A loan application may pass through a bank, an NBFC, a lending service provider and several technology platforms before approval. Each stage can involve personal information, including identity details, bank records, income documents and contact information.
When this information is collected without clear purpose limits, stored longer than necessary or shared without adequate controls, the risk extends beyond cybersecurity. It can also create privacy and regulatory exposure.
The DPDP compliance for banks and NBFCs conversation has become particularly relevant ahead of India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the Digital Personal Data Protection Rules, 2025, taking effect in phases. The main data-fiduciary obligations and the detailed breach-notification requirements are scheduled to commence on 13 May 2027.
For financial institutions, preparation should start with the way customer data moves through onboarding, verification, lending and servicing.
DPDPA Penalties: Understanding the Exposure
The DPDP Act's penalty schedule sets maximum penalties of ₹250 crore for failure to maintain reasonable security safeguards and ₹200 crore for failure to meet personal data breach notification obligations. These are statutory maximums, not automatic fines for every incident.
The Act also provides for penalties of up to ₹50 crore for other specified violations. The applicable penalty depends on the nature of the violation and the relevant statutory provisions.
Banks and NBFCs should assess exposure across three areas:
- Security failures: Unauthorised access to identity documents, weak access controls or inadequate protection of stored personal data.
- Notification failures: Delays or omissions in communicating a personal data breach as required.
- Operational gaps: Inadequate processes for handling personal data, managing vendors or meeting applicable obligations.
DPDP compliance does not replace RBI requirements or other applicable cybersecurity and reporting obligations. Financial institutions should assess these requirements together when developing their incident-response procedures.
Where Customer Data Risks Arise
Customer data risks often emerge between systems rather than within a single application.
During onboarding, forms may collect more information than the stated purpose requires. During KYC, identity documents and verification results may be accessible to employees who do not need them. During credit assessment, bank statements and income proofs may pass through external platforms.
Third-party integrations create another area of concern. A financial institution may rely on verification APIs, cloud infrastructure, loan origination systems and outsourced service providers. Weak access restrictions or unclear responsibilities can make it difficult to establish how information is handled.
Retention is equally important. Downloaded documents, duplicate files and records left in legacy systems can remain accessible long after their original purpose has ended.
A practical response begins with a data-flow inventory. Map what is collected, why it is needed, who can access it, where it is stored and when it can be deleted, subject to applicable legal retention requirements.
Data Minimisation in Banking and Lending
Data minimisation means limiting personal data collection and processing to what is necessary for the specified purpose.
For banks and NBFCs, this requires reviewing application forms, verification workflows, employee permissions and document-retention practices. If a verification result meets an operational requirement, retaining a complete identity document indefinitely may not be necessary, unless another legal or regulatory obligation applies.
Before collecting or sharing information, teams should establish:
- The specific purpose for processing.
- The appropriate legal basis and notice or consent requirements.
- Who needs access to the information.
- How long the information must be retained.
- Whether the information can be securely deleted when no longer required.
An Identity Verification API can help businesses organise identity checks within digital onboarding workflows. However, using an API does not automatically establish DPDP compliance. Institutions remain responsible for assessing their processing activities, access controls, retention practices and vendor arrangements.
A Six-Month Readiness Checklist for 2027
Use this roadmap to organise preparation ahead of the scheduled May 2027 implementation. Confirm the commencement status of individual provisions before relying on any deadline.
Month 1: Map personal data
Inventory customer information across onboarding, KYC, credit assessment and servicing. Identify external processors, duplicate records and unnecessary data collection.
Month 2: Review privacy notices
Prepare clear notices that explain the personal data collected, the purposes of processing and the applicable routes for exercising customer rights. Review consent and other lawful processing requirements with your compliance team.
Month 3: Strengthen security
Review access permissions, encryption, masking, logging, monitoring and backup arrangements. Ensure that employees and vendors receive only the access they need.
Month 4: Prepare for breach notification
Establish incident escalation procedures, assign notification responsibilities and run a simulated breach exercise.
Under Rule 7 of the DPDP Rules, 2025, affected individuals must be notified without delay. The Data Protection Board must also receive an initial intimation without delay, followed by detailed information within 72 hours of awareness, unless a longer period is permitted by the Board.
Month 5: Review vendors and retention
Check contractual safeguards, data-sharing arrangements and deletion procedures. Preserve records where applicable laws or regulatory requirements require retention.
Month 6: Test and document
Conduct a gap assessment, record unresolved issues and assign owners and deadlines. Review the findings with compliance, IT, risk and business teams.
Where VerifyEdge Fits
Managing verification across disconnected systems can create unnecessary manual work and make it harder to maintain consistent processes.
VerifyEdge by SecureEdge offers verification APIs that businesses can integrate into their workflows for checks involving PAN, bank accounts, identity information, business details and documents, depending on the selected services.
For banks, NBFCs and fintech companies, the practical value lies in organising verification processes and reducing repetitive manual handling. Before deployment, evaluate the API's data flows, security controls, access permissions, retention arrangements and contractual responsibilities.
VerifyEdge can support verification operations, but the wider compliance programme must also address privacy notices, appropriate processing grounds, incident response and applicable regulatory obligations.
Planning your 2027 readiness? Explore VerifyEdge to discuss verification API requirements for your business.
Conclusion
For banks and NBFCs, preparing for DPDP compliance means examining how customer information is collected, accessed, shared and retained across the lending lifecycle. Mapping these processes now gives teams time to identify gaps and test their response procedures before the scheduled 2027 implementation.
A well-governed verification workflow can be part of that effort, provided it sits within a broader privacy and security framework.
