BFSI Data Breaches amidst DPDP rules leave doubts in the minds of many

The recently unveiled draft rules under the Digital Personal Data Protection (DPDP) Act are poised to transform how banks, non-banking financial companies (NBFCs), and insurance firms manage customer data. The proposed regulations emphasize explicit customer consent for data sharing and restrict its use to predefined purposes, posing potential challenges to cross-selling strategies and operational workflows in the financial sector.

One significant shift under the DPDP rules for BFSI sector is the prohibition on financial institutions sharing customer data with subsidiaries without explicit consent. This disrupts the prevalent practice of banks and NBFCs utilizing subsidiary networks to promote products such as insurance, mutual funds, and other financial services.

In response to growing concerns about Indian BFSI Sector Data Breaches, the draft Data Protection Act places a strong emphasis on transparency and cybersecurity within the BFSI Sector. The proposed regulations mandate financial entities to provide clear and detailed notices about data collection, usage, and retention practices. To ensure inclusivity, these notices must be available in English as well as in 22 Indian languages, empowering a diverse customer base to make informed decisions about their data.

The Act introduces strict data retention norms to curb misuse and enhance BFSI Sector Cybersecurity. Financial entities are required to collect and retain customer data solely for the purposes specified at the time of collection. Once the stated purpose is fulfilled or the customer withdraws consent, the data must be permanently deleted. These measures aim to close the loopholes often exploited in data breaches, ensuring stronger protection for sensitive financial information.

 

Read More: https://varindia.com/news/explanatory-note-to-digital-personal-data-protection-rules-2025

Customers will have greater control over their personal data, with the right to request detailed summaries of its usage and withdraw consent at any point. This ensures that data processing halts immediately upon such withdrawal, safeguarding the integrity and confidentiality of the customer’s information.

These draft regulations signify a transformative step in addressing Indian BFSI Sector Data Breaches, compelling financial institutions to adopt robust cybersecurity frameworks. By prioritizing transparency and empowering customers, the rules demand a fundamental rethinking of data management strategies in the sector. Financial institutions are urged to integrate cutting-edge cybersecurity measures to preempt potential breaches and align with the principles of accountability and customer-centricity.

With data breaches becoming a recurring challenge in the BFSI sector, the proposed changes underscore the importance of proactive regulatory intervention. These measures not only aim to restore customer trust but also set a benchmark for data privacy and security in India’s financial ecosystem. The emphasis on BFSI Sector Cybersecurity and stringent compliance standards is expected to redefine how financial institutions safeguard customer data in an increasingly digital economy.