DRISHTI™
Five Regulators. One Act.
Zero Margin for Error.
BFSI entities in India operate under a five regulator architecture: RBI, SEBI, IRDAI, PFRDA, and IBBI. Each imposes its own data obligations. DPDPA 2023 now sits across all of them. The result is the most complex compliance surface in Indian industry.
31 Million Records. One Breach.
Star Health. August 2024. The largest data breach in Indian insurance history. Aadhaar numbers, PAN cards, medical records, biometric data. Leaked through Telegram chatbots. DRISHTI™ BFSI exists because that should never happen again.
6 Hours. Not 6 Days.
CERT-In mandates breach reporting within 6 hours of detection. DPDPA adds its own notification timeline. RBI requires its own reporting. Three clocks running simultaneously. One missed deadline is one enforcement action.
Cross Sell Is the Kill Zone
When a bank shares customer data with its subsidiary insurance company for cross selling without granular consent, that is a DPDPA violation hiding in plain sight. The DSA, the agent, the TPA, the account aggregator. Every node is a leak point.
AI Without Governance Is Liability
Credit scoring algorithms, fraud detection engines, underwriting models, robo advisors. Every one processes personal data. Section 10(2) demands algorithmic accountability from Significant Data Fiduciaries. Most BFSI entities have not even catalogued their AI systems.
Entry Points. Retention Nodes. Exit Pathways.
Data Collection Points
- KYC data (Aadhaar, PAN, CKYC, Video KYC, e KYC)
- Core banking customer master and account master
- Transaction data (UPI, NEFT, RTGS, IMPS, cheque)
- Credit bureau flows (CIBIL, Experian, Equifax, CRIF)
- Loan origination (ITR, bank statements, property docs)
- Mobile/internet banking (device fingerprint, IP, location, biometrics)
- ATM data (card, PIN logs, CCTV footage)
- SWIFT cross border remittance data
- Recovery/NPA data (SARFAESI, DRT, IBC, ARC)
- Account Aggregator consent flows
Data Collection Points
- Proposal form (personal, medical history, family history)
- Underwriting (medical exams, pathology, tele medical recordings)
- Claims (hospital records, FIR, surveyor reports)
- TPA data flows (Medi Assist, FHPL, Paramount)
- Reinsurance data (Munich Re, Swiss Re, GIC Re)
- Agent/broker/POSP/bancassurance data
- Telematics (vehicle GPS, OBD, driving behaviour)
- Wearable data (health trackers for premium pricing)
- Fraud investigation SIU data and surveillance
Data Collection Points
- Demat account and beneficial owner data
- Trading order logs, margin data, position data
- Mutual fund folio, SIP, transaction, nominee data
- KRA data flows (CAMS, KFintech)
- PMS and AIF investor profiling data
- UCC and dormant account data
- SCORES complaint data flows to SEBI
Data Collection Points
- Digital lending app device access (contacts, SMS, photos — now restricted by RBI)
- LSP data flows and retention
- BNPL transaction and credit data
- Microfinance group lending and field officer data
- Gold loan valuation and photo documentation
- Vehicle finance GPS tracking and repo data
- P2P lending platform lender/borrower data
- Account Aggregator consent architecture
Data Collection Points
- UPI VPA mapping, transaction, dispute data
- Prepaid wallet KYC and loading data
- Payment aggregator merchant and settlement data
- Card network data post tokenisation (Visa, MC, RuPay)
- BBPS biller and consumer data
- AEPS Aadhaar biometric at micro ATMs
Shared Ecosystem Nodes
- Cloud DR/BCP data (AWS Mumbai, Azure Pune, GCP) — cross border during failover
- SaaS CRM vendors (Salesforce, Dynamics) processing customer data
- IT outsourcing partners (TCS, Infosys, Wipro, HCL)
- DSA and agent personal device data retention
- Marketing automation platforms processing PII
- Employee HR data, POSH data, whistleblower data
Seven Dimensions — BFSI Calibration
Each dimension recalibrated for the five regulator BFSI compliance surface. BFSI specific KPIs. BFSI specific evidence artifacts. BFSI specific regulatory mapping.
BFSI KPIs
BFSI KPIs
BFSI KPIs
BFSI KPIs
BFSI KPIs
BFSI KPIs
BFSI KPIs
BFSI Privacy Governance Index — Live Measurement
21 Critical Gaps Identified. All Plugged.
A forensic audit revealed 21 structural gaps in data governance, data lineage, data provenance, statutory mapping, and operational controls. Every one is now closed.
1. Data Lineage Engine Absent
V1 mapped collection points but not the transformation chain. Where data was copied, enriched, merged, anonymised, replicated to DR. Without lineage, provenance is unprovable.
