The essence of the DPDPA is that no personal data coming under the Act may be processed except under a valid legal basis. The law is due for full implementation on 13th May 2027.
There was an announcement that the Cabinet Committee approved a divestment proposal whereby the Government of India and LIC will sell shares of IDBI Bank Ltd. to Fairfax Financial Holdings, for a total value of Rs 52,878 crores.
Canadian billionaire Prem Watsa-led Fairfax will pay Rs 81 per share, higher than the benchmark fair value of Rs 75.99 determined by two independent valuation agencies, as per an official statement.
The transaction needs approval from the Reserve Bank of India (RBI), which will conduct a “fit and proper” assessment, as well as the Competition Commission of India (CCI) and other statutory authorities. This is considered the largest financial sector FDI.(Details here)..
This is a partial divestment. The Government and LIC will continue to hold residual stakes of 15% and 19%, respectively. Fairfax already owns a stake of up to 40% in Catholic Syrian Bank. As per RBI regulations, it may be necessary for Fairfax to give up its Catholic Syrian Bank holding within two years or for the two banks to merge. This aspect requires verification against the applicable RBI requirements.
IDBI Bank had 2,174 branches, 69 Business Correspondent outlets and 3,011 ATMs as of a recent date. The total deposits were around Rs 3,47,163 crores and net advances were Rs 2,53,626 crores. Around 70% of the loan portfolio is said to be retail. The total estimated customer base could be around 2.5 crores, although this figure needs verification as a current count of unique customers.
There has been a discussion in DPDPA professional circles about the impact of DPDPA on this deal.
This deal is a share acquisition and is perhaps unlike the deal of Axis Bank a few years back, when it took over the retail business of Citi Bank in India.
From a DPDPA perspective, the Citi–Axis Bank deal involved the transfer of a retail banking business and its associated customer relationships, while the Fairfax deal is more a transfer of an equity stake. This deal is, however, similar in one respect to TransUnion’s acquisition of CIBIL shares, when the stakes of multiple banks were acquired by TransUnion to raise its holding to around 90%. CIBIL was not a listed company, while IDBI Bank is.
Whether a change of control of an organisation is also a change of control over the underlying personal data, and whether it can be considered a transfer of personal data, is a debatable point.
To the extent that a foreign investor may control an organisation but may not have direct access to its personal data, the IDBI Bank deal, and perhaps the TransUnion deal as well, may be viewed as a transfer of equity stake rather than a transfer of personal data. However, the fact that Fairfax’s principal is a person of Indian origin, unlike the foreign ownership structure in the TransUnion example, does not by itself determine the DPDPA implications.
The important distinction is between ownership of shares, control over the purposes and means of processing personal data, and actual access to or disclosure of that data. A change in shareholding does not automatically transfer personal data to the shareholder. However, it may influence how the organisation governs, accesses or uses that data. Any resulting change in processing or disclosure must be examined separately.
In the DPDPA, Section 17(1)(e) provides an exemption from the provisions of Chapter II, except sub-sections (1) and (5) of Section 8, and those of Chapter III and Section 16, where processing is necessary for a scheme of compromise or arrangement, merger or amalgamation of two or more companies, reconstruction by way of demerger or otherwise, transfer of an undertaking, or division of one or more companies, approved by a court, tribunal or other authority competent to do so under any law for the time being in force.
This exemption may not apply to the present transaction merely because shares are being transferred. On the facts presently disclosed, the transaction appears to involve a transfer of shares rather than a transfer of IDBI Bank’s undertaking or its customer database to another entity. The applicability of Section 17(1)(e) would require examination of the actual transaction structure and the processing undertaken in connection with it.
The current deal will therefore not automatically change IDBI Bank’s existing DPDPA obligations. Its status as a Significant Data Fiduciary, however, should be verified against the formal designation under the Act. If Fairfax tries to use customer data for its other businesses, Fairfax may become a Data Fiduciary in respect of that processing, depending on whether it determines the purpose and means of such processing.
It is stated that Fairfax has other business interests in insurance. If Fairfax tries to use bank customers’ data for insurance marketing, it could become a Data Fiduciary in respect of that activity. If, however, an Indian subsidiary of IDBI Bank takes over the insurance business, the processing would still need to be examined for a valid legal basis, including whether consent is required for the additional purpose. The common ownership of the businesses would not, by itself, authorise unrestricted sharing of customer data.
By 13th May 2027, IDBI Bank should review the legal basis for its existing processing and ensure that its consent-based processing and notices comply with the applicable DPDPA requirements. Fresh consent is not automatically required from every existing customer merely because ownership changes. It is, however, debatable whether the change of ownership of an organisation through this sort of share transaction should be treated as information that must be provided to all Data Principals, if the DPDPA had been in effect. The answer may depend on whether the transaction results in a material change in processing purposes, data access or disclosures.
It is a good time to set out the compliance requirements for this sort of deal, using this example.
One area for discussion is the DPDPA Rule regarding Consent Managers, which states:
“The control of the company registered as the Consent Manager shall not be transferred by way of sale, merger or otherwise, except with the previous approval of the Board and subject to fulfilment of such conditions as the Board may specify in this behalf.”
If the transfer of controlling interest in a Consent Manager is specifically regulated, the question arises whether a similar control should be considered for a Significant Data Fiduciary, such as a bank. The Consent Manager operates under a distinct regulatory regime, so the same requirement cannot automatically be extended to banks. Nevertheless, the provision raises an important policy question about changes in control of organisations that process large volumes of personal data.
While this discussion may be deferred for the time being, FDPPI takes note of the issue and would like to add a clause in the DGPSI Model Implementation Specifications stating that data security should include an appropriate control preventing the personal data of an organisation from being made available to holding companies or investors without a documented lawful basis, appropriate authorisation and necessary safeguards, except where such access is otherwise permitted under applicable law.
The control should require the organisation to assess any change in shareholding or management control for its implications on personal data access, processing purposes, disclosures and group-company arrangements. Any additional regulatory approval or permission required by applicable law should be obtained.
This would ensure that a change in ownership does not become an indirect route for unrestricted access to personal data by investors or related entities.
Naavi
