Indian financial services operate under one of the world's most layered data and security regulatory environments. On top of DPDP for personal data, banks and lenders deal with RBI's Master Directions and the IT Outsourcing framework. Insurers deal with IRDAI's Information and Cybersecurity Guidelines and customer-protection rules. Capital market intermediaries deal with SEBI's Cybersecurity and Cyber Resilience Framework. Everyone deals with CERT-In's incident reporting requirements.
Read separately, these requirements appear contradictory. Read together, they form a coherent — if demanding — picture. The compliance leaders who succeed in Indian BFSI are the ones who run one unified programme covering all overlays, not four parallel programmes each handled by a different team.
Five Regulatory Layers in Indian BFSI
Layer 1 — DPDP Act Baseline
DPDP applies to all personal data processing by Indian Data Fiduciaries. For BFSI, this means customer data, prospect data, employee data, and partner data — anywhere personal information lives, DPDP applies. Consent, purpose limitation, Data Principal rights, breach notification, accountability — all standard.
Layer 2 — RBI Overlays for Banks and NBFCs
RBI's existing regulatory architecture predates DPDP by years. Master Direction on Information Technology Governance, Master Direction on IT Outsourcing, Master Direction on Cyber Resilience and Digital Payment Security, and sector-specific circulars on AI, data localisation, and customer data handling all interact with DPDP.
Key intersections — RBI's data localisation requirements for payment system data require certain personal data to be stored only in India, which goes beyond DPDP's more permissive cross-border rules. RBI's IT outsourcing framework requires specific contractual provisions with third-party processors, which augment DPDP's general data processing agreement requirements. RBI's customer complaint timelines interact with DPDP's grievance redressal timelines — generally, the stricter of the two applies.
Layer 3 — IRDAI Overlays for Insurance
Insurance customer data has been regulated by IRDAI for years under the Information and Cybersecurity Guidelines and the policyholder protection framework. DPDP adds explicit consent requirements at policy initiation, transparency on automated decisions (claim approvals, underwriting), and the right to challenge AI-driven adverse decisions.
Key intersections — IRDAI requires retention of policyholder data for defined minimum periods, which interacts with DPDP's storage limitation principle. The reconciliation — the retention periods established by IRDAI represent the 'specified period' under DPDP for that processing purpose, so the two are not contradictory but must be documented as such.
Layer 4 — SEBI Overlays for Capital Markets
SEBI's Cybersecurity and Cyber Resilience Framework intersects DPDP primarily at the incident reporting layer. Key intersections — an incident may simultaneously trigger SEBI reporting, DPDP breach notification, and CERT-In reporting. SEBI-regulated entities need an incident response runbook that classifies events rapidly and notifies all authorities within their distinct statutory windows.
Layer 5 — CERT-In Incident Reporting Requirements
CERT-In mandates reporting of cybersecurity incidents within 6 hours. This strict timeline applies across all sectors and overlaps with DPDP's requirement to notify the Data Protection Board and affected principals of personal data breaches.
The Unified Programme Model
Rather than creating four siloed teams, leading financial institutions implement a single operating structure:
- Unified Data Governance: Single metadata registry covering purpose, retention, and storage boundaries across both DPDP and sectoral circulars.
- Coordinated Incident Runbook: Incident triage protocol determining notification triggers simultaneously for CERT-In (6 hours), SEBI, RBI/IRDAI, and DPBI.
- Joint DPO & CISO Office: Formal collaboration model establishing clear accountability for intersecting privacy and security controls.
- Integrated Vendor Due Diligence: Master data processing agreement incorporating both DPDP requirements and RBI/IRDAI outsourcing clauses.
- Unified Annual Audit Cycle: Combining DPDP DPIAs, sector cybersecurity reviews, and statutory vulnerability assessments.
The Shift to Make
Stop running DPDP, RBI/IRDAI/SEBI compliance, and CERT-In compliance as separate streams. Start running one unified programme that satisfies all overlays simultaneously. The architecture is more efficient, the risk posture is stronger, and duplicate compliance effort is eliminated.
