DPDP Act for Fintech KYC: Build Compliance Into Onboarding

The Digital Personal Data Protection (DPDP) Act, 2023, directly affects how fintech companies collect, process, and store customer data during KYC. You can build DPDP compliance into your onboarding stack by treating consent as the core of every data collection step, minimizing what you collect, and implementing clear deletion timelines. This article explains what the Act requires, how it changes KYC workflows, and the practical steps to integrate compliance from the first screen a user sees.

Background: What the DPDP Act Actually Says

The DPDP Act is India’s first comprehensive data protection law, replacing the earlier (and never fully implemented) Section 43A of the IT Act. It governs “digital personal data”—any information about an identifiable person that is processed in digital form. For fintech, that includes name, address, PAN, Aadhaar (with restrictions), bank account numbers, transaction history, and even device fingerprints used for fraud checks.

Key obligations relevant to KYC include:

• Consent: You must obtain free, specific, informed, unconditional, and unambiguous consent with a clear opt-out mechanism. Consent requests must be in plain language, not buried in terms and conditions.
• Purpose limitation: Data can only be used for the purpose stated at collection. You cannot repurpose KYC data for marketing without fresh consent.
• Data minimization: Collect only what is necessary for the KYC purpose. If you don’t need a customer’s income for a basic wallet, don’t ask for it.
• Storage limitation: Retain data only as long as necessary. The Act does not set a fixed period, but you must define and enforce a deletion policy.
• Security safeguards: Implement reasonable security controls to prevent breaches. This includes encryption, access controls, and regular audits.
• Grievance redressal: Appoint a Data Protection Officer (DPO) and a grievance officer who must respond within a set timeframe (typically 7 days for acknowledgment, 30 days for resolution).

The Act also restricts cross-border data transfers (except to specified countries) and imposes significant penalties for non-compliance—up to ₹250 crore per instance. For fintechs, the risk is not just fines but also loss of customer trust and regulatory action from the RBI.

How DPDP Changes the KYC Onboarding Flow

Traditional KYC flows were designed for regulatory compliance (e.g., RBI’s KYC norms) but often ignored data protection. Under DPDP, every step must be rethought:

1. Consent layer: Instead of a single “I agree” checkbox, you need granular consent for each data use. For example, separate consents for KYC verification, fraud monitoring, and marketing.
2. Data minimization: Review each field in your KYC form. Ask: Is this required by RBI or can we do without it? For low-risk accounts, you might only need name, address, and PAN.
3. Notice: Provide a privacy notice that explains what data is collected, why, how long it will be kept, and how users can withdraw consent. This must be available in the user’s preferred language.
4. Withdrawal mechanism: Users must be able to withdraw consent easily—ideally through the same app or website. Upon withdrawal, you must stop processing and delete data unless a legal obligation requires retention.
5. Deletion automation: Build automated scripts that delete or anonymize data after the retention period. Manual deletion is error-prone and unverifiable.

For example, a fintech app that previously collected Aadhaar, PAN, bank statements, and selfie would now need to justify each. The Aadhaar number cannot be stored unless the user consents and it is necessary for the KYC. The selfie, used for liveness check, should be discarded after verification, not stored for years.

Practical Steps to Build Compliance into Your Stack

Compliance is not a checkbox; it’s a design principle. Here are actionable steps to integrate DPDP into your onboarding:

• Map your data flows: Document every piece of personal data, where it comes from, where it goes, and who has access. This is the foundation of any compliance program.
• Use a consent management platform (CMP): A CMP helps you create, record, and manage consent. It should timestamp each consent and link it to the specific purpose.
• Encrypt data at rest and in transit: Use AES-256 for storage and TLS for transmission. This is a baseline security measure.
• Implement role-based access: Only employees who need KYC data for verification should see it. Log all access.
• Set up deletion schedules: Define retention periods based on legal requirements (e.g., RBI may require KYC records for 5 years after account closure) and automate deletion after that.
• Train your team: Everyone from customer support to developers should understand DPDP basics. A data breach is often caused by an insider error.
• Conduct DPIA for high-risk processing: A Data Protection Impact Assessment is not explicitly required by DPDP, but it’s good practice for large-scale KYC processing.

