Indian Banks Not Collecting DPDP Compliant Consent Data: Report

Indian Banks Found to Lack Compliance with Digital Personal Data Protection Act, 2023

A recent report by IDfy, an integrated identity verification and digital onboarding platform, has revealed that several Indian banks are not collecting Digital Personal Data Protection Act, 2023 (DPDP) compliant consent data from customers. The report found that eight out of 10 banks do not mention the personally identifiable information (PII) data collected in their privacy policy.

PII data includes sensitive information such as account numbers, permanent account numbers (PAN), and Aadhaar numbers. The report highlighted that education loans are a vulnerable avenue for PII data, with 75 percent of the data collected during the educational loan process being sensitive.

Furthermore, the report indicated that 9 out of 10 banks did not have a cookie consent banner, and only 7 percent of the cookies found were deemed necessary. Additionally, none of the banks collected parental consent when processing a minor’s data.

The lack of compliance with the DPDP Act is concerning, especially as the Reserve Bank of India (RBI) has emphasized the importance of adherence to the Act. The RBI stated that all banks under the regulatory sandbox framework must ensure compliance with the DPDP Act provisions.

Despite the notification of the DPDP Act in 2023, it has not been enacted yet. Prime Minister Narendra Modi has expressed the significance of the Act in safeguarding future generations and providing them with tools for their futures. Union Minister Rajeev Chandrasekhar has also mentioned that the accompanying rules of the DPDP Act are ready and will be notified soon.

The findings of the report raise important questions about data protection and privacy practices in Indian banks. It is crucial for banks to prioritize compliance with the DPDP Act to ensure the security and confidentiality of customer data.