A consultative perspective for leaders serving the financial MSME sector in India to create the competitive advantage in building customer trust while meeting regulatory compliance mandate

DPDP Compliance: The Next Trust Test for India’s Small and Medium Sized Financial Institutions

Sourabh Das
CTO, Co-founder & Partner

Let us picture the operational landscape of a mid-sized NBFC in India on a busy Monday. During the morning the leadership team is focused on loan growth, collection efficiency, partner integrations and investor reporting. Then around noon, the Compliance Head receives a customer complaint regarding likely sharing of his/her KYC document with a third-party collection partner without clear notice, consent trail or documented purpose limitation. By evening, the technology team discovers that similar customer records have moved across loan origination systems, spreadsheets, WhatsApp workflows, field level apps, cloud folders and vendor dashboards.

There was not a single malicious act or occurrence of any out-of-the-box and surprise activity. In spite of that the institution now faces the exact kind of privacy risk that India’s Digital Personal Data Protection Act (DPDP), 2023 is designed to address when personal data is collected, processed, shared, retained and secured without demonstrable accountability. For small and medium-sized financial institutions, the DPDP mandate by the Government of India is not merely a legal statute. It is a test of whether customers, regulators, lenders, partners and investors can trust the institution’s operating model.

The Indian Lesson – Privacy Risk is Already a Financial Services
Risk

India has already moved beyond theoretical privacy principles. The DPDP framework introduces monetary penalty exposure that can reportedly reach up to ₹250 crore for serious failure such as inadequate security safeguards leading to personal data breach.
At the same time, the Reserve Bank of India’s “Digital Lending Directions 2025” specifically recognises risks in digital lending around areas like uncontrolled third-party engagement, breach of data privacy, customer protection, grievance redressal, data
collection, data sharing, storage and privacy policies.

This means a small lender, co-operative bank, fintech partner, credit service provider or insurance distributor cannot treat DPDP as a separate legal project. The same customer data that powers KYC, credit underwriting, fraud checks, collections, service calls, colending arrangements and cross-sell campaigns can also become the source of regulatory exposure, reputational damage and business interruption.

The fear factor is not only the amount of fine but the chain reaction associated with it. A privacy failure can force management to stop campaigns, suspend partner data transfers, revisit vendor contracts, investigate historic processing, respond to customer
requests, notify authorities, reassure lenders, brief the board and rebuild customer confidence. For any institution that is running lean operations, this kind of disruption can cost more than the compliance program being postponed or overlooked.

The commercial implication shows clearly that DPDP readiness is becoming part of financial institution’s credibility. Institutions that cannot suitably prove how they collect, use, share, retain and protect customer data, may find themselves less attractive to
banks, fintech platforms, payment partners, account aggregator ecosystems, investors and outsourcing parties.

The Business Story – A Privacy Gap Can Break Four Things at Once

1. Balance Sheet – DPDP penalty exposure, remediation costs, forensic reviews, legal support, customer notification, technology fixes and lost business can become a material financial event. For a small or medium-sized financial
   institution, this can a􀆯ect profitability, capital planning and investor confidence.
2. Trust – Customers may let o􀆯 a service delay based on a proper justification, but they are far less forgiving when identity documents, bank details, income information or loan records are mishandled. In financial services, trust is more than a brand attribute; it has become the operating license to keep deposits, repayments, referrals and relationships thriving.
3. Operations – A privacy incident can force teams to trace data across systems, vendors, branches, agents and archives. It can expose the gaps related to absence of data inventories, consent logs, retention rules, breach protocols, grievance workflows and accountable owners. The seemingly legal issue will then quickly change into an command-centre operations problem.
4. Interoperability – Financial institutions increasingly operate through APIs, digital lending apps, lending service providers, account aggregators, payment systems, credit bureaus, co-lending partners and outsourced processors. In this connected environment, one weak privacy position can slow onboarding, trigger additional due diligence or cause larger partners to reconsider the relationship.

The Hidden Aspect – Most Institutions Do Not Know Their Real Data
Story

If you ask a leadership team regarding where its customer personal data resides, the first answer is most likely the core banking system, loan origination platform or CRM. Then, after a proper assessment, there can be a more uncomfortable second answer
like email inboxes, spreadsheets, shared folders, third-party dashboards, call-centre recordings, collection agency files, archived databases, WhatsApp conversations and employee devices.

This is where DPDP compliance becomes a business transformation exercise. The institution must move from assumed control to evidenced control. It must know the following – what data it collects, why it collects it, where it stores it, who accesses it, which vendors process it, how long it is retained, how consent is captured, how withdrawal is honoured, how grievances are handled and how breaches are escalated.

The Required Journey – From Awareness to Assurance

1. Awareness building: The board, founders, senior management, business heads, technology teams, operations teams, compliance teams and frontline staff must understand DPDP in their own language. The following are few of the examples –
   – A collection agent needs to know what not to share
   – A product manager needs to know how consent affects journeys
   – A technology lead needs to know what evidence will be required
   – A board member needs to know the business consequence of delay
2. Current-state assessment: The institution needs a structured review of data flows, notices, consent mechanisms, legitimate uses, third-party processing, security safeguards, retention, deletion, breach readiness, grievance handling and governance ownership. The output should be a clear mapping matrix of gap analysis.
3. Maturity roadmap and handholding: DPDP readiness must be classified into practical milestones like quick wins, high-risk remediations, policy and SOP updates, consent redesign, vendor contract strengthening, training roll-out, breach playbook testing and management reporting. An external expert-led consultation can provide the independence, methodology and execution discipline required to convert compliance from a document into an operating capability.

Our Viewpoint – Do Not Wait for the First Incident to Discover the
Gaps

The institutions that act early will turn DPDP into a market signal: “We are safe to partner with, safe to lend through, safe to invest in and safe for customers to trust.” The institutions that delay may discover DPDP through a possibly negative route like a
customer complaint, a breach, a partner audit, a regulator query or a board-level crisis.

The institutions can think of launching a 60-75 day DPDP readiness sprint led by a team of external experts, covering awareness workshops, current-state assessment, risk prioritisation, maturity roadmap creation and implementation handholding. In the DPDP
era, privacy maturity is not back-office compliance, it is rather a strategy for business continuity, trust and interoperability.