Common Challenges and Misconceptions

One common misconception is that DPDP overrides RBI’s KYC requirements. It does not. Both laws apply simultaneously. You must collect KYC data as per RBI, but you must also protect it as per DPDP. For example, RBI mandates Aadhaar-based e-KYC for some accounts, but DPDP restricts storing Aadhaar numbers. The solution is to use the Aadhaar e-KYC service, which returns a masked ID, and not store the full number.

Another challenge is consent withdrawal. If a user withdraws consent for KYC, you cannot process their data, but you may still need to keep it for legal compliance (e.g., anti-money laundering). In such cases, you can retain the data but stop using it for other purposes. The DPDP Act allows processing without consent for legal obligations, but you must document the specific law.

Third-party vendors (e.g., KYC verification agencies) are also a risk. Under DPDP, you are responsible for the data you share with them. You need to sign data processing agreements and ensure they comply. If they breach, you are liable.

How to Choose a DPDP-Compliant KYC Vendor

If you outsource KYC verification, choose a vendor that demonstrates DPDP compliance:

• Data localization: Ensure the vendor stores data in India or in a country approved by the government.
• Encryption and security: Ask about their security certifications (e.g., ISO 27001) and data encryption standards.
• Deletion capabilities: Verify they can delete data on your request and provide proof.
• Sub-processor management: Know who their sub-processors are and whether they are also compliant.
• Breach notification: Confirm they will notify you within 72 hours of a breach, as required by DPDP.

You should also run a vendor risk assessment before signing. The vendor is your data processor, and you are the data fiduciary. The law holds you accountable for their actions.

Cost and Resource Implications

Building DPDP compliance into your onboarding stack has costs, but they are far lower than the penalty for non-compliance. Costs include:

• Consent management platform: ₹50,000–₹5,00,000 per year depending on scale.
• Data mapping and DPIA: Internal hours or consultant fees, typically ₹2–10 lakh for a mid-size fintech.
• Legal review: ₹1–3 lakh for a comprehensive privacy audit.
• Engineering time: Building consent screens, deletion scripts, and audit logs can take 2–6 weeks of developer time.
• DPO salary: If you hire in-house, ₹15–40 lakh per year; or outsource for ₹5–15 lakh annually.

However, many of these costs are one-time. The ongoing cost is mainly maintenance and audits. Compared to a ₹250 crore penalty, this is a prudent investment.

Frequently Asked Questions

Does DPDP apply to startups or only large companies?

The DPDP Act applies to all entities that process digital personal data in India, regardless of size. There is no exemption for startups. However, the Data Protection Board may consider the size and nature of the business when imposing penalties, but the obligations remain the same.

Can I use Aadhaar for KYC under DPDP?

Yes, but with restrictions. The Aadhaar Act and DPDP both apply. You can use Aadhaar e-KYC, but you cannot store the full Aadhaar number unless it is necessary for the purpose and the user has consented. The safest approach is to use the masked Aadhaar or the VID (Virtual ID) and not store the raw number.

What happens if a user withdraws consent after KYC?

You must stop processing their data for the consented purpose. However, if you are legally required to retain the data (e.g., for anti-money laundering), you can keep it but must not use it for other purposes. You should have a process to flag such accounts and restrict processing.

How long can I keep KYC data?

The DPDP Act does not specify a fixed retention period. You must define a retention schedule based on legal requirements (e.g., RBI mandates 5 years after account closure) and delete data once the purpose is served. Document your policy and enforce it automatically.

Do I need a Data Protection Officer (DPO)?

The DPDP Act requires the appointment of a DPO only if you are a “significant data fiduciary” as notified by the government. However, it also requires you to have a grievance officer. For most fintechs, appointing a DPO is good practice even if not strictly mandated, as it shows commitment to compliance.

What are the penalties for non-compliance?

Penalties can be up to ₹250 crore per instance for significant breaches. Additionally, the Data Protection Board can order you to stop processing, rectify data, or take other corrective measures. The reputational damage can be even more costly.

Related

• Force Reader Mode Every Webpage? How To
• Vtuber Agency vs Independent: Which Is Better?
• Screen Mirror iPad to Firestick: Full Guide