Large BFSI Institution: DPDP Readiness: Consent Lifecycle, Data Inventory, and DSR Workflows Before Enforcement
For BFSI institutions, the DPDP Act lands on top of existing RBI obligations and decades of accumulated customer data. This engagement shows how a large BFSI institution moved from legal analysis to operating reality — a working consent lifecycle, an enterprise personal-data inventory, and data principal request workflows tested end-to-end before the DPDP Rules enforcement dates.
Client Overview
The client is a large BFSI institution serving retail and corporate customers across India through branches, digital channels, and partner ecosystems. The regulatory driver was the DPDP Act and its Rules’ phased enforcement timeline, layered onto existing RBI outsourcing and data governance obligations. Scope covered customer onboarding and servicing journeys, core banking-adjacent systems, marketing platforms, and the processor ecosystem.
- Industry: BFSI (large institution)
- Region: India (pan-India, all channels)
- Regulatory driver: DPDP Act + Rules enforcement timeline; existing RBI data obligations
- Timeline: Three phases across ~9 months, completed ahead of enforcement dates
- CyberSigma team: Privacy lead, two data governance consultants, process/workflow consultant, legal liaison
Challenge
Personal data sat in dozens of systems accumulated over years, consent had historically meant a signature at onboarding, and no mechanism existed to receive — let alone fulfil within timelines — a data principal’s access, correction, or erasure request.
- No enterprise inventory of where personal data lived across systems and processors
- Consent captured once at onboarding with no lifecycle: no granularity, renewal, or withdrawal path
- No intake channel or fulfilment workflow for data principal requests
- Legacy retention: customer data held indefinitely across systems
- Large processor ecosystem with contracts predating DPDP obligations
Objectives
- Build and maintain an enterprise personal-data inventory with system and processor mapping
- Implement a full consent lifecycle: notice, capture, granularity, withdrawal, and audit trail
- Stand up DSR intake and fulfilment workflows meeting statutory timelines
- Define retention schedules reconciling DPDP with RBI record-keeping requirements
- Uplift processor contracts and oversight for DPDP obligations
Our Approach
1. Data Discovery & Inventory
Personal data was discovered and catalogued across customer-facing and back-office systems, producing an enterprise inventory recording data categories, purposes, systems, processors, and cross-border flows — the backbone for every later workstream.
2. Consent Lifecycle Design
Notices and consent capture were redesigned across onboarding and digital journeys with purpose-level granularity, and a consent register was implemented recording capture, changes, and withdrawals with full audit trail.
3. DSR Workflow Implementation
Intake channels, identity verification, fulfilment runbooks per request type, and timeline tracking were built and wired into the systems named in the inventory, with escalation paths for complex requests.
4. Retention & Processor Uplift
Retention schedules were defined per data category reconciling DPDP minimisation with RBI record-keeping mandates, and processor contracts were amended with DPDP clauses and an oversight cadence.
5. Rehearsal & Handover
End-to-end drills ran synthetic access, correction, and erasure requests through the live workflows; results were fed back into runbooks and the programme handed to a named internal privacy office.
Solution
- Enterprise personal-data inventory spanning systems, processors, and cross-border flows
- Purpose-granular consent lifecycle with a fully auditable consent register
- DSR intake, verification, and fulfilment workflows with timeline tracking
- Retention schedules reconciling DPDP minimisation with RBI record-keeping
- DPDP-uplifted processor contracts with a standing oversight cadence
Results
- Consent lifecycle, data inventory, and DSR workflows operational ahead of DPDP Rules enforcement dates
- Enterprise data inventory covering all customer-facing and supporting systems, with named owners
- Synthetic access, correction, and erasure requests fulfilled within statutory timelines in end-to-end drills
- Retention schedules active, ending indefinite default holding of customer data
- Standing privacy office operating the programme with defined governance
Liked the case study? Share on:
