Sneak-peek into banking sector through DPDPA lens

Banks must redesign digital onboarding (account opening, loans, credit cards, mobile banking) to capture explicit, unbundled consent with clear multilingual privacy notices, ensuring customers understand how their data will be used

Every use of personal data like offers, underwriting, fraud detection, etc. must be tied to a lawful ground of processing. Shadow or silent data processing is prohibited, requiring stricter governance in analytics

Banks must collect only the minimum necessary data, rationalise fields, and delete records once the purpose or statutory retention period ends

Customers gain enforceable rights to access, correct, erase, and withdraw consent. Banks must provide structured, time‑bound mechanisms across branches, mobile apps or apps, and CRM systems, with seamless updates across interconnected platforms

Breaches must be reported to the Data Protection Board and affected customers within 72 hours. Banks remain accountable for breaches by outsourced processors (fintech partners, payment gateways, cloud providers), making vendor risk management critical