Data Privacy & Security Requirements for India’s Financial Sector

28 September 2026

By Ananya Sarkar and Pratishtha Sharma

India’s financial services sector operates within a layered data protection framework. While the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) provide the legislative framework for processing digital personal data, financial institutions must also navigate specific requirements prescribed by sectoral regulators such as the Reserve Bank of India (“RBI”), Securities and Exchange Board of India (“SEBI”) and Insurance Regulatory and Development Authority of India (“IRDAI”). For financial institutions, compliance therefore requires an integrated approach that considers both privacy obligations under the DPDP framework and sector-specific data protection and cybersecurity requirements.

KEY REGULATORY REQUIREMENTS

Digital Personal Data Protection Act, 2023[1] and Rules, 2025[2]

  • Personal data must be processed for a lawful purpose, based on consent or another legitimate use permitted under the Act.
  • Data Fiduciaries must implement appropriate technical and organisational measures and reasonable security safeguards to prevent personal data breaches.
  • Personal data must be erased when consent is withdrawn or the specified purpose is no longer served, unless retention is required by law.
  • Data Principals must be enabled to exercise their rights to access, correction, updating, erasure and grievance redressal.
  • In case of a personal data breach, prescribed breach notifications must be made to affected Data Principals and the Data Protection Board.

Reserve Bank of India (Digital Payment Security Controls) Directions, 2026[1]

  • Applicable RBI-regulated entities must assess risks relating to data storage, security and privacy protection and maintain a database of systems and applications storing customer data.
  • Appropriate encryption and security must be implemented for data processing and transmission.
  • Digital payment applications must follow a secure-by-design approach and ensure minimal data collection and app permissions.
  • Web applications must not store sensitive information in HTML hidden fields, cookies or other client-side storage.
  • Account numbers, card numbers and other sensitive information must be masked when transmitted through SMS or email.

SEBI Cybersecurity and Cyber Resilience Framework for Regulated Entities, 2024[1]

  • Regulated Entities (“RE”) must classify data into regulatory data and IT and cybersecurity data. Regulatory data must be kept available, legible and usable within the legal boundaries of India.
  • Data at rest and in transit must be protected using industry-standard encryption algorithms, with access based on the Principle of Least Privilege.
  • Web and mobile applications must not store sensitive information in HTML hidden fields, cookies or other client-side storage.
  • REs must maintain policies for data retention and disposal and a Data Migration Policy to maintain data integrity.

SEBI Framework for Adoption of Cloud Services by Regulated Entities, 2023[1]

  • REs must undertake risk assessment and due diligence before adopting cloud services.
  • REs must remain accountable for the confidentiality, integrity, availability and security of their data and logs.
  • REs must retain ownership of data, encryption keys and logs and ensure appropriate protection of data in the cloud.
  • Cloud arrangements must provide appropriate access and audit rights to the RE, SEBI and authorised agencies.
  • REs must maintain appropriate business continuity, disaster recovery and exit arrangements.

IRDAI Information and Cyber Security Guidelines, 2023[1]

  • Information must be classified based on its value and sensitivity and protected according to its classification.
  • Access to information must follow need-to-know and least privilege principles.
  • Sensitive information must be protected through appropriate cryptographic controls, including encryption at rest and in transit.
  • Appropriate security and access controls must apply to third parties and service providers.
  • Appropriate logging, monitoring and incident management controls must be maintained.

Key Actions for Financial Sector

  • Regulatory & Data Mapping: Map regulatory obligations and data flows under the DPDP framework and applicable RBI, SEBI and IRDAI requirements.
  • Privacy Notices & Consent: Review privacy notices and consent mechanisms to ensure transparency, purpose limitation and valid consent, where applicable.
  • Data Governance & Security: Strengthen data classification, access controls, encryption, retention and secure disposal practices.
  • Third-Party & Cloud Governance: Review third-party and cloud arrangements for appropriate privacy, security, audit and data-handling safeguards.
  • Breach Response & Compliance Monitoring: Establish incident response and reporting mechanisms, supported by periodic assessments, audits and employee awareness.

Way Forward

For financial institutions, data privacy compliance extends beyond the DPDP Act and DPDP Rules, with RBI, SEBI and IRDAI requirements creating a layered framework governing data security, access, third-party processing, cloud adoption and other aspects of the data lifecycle. Financial institutions should also ensure appropriate due diligence, contractual safeguards, access controls,
https://www.sebi.gov.in/legal/circulars/mar-2023/framework-for-adoption-of-cloud-services-by-sebi-regulated-entities-res-_68740.html
https://irdai.gov.in/document-detail?documentId=3314780
security requirements and ongoing oversight of third parties such as payment processors, SaaS and fintech providers, intermediaries, KYC/AML service providers and credit information providers. As the DPDP framework moves towards full implementation, financial institutions should adopt an integrated approach that aligns these sector specific requirements with their broader privacy obligations to mitigate regulatory risk, strengthen customer trust and enhance organisational resilience.

To understand how your organisation can align its existing financial sector regulatory compliance with the DPDP framework and develop an effective privacy programme, explore our Data Privacy Compliance and Advisory Services.

Disclaimer: This article is the copyright of Reina Consulting LLP. It is not intended to be a form of solicitation or advertising. The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is viewed or that it will continue to be accurate thereafter. No person should act on such information without appropriate professional advice based on the circumstances of a particular situation. This information is not to be considered as legal advice or opinion and the firm shall not be liable for any action taken by the user, directly or indirectly, on the basis of such material.