The collision points
BFSI institutions operate under multiple regulators. DPDP doesn't replace any of them — it overlays. The friction is most acute at three points:
1. KYC retention vs DSAR erasure
RBI's Master Direction on KYC requires 5-year retention from the end of the customer relationship. PMLA Section 12 also requires 5-year retention. A customer requesting erasure cannot have their KYC erased before this period — but you must explain this clearly in your DSAR response, not refuse silently.
Best-practice response template: 'Per [law], we are required to retain [category] for [period] from [trigger]. We have erased the data we are not required to retain — namely [list]. The remaining data is held only for the statutory purpose and is not accessible for any other use.'
2. Payment data localisation
RBI's payment-system data localisation directive (2018) requires payment data to be stored only in India. DPDP Section 16, by contrast, currently permits cross-border transfer except where the Central Government issues a country-restriction notification. Where they overlap (payment data of Indian users), the RBI rule is stricter — comply with that.
The point of confusion: many BFSI teams treat the RBI localisation as if it were a DPDP requirement. It's not. They are independent. If a future MeitY notification under Section 16 restricts non-payment data, that is an additional obligation, not a substitute.
3. Breach notification race conditions
For a single breach, you may face concurrent notification obligations:
- CERT-In: 6 hours (under the 28 April 2022 Directions)
- RBI: per Master Direction on Information Security (varies by entity type)
- IRDAI / SEBI: per sectoral cyber-security guidelines
- DPDP: 'without delay' to the DPBI and to affected Data Principals
Without an integrated playbook, the notifications go out at different times, with different scope, with different language — and can contradict each other. The simplest defence: a single incident-management process that produces all required notifications from a shared incident record.
The SDF question
Almost every meaningful BFSI institution should expect SDF designation when criteria are notified. Volume + sensitivity + sectoral exposure + sovereign-interest factors all push in that direction. Build the additional Rule 13 obligations (DPIA programme, audit cycle, India-resident DPO with board reporting) into your roadmap on the assumption that you'll be designated.
The Account Aggregator question
If you're an FIU under the AA framework: your AA-mediated data sharing is consent-based under RBI rules. Layer DPDP Section 6 requirements on top — granularity per purpose, withdrawal parity, audit trail. Many AA implementations capture the RBI consent without the DPDP elements.