Fintech compliance in India
where the DPDP Act meets RBI.

Fintechs usually treat RBI retention and DPDP erasure as a conflict and resolve it by keeping everything. They do not conflict. Section 8(7) of the DPDP Act exempts retention necessary for compliance with law, but only for the data that law names, for as long as it names.

The anti-money-laundering rule is the anchor. Section 12 of the Prevention of Money-laundering Act requires reporting entities to keep records of transactions and of client identity for five years after the transaction or after the business relationship ends. RBI's KYC directions, consolidated in November 2025, build on it. That covers the KYC document, the video-KYC recording, the transaction history. It does not cover the marketing consent captured at signup, the referral graph, the device fingerprint used for growth analytics, or the half-completed application of someone who never became a customer.

So the work is a map, field by field: which law requires each field, from what trigger, for how long, and what happens at the end. A regulated entity that can produce that map passes an inspection. One that says "we are RBI-regulated, we keep everything" has told the examiner it cannot tell the two kinds of data apart. The DPDP retention and erasure guide covers the Rule 8 mechanics, including the one-year floor on logs.

Three consent layers run through a typical fintech, and only one of them is DPDP consent. An Account Aggregator consent artefact authorises one flow of financial data. An app's permission prompt authorises access to a device resource. Neither is the section 5 notice and section 6 consent you must be able to prove.

The Account Aggregator framework is RBI's own consent architecture, with its own artefact, purpose codes and expiry. It is well designed, and it answers a narrower question: may this institution fetch that account's data for this purpose. Your DPDP notice still has to tell the person what you will do with the data once it arrives, and your record still has to show which notice version they saw.

Lending adds a third layer. The Digital Lending Directions, 2025 bar apps from contacts, call logs, files and telephony functions, allow one-time camera, microphone or location access only for onboarding or KYC with explicit consent, and require collection to be need-based with an audit trail and a way to revoke consent and ask for deletion. Data may be processed abroad only if it is deleted there and returned to India within 24 hours. The same onboarding consent also will not carry a later cross-sell campaign: purpose limitation under section 6(1) is the provision most often breached by re-using it.

A cyber incident at a bank or NBFC must reach RBI on DAKSH within six hours of detection and CERT-In within six hours. If personal data is affected, the Data Protection Board and every affected person must be told without delay, with the Board's detailed report within 72 hours. SEBI entities add SEBI and the exchange.

The clocks run in parallel from different triggers, detection for RBI and awareness for the Board, so the incident runbook has to name who files each report. A fintech that is not itself regulated, but processes for a bank, will be contractually required to tell the bank fast enough for the bank to meet its six hours, which in practice means within one or two. The breach deadline calculator lays the deadlines out from a single timestamp.

Regulated entities should read the RBI cybersecurity guide or, for brokers, the SEBI CSCRF guide. For the law underneath all of it, read the DPDP Act and Rules 2025 guide. To see what your own website does before a visitor answers the banner, run the free two-pass cookie scan. The consent platform holds versioned notices in 22 languages, a hash-chained consent ledger, withdrawal relayed to each processor, and rights requests and breaches on their statutory clocks. The industries overview compares all eight sectors.