is that DPDP compliance does not exist in isolation. Financial institutions must reconcile their new obligations with requirements from the RBI, SEBI, IRDAI, and other sector regulators, meaning they cannot simply retrofit consent frameworks built for a pre-DPDP world. The intersections between these mandates require careful legal and technical mapping, and firms that fail to align across regimes risk compounding their exposure.

Questions of Scale and Enforcement

Even as firms invest in compliance infrastructure, broader structural questions about India's readiness to enforce the framework at scale persist. 

The Data Protection Board was constituted only in November 2025, and industry watchers note that it is still building operational capacity. Adding to the uncertainty, The Indian Express reported that the government may reduce the compliance timeline from 18 months to 12 months, a move that would significantly compress the runway for firms still mid-transformation.

For now, the industry is moving towards compliance, but whether it is acting fast enough remains an open question. 

As Koomar puts it, the DPDP Act is not just a compliance exercise. It is a fundamental rethinking of how financial institutions relate to the data of the people they serve.