{"id":20613,"date":"2026-07-07T12:58:45","date_gmt":"2026-07-07T07:28:45","guid":{"rendered":"https:\/\/www.naavi.org\/wp\/?p=20613"},"modified":"2026-07-07T12:58:45","modified_gmt":"2026-07-07T07:28:45","slug":"aggregated-data-fiduciaries-a-new-governance-model-for-dpdpa-compliance-in-the-banking-sector","status":"publish","type":"post","link":"https:\/\/www.naavi.org\/wp\/aggregated-data-fiduciaries-a-new-governance-model-for-dpdpa-compliance-in-the-banking-sector\/","title":{"rendered":"Aggregated Data Fiduciaries: A New Governance Model for DPDPA Compliance in the Banking Sector"},"content":{"rendered":"

\"\"<\/a><\/p>\n

One of the distinguishing features of the Digital Personal Data Protection Act, 2023 (DPDPA)<\/strong> is that it places accountability<\/strong> at the centre of personal data governance. The law identifies the Data Fiduciary<\/strong> as the entity that determines the purpose and means of processing personal data and makes that entity responsible for complying with the obligations prescribed under the Act.<\/p>\n

In legal terms, the position appears straightforward. A bank is a corporate entity and therefore the Bank is the Data Fiduciary. Its branches are merely operational units and not separate legal persons. Consequently, the branches are not independently recognized as Data Fiduciaries under DPDPA.<\/p>\n

However, legal definitions do not always reflect operational realities.<\/p>\n

The Reality of Banking Operations<\/span><\/strong><\/h2>\n

Modern banks operate on sophisticated Core Banking Systems (CBS), giving the impression that all customer information is centrally managed. While this is technologically true, it does not mean that personal data is processed only at the Head Office.<\/p>\n

In the Banking practice before the advent of “Anywhere Banking”, a Customer was a customer of a Branch. This concept has now undergone a change and Banks recognize that a Customer is a Customer of the Bank with a “Parent Branch” being recognized for the purpose of documentation.<\/p>\n

This change brought by the Digital Banking system is not however ideal for the compliance of DPDPA since the collection of personal data often originates at the branch level and then gets onboarded on to the enterprise servers. Consent Management therefore happens at the Branch level. However the KYC may be managed by an organization which has a contract signed at the HO level and not at the branch level.<\/p>\n

In cases where Branches use the services of centrally appointed service providers for KYC etc, the status of the Head office and its vendor needs to be defined along with that of the branch as either Data Fiduciary, Joint Data Fiduciary or Data Processor.<\/p>\n

Customer grievances are handled at branches as well as through the website.<\/p>\n

Loans are processed through branch-level officers and by the models governed by the Central office while loan assets are often managed physically at the Branch level.\u00a0Documents are collected, verified, digitized and stored through branch operations.<\/p>\n

Hence, even where centralized databases exist, the operational handling of personal data remains highly decentralized.<\/p>\n

For a customer, the Branch Manager is the face of the Bank. It is the branch that decides how the customer is onboarded, how documentation is verified, how service requests are processed and, in many cases, how customer data is shared with third parties for legitimate banking operations.<\/p>\n

The Branch, therefore, exercises significant operational control over personal data.<\/p>\n

Centralized Systems, Decentralized Processing<\/span><\/strong><\/h2>\n

This distinction between centralized storage and decentralized processing is becoming even more complicated because many branches independently use:<\/p>\n