Skip to content

DPDP Rules: substantive obligations take effect 13 May 2027 (computed).

DPDPNiti
All solutions

Solutions

Banking, lending & payments

Work through the overlap between RBI mandates and the DPDP Act from one control plane: purposes, systems and vendors registered, and every control owned and evidenced.

The Act is written for anyone who processes digital personal data. Whether and how it applies to you is what our questionnaire answers.

Sectors on this page

  • Banking
  • NBFC & Lending
  • FinTech & Payments
  • Credit Bureaus & Financial Data
  • Wealth, AMC & Investment
  • Capital Markets & Market Infrastructure

A few of the questions the readiness assessment asks

  1. Does any processing rely on the Data Principal's consent rather than only on a legitimate use?
  2. Is every vendor that processes personal data on your behalf covered by a current written contract?
  3. Do encryption, access control, logging and backups cover every system holding personal data, including your vendors'?
  4. Do you record the moment you become aware of a breach, and can you file the detailed Data Protection Board report within 72 hours of it?
  5. Has the Central Government notified you, or a class you belong to, as a Significant Data Fiduciary?
  6. If you were notified as a Significant Data Fiduciary, is there an India-based DPO reporting to the board?

From obligation to audit record

  1. Statutory obligations become controls with owners, evidence with reviewers, and a record you can put in front of an auditor.
  2. The place the compliance work actually happens: a control per obligation, an owner per control, evidence per requirement, and a queue where somebody reviews it.
  3. An append-only audit record behind every decision and every piece of evidence

What you record in DPDPNiti

  • Purposes and systems registered for lending, KYC and collections
  • The data stores each system holds, recorded against the system
  • Where an RBI record-keeping duty meets a DPDP erasure duty, your reasoning is recorded on the control that answers both
  • Vendors and sub-processors registered with the contract that governs them

Frameworks carried beside the Act

  • CERT-In Directions on cyber incident reporting: carried for every organisation

On the roadmap

  • Regulator crosswalkComing
  • Breach deadline clocksComing
  • DPIA workflowComing

See it yourself

Open the live demo yourself: a few questions, and you are inside a working synthetic organisation.

Open the live demoPricing

See it against your own obligations

A walkthrough of the real product — the assessment, the controls, the evidence and the audit trail — with the roadmap shown as the roadmap.

Book a tailored demoEmail us instead

Scheduling opens Calendly, a third party who will see what you enter there. Email reaches us directly and this site records nothing either way.