DPDP Act and Payment Data: What Merchants and Fintechs Must Do Before May 2027

India’s Digital Personal Data Protection Act, 2023 is now in its transition period. The government notified the DPDP Rules on 13 November 2025 and gave businesses 18 months to comply with most obligations, which means the security, breach reporting and retention rules take effect in mid-May 2027.

For payment businesses, the DPDP Act adds a general privacy law on top of rules that already exist: RBI’s data localisation and card tokenisation directions, CERT-In’s incident reporting rules and PCI DSS. This guide explains how the DPDP Act applies to payment data, where it overlaps with those rules, and what merchants, payment aggregators and fintechs should do before the deadline.

Quick answer: The DPDP Act covers all digital personal data, including customer names, phone numbers, UPI IDs, masked card details and transaction histories. Most of its obligations apply from about 13 May 2027. Payment businesses will need a valid basis for processing (consent or a listed legitimate use), reasonable security safeguards such as encryption, access control and one year of logs, breach notices to affected customers and the Data Protection Board with a detailed report within 72 hours, and erasure once data is no longer needed unless another law requires it to be kept. Penalties reach Rs 250 crore for failing to protect data. Existing RBI, CERT-In and PCI DSS rules continue to apply alongside it.

When do the DPDP Act’s obligations apply?

The Act was passed in August 2023. The Rules were notified on 13 November 2025 (G.S.R. 846(E)) and commence in three phases:

In January 2026, reports said the government was considering shortening the 18-month period to 12 months for some provisions. As of October 2026 no amendment had been notified. A Removal of Difficulties Order in October 2026 made drafting corrections to the Act but did not change the commencement dates.

The Board was established in law in November 2025, but its chairperson and members had not been appointed as of October 2026. MeitY invited applications in May 2026.

Does the DPDP Act apply to payment data?

Yes. The Act covers personal data in digital form, and almost everything in a payment flow identifies an individual: names, phone numbers, email addresses, UPI IDs, masked card numbers, device identifiers, addresses and purchase histories. It applies to individual customers, not to business entities, though data about a business’s employees or a sole proprietor is personal data.

The Act assigns roles based on who decides why and how data is processed.

A payment aggregator can be in more than one role. It decides how to use the data it collects for merchant KYC, fraud screening and regulatory reporting, so it is likely a fiduciary for that data. Where it processes data strictly on a merchant’s instructions, it may act as a processor. Contracts should state which role applies to which data. The fiduciary stays responsible for anything its processors do.

What legal basis can payment businesses rely on?

The DPDP Act allows processing on two grounds: consent, or one of the “certain legitimate uses” listed in section 7.

• Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, and limited to what is necessary for the stated purpose. It can be withdrawn as easily as it was given.
• Section 7(a) covers data a person provides voluntarily for a specified purpose, such as entering an address and phone number to complete a purchase, as long as they have not objected.
• Other legitimate uses include complying with a legal obligation to disclose information to the State and complying with court orders.

There is no general “legitimate interest” ground like the one in the GDPR. Marketing, profiling for cross-selling and sharing data with partners will usually need consent. Our comparison of GDPR, payment data and PCI DSS covers how the European approach differs.

What security safeguards does Rule 6 require?

Section 8(5) requires every fiduciary to take reasonable security safeguards to prevent a breach. Rule 6 sets the minimum:

• Encryption, obfuscation, masking or virtual tokens.
• Access control over the computer resources of the fiduciary and its processors.
• Logs, monitoring and review to detect, investigate and fix unauthorised access.
• Measures to keep processing going if data is lost or compromised, such as backups.
• Retention of logs and personal data for one year, unless another law requires otherwise.
• Security clauses in contracts with processors.
• Technical and organisational measures to make sure the safeguards are followed.

A business that already meets PCI DSS will have many of these controls in place, but only for cardholder data. The DPDP Act applies them to all personal data, including data PCI DSS never touched, such as CRM records, support tickets and marketing lists.

Our guide to encryption, tokenisation and hashing explains which method suits which data.

How does DPDP breach notification work alongside CERT-In and RBI?

