India's Digital Personal Data Protection (DPDP) framework reaches a new implementation milestone on Friday, November 13, with the registration of Consent Managers set to begin.

However, the date does not mark the commencement of the law's full compliance requirements for businesses. Key obligations relating to consent management, data security, customer rights and breach reporting are scheduled to come into effect on May 13, 2027.

For banks, insurers and non-banking financial companies (NBFCs), the six-month transition period will be important for reviewing how they collect, process, store and share customer information.

"Consent becomes an operational control, not just a legal formality. Banks, insurers and NBFCs will need to rethink how they capture, document, manage and demonstrate customer consent across digital and physical channels," said Krishna Chaitanya B, Chief Product Officer, Perfios, an Indian financial technology (FinTech) and AI-driven software company.

Under the DPDP framework, financial institutions will need to make their data collection practices more purpose-specific, distinguishing information required for regulatory compliance from data collected for commercial activities such as marketing and cross-selling.

For instance, KYC requirements under the Prevention of Money Laundering Act (PMLA) and RBI regulations do not automatically permit institutions to reuse customer information for unrelated purposes.

Institutions will also need to ensure that the information collected for credit assessment is relevant to that purpose. This assumes significance as lenders increasingly use bank statements, transaction histories, credit bureau information and alternative data to assess borrowers.

Chaitanya said lenders would need to establish a lawful basis for processing different categories of personal data, restrict access and prevent unrelated reuse, including for marketing and profiling.

Source link