DPDP by industry
BFSI holds the densest concentration of personal and financial data in the country, collects it across the widest channel mix, and shares it with the longest processor chain. Every one of those is a DPDP pressure point.
DPDP sits alongside these rather than replacing them. Where a sectoral rule requires retention and the Act requires erasure, both are satisfiable — but only where the basis is recorded per attribute.
Where the pressure lands
The Act applies uniformly. The obligations that bite first do not — these are the ones this sector fails on.
Sec. 6(1), 6(4)
Branch, agent, IVR, DSA and paper forms all collect personal data, and consent captured on paper still has to be specific, informed and withdrawable as easily as it was given. A digital-only consent stack leaves the assisted channels unevidenced.
Sec. 8(1)–(2)
Card networks, KYC vendors, collection agencies, analytics providers and cloud processors all inherit personal data. The Fiduciary carries the penalty for each of their failures, so the register has to map vendor to purpose to the consent that permits it.
Sec. 8(7)
Sectoral rules require records to be kept for years; DPDP requires erasure once the purpose ends. Both are satisfiable, but only where the retention basis is recorded per attribute rather than applied as a blanket policy.
Sec. 8(6)
Scoping an incident to affected Principals across core banking, CRM, data warehouse and partner systems is the step that overruns. Without a catalogue it is an investigation; with one it is a query.
What closes them
Discovery first, because every other obligation is undeliverable without a catalogue. Everything after that consumes what it built.
Capture valid consent per purpose, give people self-service control, and make it the authoritative signal everywhere.
Sec. 5, 6, 9
Replace stale inventories with a live, identity-resolved map of every place personal data actually lives.
Sec. 8(3), 8(7)
Run the whole privacy programme from one control plane, so the next regulation lands as configuration.
Sec. 4, 7, 10, 16
From detection to defensible intimation and closure — a structured workflow that beats the regulatory clock.
Sec. 8(6)
Receive, verify, fulfil and audit every access, correction, erasure and grievance request inside the statutory clock.
Sec. 11–14
Sequence
The same four phases apply in every sector; what changes is which systems go first.
Phase 1
Weeks 1–6
Phase 2
Weeks 4–12
Phase 3
Weeks 8–18
Phase 4
Weeks 14–26
Check that the person opening an account, making a claim or approving a payment is really who they say they are, before the money moves.
A readiness walkthrough maps what you already run onto the eighteen obligations, and names what is missing with the exposure attached.
