Executive Summary
For BFSI institutions, the DPDP Act lands on top of existing RBI obligations and decades of accumulated customer data. This engagement shows how a large BFSI institution moved from legal analysis to operating reality — a working consent lifecycle, an enterprise personal-data inventory, and data principal request workflows tested end-to-end before the DPDP Rules enforcement dates.
Client Overview
The client is a large BFSI institution serving retail and corporate customers across India through branches, digital channels, and partner ecosystems. The regulatory driver was the DPDP Act and its Rules’ phased enforcement timeline, layered onto existing RBI outsourcing and data governance obligations. Scope covered customer onboarding and servicing journeys, core banking-adjacent systems, marketing platforms, and the processor ecosystem.
- Industry: BFSI (large institution)
- Region: India (pan-India, all channels)
- Regulatory driver: DPDP Act + Rules enforcement timeline; existing RBI data obligations
- Timeline: Three phases across ~9 months, completed ahead of enforcement dates
- CyberSigma team: Privacy lead, two data governance consultants, process/workflow consultant, legal liaison
Challenge
Personal data sat in dozens of systems accumulated over years, consent had historically meant a signature at onboarding, and no mechanism existed to receive — let alone fulfil within timelines — a data principal’s access, correction, or erasure request.
- No enterprise inventory of where personal data lived across systems and processors
- Consent captured once at onboarding with no lifecycle: no granularity, renewal, or withdrawal path
- No intake channel or fulfilment workflow for data principal requests
- Legacy retention: customer data held indefinitely across systems
- Large processor ecosystem with contracts predating DPDP obligations
Objectives
- Build and maintain an enterprise personal-data inventory with system and processor mapping
- Implement a full consent lifecycle: notice, capture, granularity, withdrawal, and audit trail
- Stand up DSR intake and fulfilment workflows meeting statutory timelines
- Define retention schedules reconciling DPDP with RBI record-keeping requirements
- Uplift processor contracts and oversight for DPDP obligations
Our Approach
1. Data Discovery & Inventory
Personal data was discovered and catalogued across customer-facing and back-office systems, producing an enterprise inventory recording data categories, purposes, systems, processors, and cross-border flows — the backbone for every later workstream.
2. Consent Lifecycle Design
Notices and consent capture were redesigned across onboarding and digital journeys with purpose-level granularity, and a consent register was implemented recording capture, changes, and withdrawals with full audit trail.
3. DSR Workflow Implementation
Intake channels, identity verification, fulfilment runbooks per request type, and timeline tracking were built and wired into the systems named in the inventory, with escalation paths for complex requests.
4. Retention & Processor Uplift
Retention schedules were defined per data category reconciling DPDP minimisation with RBI record-keeping mandates, and processor contracts were amended with DPDP clauses and an oversight cadence.
5. Rehearsal & Handover
End-to-end drills ran synthetic access, correction, and erasure requests through the live workflows; results were fed back into runbooks and the programme handed to a named internal privacy office.
Solution
- Enterprise personal-data inventory spanning systems, processors, and cross-border flows
- Purpose-granular consent lifecycle with a fully auditable consent register
- DSR intake, verification, and fulfilment workflows with timeline tracking
- Retention schedules reconciling DPDP minimisation with RBI record-keeping
- DPDP-uplifted processor contracts with a standing oversight cadence
Results
- Consent lifecycle, data inventory, and DSR workflows operational ahead of DPDP Rules enforcement dates
- Enterprise data inventory covering all customer-facing and supporting systems, with named owners
- Synthetic access, correction, and erasure requests fulfilled within statutory timelines in end-to-end drills
- Retention schedules active, ending indefinite default holding of customer data
- Standing privacy office operating the programme with defined governance
Timelines and outcomes reflect the documented engagement record for this client; results vary with scope and readiness.
What We Delivered
- Personal-data inventory and processing map (RoPA-style)
- Consent capture and withdrawal workflows aligned to s.6 and the 2025 Rules
- Privacy notices in the required plain-language form
- Data-principal rights machinery — access, correction, erasure workflows with records
- Retention schedule aligned to s.8(7) whichever-earlier erasure, with legal-hold register
- Breach-response procedure aligned to Rule 7 (without-delay intimation, 72-hour Board reporting)
The standard artefact set for this engagement type; per-client environment and architecture details are shared under NDA during procurement, not published.
Lessons Learned
- The data map was the critical path: every downstream artefact — notices, consent, retention — inherited its quality from how honestly the inventory was built.
- Deletion promised in policy but unexecutable in systems is the gap regulators will test; erasure had to be engineered end-to-end including processors, not written into a PDF.
- Building the DPDP machinery once and mapping it to SOC 2 privacy/confidentiality criteria avoided running two parallel privacy programmes.
Talk to the team that ran this engagement
This was a real DPDP Act Implementation (Consent, Inventory, DSR) engagement. If you are preparing for the same, speak to a specialist who has delivered it — not a sales rep. We will give you a clear read on your scope, gaps and the fastest path, and reply within four business hours.
Explore DPDP implementation · more case studies
Liked the case study? Share on: