Personal data isn’t just a business asset—it’s your liability.

In 2024, the Reserve Bank of India (RBI) imposed over ₹56 crore in penalties across 304 instances, mainly on co-operative banks and NBFCs, due to lapses in cybersecurity and KYC processes. This indicates India’s recently mounting shift from token fines to severe penalties for lapses in data protection.

The Digital Personal Data Protection (DPDP) Act, is the latest and most stringent framework in this evolution. Regulators like RBI, SEBI, IRDAI, TRAI, and PFRDA are not just recommending compliance—they're demanding it. Non-compliance is a ticking time bomb that could cost you up to ₹250 Crores in penalties.

In this article, we’ll break down what India’s key regulators expect from you, why compliance is not just a box to check, and the immediate actions required to safeguard your organization and avoid severe consequences.

The time to comply is now.

The Regulator’s Mandates: A Sector-by-Sector Breakdown

1. RBI

The Reserve Bank of India (RBI) has publicly recognized the DPDP Act and strongly encourages regulated entities to adopt its provisions. Deputy Governor M. Rajeshwar Rao emphasized the need for robust data governance frameworks to safeguard financial data:

“Banks and other financial institutions, as custodians of vast volumes of sensitive customer data, must make the required efforts to adhere to the provisions of the (DPDP) Act and related regulations. 

To manage this transition smoothly, financial institutions must invest in robust data governance frameworks, ensuring that they and their data processors collect, process, and store data in complete adherence to the law... ”

Directives like the Master Direction on Information Technology Governance, Risk, Controls, and Assurance Practices (2023) make it clear that compliance with the DPDP Act is now mandatory for all financial institutions under the RBI’s purview. This includes ensuring comprehensive data protection strategies, managing sensitive customer information, and adhering to transparent consent management processes.

For the BFSI sector, compliance with the DPDP Act requires strong data governance, clear consent management, and proper documentation of data flow. To know more about DPDP compliance for BFSIs, get our DPDP Compliance Checklist.

2. SEBI

The Securities and Exchange Board of India (SEBI) mandates that all regulated entities (REs), such as stockbrokers, mutual funds, and asset management companies, comply with the DPDP Act under the Cybersecurity and Cyber Resilience Framework (CSCRF).

According to Part II, GV.OC.S2 of the CSCRF guidelines:

• REs must comply with data protection laws, including the DPDP Act.
• They must ensure their data security, consent management, and privacy protocols align with the DPDP Act.

SEBI’s directive underscores the importance of data protection for financial market intermediaries. It’s clear that compliance with the DPDP Act is essential to ensure the security of investor data. SEBI is setting the standard for financial market intermediaries, if they want to avoid crores in penalties then DPDP compliance is non-negotiable.

3. IRDAI

The Insurance Regulatory and Development Authority of India (IRDAI), through its Information and Cyber Security Guidelines 2023, mandates that regulated entities in the insurance sector comply with the DPDP Act. This requirement is part of IRDAI’s broader regulatory framework on data protection, which includes adherence to various laws such as the IT Act and its amendments.

According to the guidelines:

• Insurance companies must align their data protection policies with the DPDP Act to safeguard customer data.
• They must document clear data security policies to ensure personal and sensitive data is protected at all stages.

IRDAI’s regulations make it abundantly clear that insurance companies are now legally required to update their data protection measures to comply with the DPDP Act. For the insurance sector, safeguarding personal and financial information has never been more critical.

4. TRAI

The Telecom Regulatory Authority of India (TRAI) has issued regulations emphasizing compliance with the DPDP Act, particularly regarding the protection of telecom subscriber data. Under the Telecom Commercial Communications Customer Preference (Second Amendment) Regulations (2025), strict guidelines have been established for data security and access control in the detection of Unsolicited Commercial Communications (UCC).

Key provisions include:

• Data Security and Privacy: Telecom operators must ensure that subscriber data is protected and not shared or misused without explicit consent.
• Audit Compliance: Telecom companies must undergo security audits conducted by authorized agencies like CERT-IN to ensure adherence to the DPDP Act.
• Access Control: Stringent internal controls must be in place to prevent unauthorized access to UCC detection systems, ensuring data integrity and protection.

TRAI’s regulations underscore the critical importance of safeguarding telecom subscriber data. It is imperative for telecom operators to implement strict data handling policies to ensure compliance with the DPDP Act.

5. PFRDA

The Pension Fund Regulatory and Development Authority (PFRDA) has mandated compliance with the DPDP Act through its 2024 Information and Cybersecurity Policy Guidelines for Intermediaries and Regulated Entities under its jurisdiction, including pension funds and central recordkeeping agencies (CRAs).

Key directives include:

• Data Security Policies: Pension providers must integrate the DPDP Act into their cybersecurity policies to ensure subscriber data is securely protected.
• Intermediary Compliance: All intermediaries under PFRDA must align with the DPDP Act to safeguard personal data.
  

PFRDA’s directives emphasize the necessity for the pension sector to adopt comprehensive data privacy measures. Pension providers and their intermediaries must take immediate action to ensure that their data protection measures are aligned with the DPDP Act to protect subscriber data and avoid penalties.

Why Compliance Cannot Wait

Regulatory bodies have laid down the law.The DPDP Act demands attention now, not later.  Businesses that fail to comply will face severe consequences:

• Penalties and Fines: Non-compliance can lead to fines of up to ₹250 Crores. The penalties aren’t just hypothetical—they’re coming. Recent crackdowns, such as RBI’s ₹56 Crore fines across 304 instances in 2024, show regulators mean business.
• Reputational Damage: Mishandling personal data isn’t just a technical issue—it’s a brand killer. One data breach can erode consumer trust irreparably, leading to long-lasting reputational damage that’s almost impossible to recover from.
• Regulatory Action: Regulators are not sitting idle. The DPDP Rules consultation is over, and the final rules are expected soon—perhaps as early as May. Expect audits, corrective actions, and more scrutiny. If you’re non-compliant, be prepared for more than just a slap on the wrist.

But here’s the reality: DPDP compliance is complex and will take time. Achieving full compliance will likely require an operational overhaul, from data discovery to consent management, and businesses that delay are only setting themselves up for a tougher, more costly road ahead.

2 Critical Steps to Kickstart Compliance

The journey to DPDP compliance is complex and multifaceted— There's a lot to do to ensure full compliance, but starting with these two critical steps will put you on the right path. 

1. Map Your Data Flows:
Data is scattered across multiple systems and it is crucial for DPDP Compliance to understand what data is where and how it moves.

• Identify and document all data sources, systems, and workflows.
• Classify personal data as sensitive or non-sensitive, and apply robust security measures based on these classifications.
• Implement data discovery tools to classify data based on its sensitivity, ensuring you know where your most sensitive data resides.

2. Onboard a Consent Manager:
Automating consent collection will speed up your compliance exponentially:

• Ensure every piece of customer data is collected with proper consent—and documented thoroughly.
• Ensure privacy notices are concise, easy to understand, and readily accessible for your customers.
• Track and update consent preferences as they change, offering customers easy access to update their choices.
• Ensure transparency with auditable consent logs that can withstand regulatory scrutiny.

Don’t wait for everything to be perfect—taking action now is the first and most important step. 

Compliance Tech - The Key to DPDP Success

Regulators are closely monitoring compliance, and businesses that act now will be better positioned to avoid penalties. Compliance requires more than just policy updates; it demands a transformation in how businesses manage personal data.

Thankfully, technology can shoulder the burden for you and make this transition smoother. By leveraging tools like data mapping software, consent management platforms, and data security solutions, businesses can simplify their compliance efforts. Here's how:

• Automate key compliance activities to reduce errors and improve efficiency, ensuring that your data management processes are both accurate and timely.
• Track data flows across systems, ensuring that sensitive data is securely handled at every stage, from collection to processing and sharing.
• Manage consent effectively, ensuring that customers' rights are respected and that their data usage preferences are always up to date.

Leegality Consent Infrastructure is designed to help financial institutions implement DPDP compliance practically — without disrupting business operations. By embracing data governance now you avoid crores in penalties and build trust with your customers. Don’t wait for the fines to come—take action now 

Sign up using the form below to book a demo and establish your business as a leader in responsible data practices.