DPDP for Banks, NBFCs, Fintech, Stock Brokers & Insurance (BFSI)

Can my bank / NBFC / broker delete everything when I close the account or demat?

Not where another law requires them to keep it longer. The Act uses a bank as its own example: identity records from a closed account can be kept for ten years where banking law says so.

Outside what a law demands, the ordinary rule applies. Once there is no live reason left, it should go.

ACT · Section 8(7) illustration.

Can they use my data after I default on a loan?

There is a specific carve out, and it is narrower than lenders tend to assume. It covers working out the financial position, assets and liabilities of someone who has defaulted on a loan from a financial institution. That is about establishing what you owe and what you own.

It is not a licence to run a recovery campaign, and it still has to respect what other laws say about disclosure.

It is also tied to particular meanings. Default and financial institution take their meanings from the insolvency law, so it does not automatically stretch to every unpaid amount owed to every kind of intermediary. A margin shortfall at a broker is not obviously inside it.

ACT · Section 17(1)(f) and its Explanation.

I bought an insurance policy online, did the consent I clicked also waive my right to complain to the Data Protection Board?

No, and the Act says so with its own example. A tick box that also signs away your right to complain to the Data Protection Board is invalid for that part. The rest stands. That piece simply never took effect.

ACT · Section 6(2) illustration.

Can my stock broker / mutual fund platform keep using my data for product recommendations after I close the account?

Only with a fresh and specific reason. Once the relationship ends the original purpose is normally over, and having been a customer is not a reason to keep selling to you.

Anything a law requires them to retain is a separate matter, and being allowed to keep something is not permission to market from it.

ACT · Sections 4 and 6.

Are NBFCs and stock brokers treated differently from banks under DPDP?

Not by this law. A bank, an NBFC, a broker and an insurer all sit under the same general rules. There is no special tier for financial firms, and no special tier for sensitive information either.

Extra duties come from RBI, SEBI or IRDAI, and those continue to apply, because this law sits on top of other laws rather than replacing them.

One thing can change the picture, and it is not size or sector on its own. The Central Government can name any organisation, or a whole class of them, as a Significant Data Fiduciary. That adds a data protection officer based in India, an independent auditor, and a yearly impact assessment and audit. Those duties arrive only with an actual notification.

ACT · Sections 10 and 38(1).

Can my bank/NBFC share my data with a group insurance or mutual fund company?

Only with a reason of its own. Being part of the same group is not one, and a customer of the bank is not automatically a prospect for the insurer. Where the sharing is for selling to you, nothing on the law's short list covers it, so that means asking you.

ACT · Sections 4 and 6.

Can they use my transaction data to offer me pre approved loans without fresh consent?

Offering you a new product is normally a separate purpose from running the account you already have. Unless one of the situations where the law does not require asking clearly applies, or you agreed specifically to that use, they have to ask.

ACT · Section 6.

If I close my demat or trading account, how long can the broker keep KYC and transaction records?

For as long as a live reason remains, or as long as another law requires it, and SEBI rules commonly do. This law sets no period of its own here. It gives way to the legal requirement, and then expects deletion once that runs out.

ACT · Section 8(7).

Can an insurer use my health data from a claim for other products?

Not automatically. Information given to settle a claim was given for settling that claim. Using it to price or market other products is a different purpose and needs its own reason.

ACT · Sections 4 and 6.

A recovery agent called my relatives about my loan. Is that allowed?

The carve out for defaulters covers working out your financial position, your assets and your liabilities. It says nothing at all about contacting the people around you.

Telling a relative, a neighbour or your employer that you owe money is a disclosure of your information to somebody who has no part in the loan. That is a separate purpose, and the defaulter carve out does not reach it.

Rules on recovery conduct apply on top of this. This law sits alongside other laws rather than replacing them, so meeting one does not excuse breaking the other.

ACT · Sections 17(1)(f), 4 and 38(1).

The lending app wants access to my contacts and SMS. Is that allowed?

Only for what the app genuinely needs to do the job you came for. Agreement is limited to the information the stated purpose actually requires, and the Act makes exactly this point with its own example: an app that asks both to provide its service and for your contact list gets agreement for the service only, because the contact list was never necessary for it.

A lending decision does not need your address book. Asking for it anyway, and treating a tap as agreement, does not make it necessary.

ACT · Section 6(1) and its Illustration.

Can the bank insist on KYC documents, or can I refuse?

KYC is not really the bank asking your permission. Another law obliges the bank to collect it, and where that is so the collection rests on that legal obligation rather than on your agreement.

The limit is that it stays tied to what those rules actually require. Collecting more than that, or reusing your KYC documents to market to you or to feed a group company's products, falls outside and needs a reason of its own.

ACT · Sections 7(d), 6(1) and 8(7).

RBI or SEBI rules require us to keep your data, so we can use it for anything.

A legal duty to retain permits keeping it for that duty. It does not unlock a second use. Marketing, cross selling and profiling each need their own reason, whatever the retention rule says.

You ticked the box at account opening, so you consented to cross selling and partner offers.

Agreement has to be free, specific, and limited to what the stated purpose actually needs. Bundling unrelated marketing into an account opening flow does not meet that, and if it is disputed it is the institution that has to prove you validly agreed.

The terms you accepted mean you cannot complain to the Board.

Any part of an agreement that cuts across the Act is invalid for that part. The Act uses this exact example: signing away the right to complain to the Data Protection Board does not work.

We are a Significant Data Fiduciary, so we are entitled to collect more from you.

Being named a Significant Data Fiduciary adds obligations to the institution. It gives it no additional entitlement over your data at all.