RBI Regulations + DPDP Alignment Checker

Check your RBI-DPDP alignment

Do you process payments data covered by RBI's data localisation directive?

Do you use third-party vendors for data processing, storage or support (outsourcing)?

How is consent for KYC data collection and use structured?

Do you retain customer financial data beyond RBI-mandated periods for any reason?

Where RBI rules and the DPDP Act intersect

Data localisation — RBI requires payments system data stored exclusively in India; DPDP adds cross-border transfer restrictions on top
Outsourcing directions — RBI's vendor risk framework must be layered with DPDP Data Processor obligations in the same contracts
KYC data — collected for regulatory compliance, but any use beyond that (marketing, cross-sell, analytics) needs separate DPDP consent
Retention — RBI sets minimum retention periods; DPDP requires erasure once purpose is served and no legal basis remains
Breach notification — RBI has its own incident reporting timelines; DPDP adds Data Protection Board and Data Principal notification duties
Credit information sharing with bureaus — needs a DPDP-compliant consent and disclosure basis, not just regulatory mandate

RBI compliance does not automatically mean DPDP compliance

Banks, NBFCs and fintechs have operated under RBI's data governance framework for years — data localisation for payments data, the Master Direction on Outsourcing of IT Services, and detailed KYC/AML data handling rules. It is a common and costly assumption that satisfying these makes an entity automatically DPDP compliant. The two frameworks serve different regulators with different goals: RBI focuses on financial system stability and data sovereignty, while DPDP focuses on individual consent, purpose limitation and data principal rights. A regulated entity needs to satisfy both, and in a few areas — like KYC data reuse for marketing — the frameworks require genuinely separate compliance steps.

The most common gap Niti Bharat finds in fintech and NBFC audits is vendor contracts: outsourcing agreements drafted to satisfy RBI's outsourcing directions almost never include DPDP-specific Data Processor clauses — purpose limitation, sub-processor consent, breach notification timelines to the Data Fiduciary. Both sets of obligations need to sit in the same vendor agreement.

Building one compliance programme that satisfies both regulators

Rather than running RBI compliance and DPDP compliance as separate workstreams, the efficient approach is a single data governance programme that maps every data flow to both regulatory bases at once — noting where RBI sets the floor (localisation, retention minimums) and where DPDP adds an additional layer (consent specificity, erasure rights, breach notification to the DPB). Niti Bharat's Fintech DPDP Compliance Pack is built for exactly this dual-framework reality, with the enforcement deadline of May 2027 as the working timeline for regulated entities.

Get the RBI-DPDP Alignment Map (free)

A framework-by-framework mapping of RBI data localisation, outsourcing directions and KYC rules against DPDP Act requirements, with gap-closing actions.

Frequently Asked Questions

Does RBI data localisation satisfy DPDP cross-border transfer rules?+

Not automatically. RBI localisation requires payments system data to stay in India, which helps, but DPDP's approach to cross-border data transfer restrictions is separate and may apply to other data categories RBI does not cover.

Can KYC data be used for marketing under DPDP?+

Only with separate, specific consent. KYC data is collected for a regulatory purpose; using it for marketing or cross-sell without a distinct consent basis breaches the DPDP requirement for purpose-specific consent.

Do RBI outsourcing contracts need to be rewritten for DPDP?+

In most cases yes, or at minimum amended. RBI outsourcing directions focus on operational and vendor risk; DPDP requires additional Data Processor clauses covering purpose limitation, sub-processing consent, and breach notification obligations.

Which regulator enforces DPDP for banks and NBFCs — RBI or the Data Protection Board?+

The Data Protection Board of India enforces the DPDP Act across all sectors, including regulated financial entities. RBI continues to enforce its own regulations in parallel — the two are not a substitute for each other.

Quick Answer