In discussing DPDPA today, we can recall certain aspects of Information Technology Act 2000 which are relevant.
The Information Technology Act 2000 (ITA 2000) was designed as a law for electronic documents, not for computers. It defined what an electronic record is, and it treated the devices that create and use such records as “computer” devices. This approach let the law keep pace as computers took new forms such as mobiles, kiosks and embedded systems.
The same design explains why Section 11 of ITA 2000 remains relevant today. It attributes an electronic record to its originator, including a record generated by an information system programmed to operate automatically on the originator’s behalf. By extension, Section 11 attributes the outputs of an automated system, including an AI, to the person who deployed it.
The DPDPA has a similar resilience when we read it as a law of personal data. Those who handle personal data in a particular way are defined as Data Fiduciaries, and obligations are cast on them. But it is clearer to see the Act as a law of digital personal data than as a law regulating Data Fiduciaries. Just as the Information Technology Act was a law for information, the DPDPA is the law for digital personal data.
Following the data in a bank
If the law follows the data, governance must follow the data too. A bank has numerous end points where personal data is collected, processed, disclosed and disposed of. The most visible of these are its branches.
Accountability stays with the Bank.
Currently, we consider that the Data Fiduciary is the Bank as a single legal entity, answerable through its Board. Branches are not separate fiduciaries. What is distributed across the organisation is implementation and evidence of compliance, not accountability. Given their scale and the sensitivity of the data they hold, banks can also be expected to be notified as Significant Data Fiduciaries. That brings in the obligations of a Data Protection Officer, independent data audit under Section 10, and periodic Data Protection Impact Assessments.
Whether this interpretation has to stay as it is or modified to consider each branch unit as a “Micro Data Fiduciary Element” and the Bank as an “Aggregation of such Units” is the jurisprudential thought that needs consideration.
Personal data enters through two kinds of channels:
- Physical entry points. Branches collect data from customers and from many non-customers. These include guarantors, nominees, joint holders, payees and beneficiaries, walk-in enquirers, visitors captured on CCTV and in visitor registers, and job applicants.
- Digital entry points. A growing share of data reaches the Bank without passing through a branch:
- mobile and internet banking
- Video-KYC onboarding
- Account Aggregator and API flows
- call centres
- Central Processing Centres
Intermediaries add a further layer. Business Correspondents, Direct Selling Agents and collection agents also collect personal data on the Bank’s behalf. They may be Data Processors or Joint Data Fiduciaries (Those who determine the means of processing in conjunction with the Bank) and must be governed through contracts and oversight.
Branches also hold data in paper form, such as application forms, registers and documents awaiting scanning. The DPDPA applies to such data once it is digitised, so branch-level governance must clearly define how and when paper records enter the digital regime.
Who needs identified data?
The Head Office maintains the IT architecture, including the Core Banking System, and is guided by the RBI as the sectoral regulator. The CBS holds data originally collected by branches and other channels. Not every function at the HO, however, needs that data in identified form.
Some functions have a specific legal or security purpose for identifiable data:
- fraud management
- KYC/AML compliance and suspicious transaction reporting to FIU-IND
- CKYC uploads
- credit bureau and regulatory reporting
- grievance redressal
- recovery and legal
Other functions, such as marketing analytics, MIS and policy planning, can work on pseudonymised or anonymised data.
Pseudonymised is not anonymised.
Pseudonymised data remains personal data under the DPDPA; only properly anonymised data may fall outside it. So marketing may analyse pseudonymised data, but re-identifying a customer for outreach needs its own lawful basis, ordinarily consent.
If prospective marketing candidates are first identified on the basis of processing of pseudonymised data, the monetization of these contacts (eg:HNW prospects) can be for a far lesser number of customers and obtaining consents could be easier.
The Data Minimisation principle is therefore best implemented through purpose-based access. Identifiable data is made available only to functions that need it for a defined purpose, and in pseudonymised or anonymised form to everyone else.
The three-tier structure
DPDPA governance in a bank should therefore be designed differently for the Head Office, the Regional Office and the Branches. Employee data, handled across all tiers, is best treated as HR information under DGPSI-HR.
| Tier | Role | Framework | Key responsibilities |
|---|---|---|---|
| Head Office | Accountable Data Fiduciary (likely SDF) | DGPSI-Full | Policies, CBS and IT architecture, digital channels, DPO, data audit, DPIA, purpose-based access control, processor contracts |
| Regional Office | Supervisory and assurance layer | DGPSI-Full (monitoring modules) | Oversight of branch compliance, consolidation of incident and grievance reports, internal audit of branches, escalation to HO |
| Branch | Physical point of collection, disclosure and disposal | DGPSI-Lite | Notice and consent at the counter, local records, CCTV and visitor data, paper-to-digital handling, retention and disposal |
| All tiers | Employer | DGPSI-HR | Employee personal data |
The HO follows the full DGPSI framework, with suitable accommodation for delegated implementation of its policies at the branches. The RO assures that this delegation actually works. The branches apply DGPSI-Lite to the customer and non-customer data that passes through their counters.
Aligning with the sectoral regulator
This structure is meant to complement the RBI’s regulatory framework, including its emerging guidance on data governance, not to run parallel to it. DGPSI-Bank maps the DPDPA’s obligations onto a bank’s existing hierarchy of HO, RO and branches. In this way, compliance follows the data along the same lines through which the bank already governs its business.
This is a basic structure that may be considered for implementing the DGPSI-Bank framework, and it can be refined further as RBI’s guidance is finalised.
Naavi
(This discussion continues and will be part of the DGPSI-Compliance Branch Manual being prepared by Naavi. Comments are welcome)
Audio Review:
