International Banks in India Face Dual Regulatory Obligations: DPDPA and Sectoral Prudential Norms
The DPDPA operates concurrently with RBI, SEBI, and IRDAI regulations. For international banks, compliance requires harmonising data protection obligations with existing prudential and operational requirements across both regimes.
International banks operating in India through branches, subsidiaries, or representative offices process personal data of millions of Indian Data Principals — account holders, borrowers, cardholders, insurance customers, and investment clients. Every processing activity falls within the scope of the Digital Personal Data Protection Act, 2023.
The compliance challenge for international banks is not just DPDPA in isolation. It is the convergence of DPDPA with existing RBI directions on data localisation (April 2018), SEBI cybersecurity circular requirements, IRDAI data governance norms, and cross-border data sharing obligations under bilateral supervisory arrangements. A compliance architecture that addresses DPDPA without harmonising with sectoral regulations will fail at the first regulatory examination.
RBI Data Localisation and DPDPA Section 16
The Reserve Bank of India mandated in April 2018 that all payment data relating to Indian transactions must be stored exclusively in India. This is a localisation mandate — stricter than DPDPA Section 16, which uses a negative list approach permitting transfers to all jurisdictions except those specifically restricted. International banks must satisfy both: RBI localisation for payment data AND DPDPA Section 16 compliance for all other personal data categories.
Consent Architecture for Banking Products
An international bank in India typically offers multiple products through a single customer relationship — savings accounts, credit cards, loans, insurance, investments. Under DPDPA Section 6, consent must be specific to each purpose. A single account opening consent form that covers all future products and processing purposes is non-compliant. Each product, each processing purpose, requires separate, informed consent.
Product-level consent segregation
Separate consent for account services, credit assessment, marketing, cross-selling, and analytics
KYC data processing basis
KYC data processing under Section 7(a) — compliance with legal obligation — does not require consent but requires a notice under Section 5
Wealth management profiling
Behavioural profiling for investment recommendations requires explicit consent. Legitimate use exemptions do not cover discretionary advisory services
Key DPDPA Obligations
| Obligation | Section / Rule | Description |
|---|---|---|
| RBI + DPDPA dual compliance | Section 16 + RBI 2018 | Payment data localised per RBI; all personal data compliant with Section 16 negative list |
| Product-specific consent | Section 6 | Separate consent per banking product and processing purpose |
| KYC notice obligation | Section 5 + Section 7(a) | Notice for KYC processing even when consent-exempt under legitimate use |
| Cross-border supervisory data | Section 16, Section 17(2) | Supervisory data sharing with home regulator mapped against DPDPA framework |
| Breach notification | Section 8(6), Rule 7 | Board and customer notification; harmonised with CERT-In 6-hour direction |
| Vendor governance | Section 8(2) | DPAs with fintech vendors, payment processors, correspondent banks, and outsourced operations |
Request a Banking DPDPA Regulatory Convergence Assessment
A confidential assessment mapping your India banking operations against DPDPA, RBI, SEBI, and IRDAI data governance requirements — with a unified compliance roadmap.
Request a Confidential Briefing
Our data privacy counsel will reach out within one working day.
Frequently Asked Questions
Does DPDPA apply to an international bank's India branch?
Yes. An India branch of an international bank processes personal data within the territory of India under Section 3(a). The branch is a Data Fiduciary for all personal data it processes in India, regardless of the parent bank's jurisdiction.
Can KYC data be processed without consent under DPDPA?
KYC data processing can be grounded in Section 7(a) — legitimate use for compliance with any law. However, Section 5 notice obligations still apply. The Data Principal must be informed of the processing, even when consent is not required.
How should an international bank handle supervisory data sharing with its home regulator?
Cross-border supervisory data sharing must comply with Section 16. If the home regulator's jurisdiction is not on the restricted list, the transfer is permitted. However, the bank must map the data categories shared, document the legal basis, and ensure the transfer is limited to what is required under the supervisory arrangement.