2. Data Provenance Chain Missing
Lineage tracks the journey. Provenance proves the chain of custody. Who touched data? When? What was changed? Without provenance, evidence is inadmissible.
3. 23 Orphan Data Points Unparented
CCTV footage. Call centre recordings. Visitor registers. POSH data. Whistleblower data. Board minutes. Employee biometrics. Marketing PII. Testing environment copies. None were mapped.
4. DPDP Rules 2025 Not Mapped
48 hour erasure pre notice. 90 day grievance response. 7 year Consent Manager retention. Retrospective notice. 22 language requirement. Phased compliance. Annual SDF audit.
5. Consent Manager Integration Missing
Registered intermediary with INR 2 crore net worth. Interoperable platform. No sub contracting. 7 year consent record retention. New evidence chain.
6. Children/Disability Data Unaddressed
Junior accounts. Student loans. Minor nominees. Dependent children on health insurance. Persons with disability requiring lawful guardian verification under RPWD Act.
7. Retrospective Notice Obligation Missing
Notices required for all personal data processed before the Act. Banks with 50 to 100 million records face massive operational challenge.
8. 48 Hour Erasure Pre Notice Missing
Data Fiduciary must notify Data Principal 48 hours before completing erasure. New operational process for multi system purge coordination.
9. Purpose Limitation Enforcement Absent
Data collected for lending cannot be used for insurance cross selling without fresh consent. Requires purpose tagging at data element level with drift detection.
10. Data Principal Nomination Rights Unmapped
Section 14 nomination intersects with existing bank/insurance/demat nominee frameworks. Reconciliation architecture was absent.
11. SDF Annual DPIA/Audit Not Operationalised
Rule 13 mandates annual DPIA and independent audit. Most BFSI entities will be SDFs. Annual cycle was not built into the framework.
12. Document Registry Incomplete
47 documents across 9 categories required. Policies, DPAs, SOPs, registers, governance documents, security standards, training modules, AI governance documents.
Track Every Transformation. Prove Every Pathway.
Collection Point Registry
Every data element tagged with its origin: branch form, mobile app, API, third party feed, web form, call centre, field officer, agent device, AA framework, e KYC, CKYC.
Processing Chain Log
Every transformation logged: enrichment, merger, anonymisation, pseudonymisation, aggregation, tokenisation, masking for testing environments.
Copy and Clone Register
Every copy tracked: core banking to data warehouse, production to DR, production to testing, export to regulatory reporting, backup tapes, email attachments.
External Flow Map
Every external share logged: credit bureau, insurer, TPA, reinsurer, LSP, DSA, AA, payment network, regulator, auditor, legal counsel, marketing vendor, cloud processor.
Chain of Custody Proof
Every access timestamped: who, from what system, for what purpose, what action. Tamper resistant. Retrievable within 72 hours for any data element.
Purpose Binding Engine
Every element tagged to lawful purpose at collection. Drift detection triggers alerts for access outside tagged purpose. Cross sell without fresh consent flagged in real time.
Lifecycle Termination Map
Tagged with retention trigger: purpose fulfilment, contract end, consent withdrawal, regulatory period (PMLA 5 years, security logs 1 year). 48 hour erasure pre notice automated.
Verified Erasure Proof
Erasure verification across all copies: production, backup, DR, warehouse, analytics sandbox, testing, email archives, agent devices. Erasure certificate per data class.
Where BFSI Compliance Breaks Down
Every grey area identified, risk scored, and mapped to a remediation pathway. These are the zones where DPDPA violations hide in plain sight.
Subsidiary Cross Sell Without Consent Walls
Bank shares customer data with subsidiary insurance company and AMC via common CRM. No fresh consent. No purpose isolation. No audit trail. Customer opens savings account Monday. Insurance subsidiary calls Tuesday.
DSA and Agent Device Data Retention
DSAs collect documents on personal phones and WhatsApp. KYC photos, income proofs, Aadhaar copies. When DSA relationship terminates, no deletion protocol. Data lives on personal devices indefinitely.
Legacy Data Consent Migration
Banks hold decades of customer data collected before DPDPA. Section 7(1)(b) covers “performance of contract.” But cross selling, profiling, marketing using legacy data does not qualify. Migration architecture absent in 90% of institutions.
TPA Data Retention Beyond Claim Settlement
TPAs retain policyholder health data, hospitalisation records, diagnostics long after claim settlement. No defined deletion trigger. TPA serves multiple insurers. Patient data from Insurer A accessible in systems serving Insurer B.
Account Aggregator Consent Fatigue
Consent screens are complex. Users click through. Consent window is time bound but data processed may be retained by FIU beyond window. No effective enforcement of deletion post consent expiry.
Cloud DR/BCP Cross Border Leakage
RBI mandates data localisation. But during DR failover, data replicates to overseas zones for milliseconds to hours. AWS Mumbai to Singapore. Azure Pune to Southeast Asia. RBI circular silent on transient DR replication.
AI Credit Scoring Without Explainability
200+ variables including behavioural data. No right to explanation on loan decline. Section 10(2) mandates algorithmic accountability for SDFs but implementation guidance absent.
Deceased Customer Data Limbo
DPDPA provides for nominee to exercise rights. Banks retain deceased data for PMLA (5 years post closure). Insurance retains for claim maturity. Conflict between erasure rights and statutory retention unresolved.
Indian BFSI Breaches — What DRISHTI™ Would Have Caught
| Entity | Year | Records | Root Cause | DRISHTI™ Dimension Gap |
|---|---|---|---|---|
| Star Health Insurance | 2024 | 31M | Insider access, delayed detection, Telegram chatbot data leak | PRAHARI (detection), KAVACH (access controls), PRAMAANA (evidence) |
| HDFC Life Insurance | 2024 | 16M | Unknown exfiltration, ransom demand, delayed disclosure | PRAHARI (notification), KAVACH (data loss prevention) |
| Nupay (Banking Fintech) | 2025 | Undisclosed | S3 bucket misconfiguration, third party vendor gap | KAVACH (vendor security), SATYA (third party inventory) |
| Juspay | 2021 | 100M | Card data exposure via payment processor vulnerability | KAVACH (tokenisation), PRAMAANA (audit trail) |
| SBI Server Exposure | 2019 | Millions | Unprotected server exposing customer data | SATYA (inventory), KAVACH (access controls) |
| Upstox | 2021 | 2.5M | KYC data exposed via third party breach | KAVACH (vendor DPA), SATYA (third party data mapping) |
Algorithmic Accountability for BFSI Under DPDPA Section 10
Every AI/ML system processing personal data must be inventoried, impact assessed, bias audited, and explainability mapped.
Credit Scoring Algorithms
Bureau scores, application scorecards, behavioural scorecards. 200+ variables. Bias audit required. Explainability for loan rejection. DPDPA S.10(2) applies.
Fraud Detection Engines
Real time transaction scoring. Behavioural analytics. Session anomaly detection. Continuous personal data processing. Profiling question under DPDPA.
AML Screening Engines
Name matching, transaction pattern detection, SAR generation. S.7 legitimate use. Model drift and false positive rates must be monitored.
Underwriting Risk Models
Health data, genetic predisposition, wearable data, telematics. Discrimination risk. Algorithmic impact assessment across protected categories.
Face Recognition and Liveness
Video KYC biometric data. Face matching against ID. Liveness creates biometric templates. UIDAI Aadhaar authentication restrictions.
Chatbots and Voice Assistants
NLP trained on interaction data. Call recordings for sentiment analysis. Consent for secondary use of conversation data typically absent.
Robo Advisory Systems
Automated investment advice from financial profiling. SEBI suitability requirements. DPDPA profiling consent. Algorithmic liability unresolved.
Collection Score Models
Payment prediction using transaction patterns, demographics. Priority recovery actions. Demographic bias must be audited.
DPDPA + RBI + SEBI + IRDAI — Provision by Provision
| DRISHTI™ Dimension | DPDPA Sections | RBI Directions | SEBI / IRDAI |
|---|---|---|---|
| SATYA — Inventory | S.4, S.5, S.8(7) | KYC Master Direction, Data Localisation 2018, CKYC, PMLA Rules | SEBI KRA Regulations | IRDAI Repository Guidelines |
| SAMVIDA — Consent | S.5, S.6, S.7, S.9 | Digital Lending Directions 2025, AA Framework, Customer Confidentiality | SEBI Suitability | IRDAI Web Aggregator | TRAI TCCCPR |
| NIYAMA — Governance | S.8, S.10, S.11, S.14 | IT Governance Direction 2023, Outsourcing Direction | SEBI CSCRF Governance | IRDAI Board Oversight |
| KAVACH — Safeguards | S.8(5), S.16 | DPSC Master Direction, Tokenisation, Cyber Security Framework | SEBI Cloud Framework 2023 | IRDAI Cybersecurity | PCI DSS 4.0 |
| PRAMAANA — Evidence | S.8, S.10, S.27-33 | IT Governance (audit), System Audit, Compliance Certificates | SEBI System Audit | IRDAI Inspection Framework |
| PRAHARI — Response | S.8(6), S.10(2)(b) | 6 Hour RBI Reporting, Cyber Security Framework Incident Protocols | SEBI CSCRF Incident | IRDAI Breach Notification | CERT-In 6 Hour |
| SAMSKRITI — Culture | S.8, S.10, S.15 | IT Governance (awareness), Guidelines on Information Security | SEBI CSCRF Training | IRDAI Awareness Programs |
47 Documents. 9 Categories. Zero Gaps.
Every document, contract, policy, SOP, notice, and register that DPDPA 2023, DPDP Rules 2025, and all five sectoral regulators require from a BFSI entity.
8 Documents
- Data Protection Notice (standalone, 22 languages)
- Granular Consent Form (account, loan, insurance, investment, cross sell)
- Retrospective Notice for pre DPDPA data
- Consent Withdrawal Mechanism and SOP
- 48 Hour Erasure Pre Notice Template
- Children’s Data Parental Consent Form
- Lawful Guardian Consent Form (Rule 11)
- Consent Manager Integration Agreement
9 Documents
- Enterprise Data Protection Policy
- Data Classification and Labelling Policy
- Data Retention and Erasure Policy (PMLA reconciliation)
- Cross Border Data Transfer Policy
- Employee Data Privacy Policy
- Children and Vulnerable Persons Policy
- Purpose Limitation and Minimisation Policy
- AI and Algorithmic Processing Policy
- Marketing and Profiling Consent Policy
10 Documents
- Data Processing Agreement (Master)
- Sub Processor Flow Down Agreement
- TPA Data Processing Agreement
- LSP/DSA Data Handling Agreement
- Cloud Service Provider DPA (localisation)
- IT Outsourcing DPA (RBI alignment)
- Reinsurance Data Transfer Agreement
- Account Aggregator FIU Agreement
- Marketing Vendor DPA
- Auditor Data Handling Agreement
8 Documents
- Data Subject Access Request SOP (90 day)
- Data Correction Request SOP
- Erasure SOP (48 hour pre notice, multi system purge)
- Consent Withdrawal Processing SOP
- Breach Notification SOP (6 hr + 72 hr + sectoral)
- Cross Sell Data Wall Enforcement SOP
- DSA/Agent Termination SOP
- Testing Environment Anonymisation SOP
8 Documents
- Record of Processing Activities (ROPA)
- Data Inventory and Lineage Register
- Consent Register (7 year Consent Manager retention)
- Breach Register (triple clock tracking)
- DSAR Register (90 day SLA)
- Vendor/Data Processor Register
- AI/ML Model Inventory Register
- Cross Border Transfer Log
6 Documents
- DPO Charter and Terms of Reference
- Privacy Committee Constitution and ToR
- Board Privacy Resolution Template
- Quarterly PGI Dashboard Report
- Annual DPIA Report (SDF mandatory)
- Independent Data Audit Report (SDF)
5 Documents
- Encryption Standards (rest, transit, processing)
- Access Control Matrix (role and purpose based)
- Security Log Retention Standard (1 year minimum)
- VAPT Schedule
- Incident Response Playbook
4 Documents
- Annual Privacy Training Calendar
- Role Specific Training Modules
- Phishing Simulation Programme
- Privacy Awareness Assessment
5 Documents
- AI/ML Model Risk Policy
- Algorithmic Impact Assessment Template
- Bias Audit Report Template
- Model Explainability Standard
- Synthetic Data Generation Policy
What Non Compliance Costs
Three Phases. Full Compliance by May 2027.
Five Stages — Calibrated for Financial Services
| Level | Stage | BFSI Governance Posture | Score |
|---|---|---|---|
| 1 | Ad Hoc | No formal privacy processes beyond existing RBI/SEBI compliance. Customer data scattered across core banking, CRM, agent devices. No data inventory. Consent is a checkbox buried in 40 page terms. Breach response reactive. No DPO appointed. | 0 – 20 |
| 2 | Aware | Privacy policy drafted. Partial inventory. Consent exists for digital channels but not branch operations. Third party register incomplete. CERT-In reporting untested. DSA data handling unaddressed. | 21 – 40 |
| 3 | Defined | All seven dimensions documented. Consent granular and purpose locked. Vendor DPAs cover TPAs, LSPs, cloud. Breach playbook covers triple clock. AI inventory exists. Cross sell consent walls designed. 47 document registry complete. | 41 – 60 |
| 4 | Managed | All dimensions instrumented with automated evidence. Board receives quarterly PGI. AI impact assessments complete. Multi regulator evidence assemblable in 72 hours. Tabletop exercises quarterly. Data lineage operational. Orphan data parented. | 61 – 80 |
| 5 | Optimised | Governance predictive. AI monitoring flags consent drift, leakage, vendor risk before incidents materialise. Evidence readiness continuous. Privacy is competitive differentiator. Net Privacy Dividend™ positive. | 81 – 100 |