Rule 7 applies to any personal data breach, with no threshold for size or harm. A fiduciary must:

• Notify each affected individual without delay, in plain language, through their account or registered contact. The notice must describe what happened, the likely consequences, what the business is doing, what the individual can do to protect themselves, and who to contact.
• Notify the Board without delay with the nature, extent, timing, location and likely impact of the breach.
• Within 72 hours of becoming aware, or longer if the Board allows in writing, send a detailed report covering the facts, the cause, mitigation, findings on who caused it, steps to prevent a repeat, and the notices sent to individuals.

A single payment data incident can now trigger several reports with different clocks:

Build one incident runbook that triggers all of them. Our guides to breach notification deadlines and the first 24 hours of a payment data breach cover the practical steps.

How long can you keep payment and KYC data?

Section 8(7) requires a fiduciary to erase personal data once consent is withdrawn or the purpose is served, unless keeping it is necessary to comply with a law. For payment businesses, several laws require retention:

• The Prevention of Money Laundering Act requires reporting entities to keep transaction records for five years, and identity records for five years after the relationship ends.
• RBI’s cyber resilience direction requires non-bank payment operators to keep logs for five years.
• CERT-In requires ICT logs to be kept for 180 days in India.
• DPDP Rule 8(3) requires personal data, related traffic data and processing logs to be kept for at least one year from processing.

Large e-commerce platforms face an extra rule. Under the Third Schedule, e-commerce entities with at least two crore registered users in India must erase a user’s data after three years of inactivity, with at least 48 hours’ notice before erasure. Data needed for other legal obligations can still be kept.

The practical approach is a retention schedule that lists each data category, the law or purpose that justifies keeping it, and the date it must be deleted.

How does the DPDP Act interact with RBI’s rules?

Section 16(2) says any other law that gives a higher degree of protection or restricts cross-border transfers more tightly continues to apply. RBI’s April 2018 circular, which requires all payment system data to be stored only in India, therefore stays in force even though the DPDP Act allows most transfers abroad.

RBI’s card-on-file rules also continue. Since October 2022, only card issuers and networks may store card-on-file data, and merchants keep at most the last four digits and the issuer name. Under the DPDP Act, tokenised card data is still personal data, but storing less of it reduces the impact of a breach.

Section 38 says the DPDP Act applies in addition to other laws, and prevails only where there is a direct conflict. In most areas, payment businesses will be complying with both.

What are the penalties under the DPDP Act?

The Board sets the amount after an inquiry, considering the nature, gravity and duration of the breach, the type of data, whether it was repeated, any gain made or loss avoided, and the steps taken to reduce harm. Penalty powers start in the May 2027 phase.

What should merchants and fintechs do before May 2027?

• Map personal data across payments, KYC, support, marketing and analytics, not only the card data environment. Our cardholder data discovery guide describes a method that also works for wider personal data.
• Record the legal basis for each processing purpose: consent, a section 7 legitimate use, or a legal obligation.
• Rewrite privacy notices in plain language, with a clear purpose for each data category and an easy way to withdraw consent.
• Extend encryption, masking and access controls from cardholder data to all personal data.
• Keep logs for at least one year, and longer where RBI or PMLA requires. See our guide to PCI DSS Requirement 10 for logging practice.
• Update processor contracts with security clauses, breach notice duties and deletion on termination.
• Combine CERT-In, RBI, DPDP and card network notifications into one incident runbook, with templates for customer notices.
• Build a retention schedule and automate deletion where no law requires retention.
• Publish a contact for data questions and set up a grievance process that responds within the Rules’ 90-day maximum. Complainants must use it before approaching the Board.
• Decide whether you may be notified as a Significant Data Fiduciary, and prepare for a data protection officer, independent audits and impact assessments if so.

Frequently asked questions

When does the DPDP Act come into force for businesses?

Most obligations, including security safeguards and breach reporting, apply from about 13 May 2027, 18 months after the Rules were notified on 13 November 2025.

Does the DPDP Act apply to card and UPI data?

Yes. Any data that identifies an individual, including names, phone numbers, UPI IDs, masked card numbers and transaction histories, is personal data under the Act.

What is the DPDP breach notification deadline?

Affected individuals and the Data Protection Board must be told without delay, and a detailed report must reach the Board within 72 hours of the business becoming aware of the breach.

Does PCI DSS compliance mean DPDP compliance?

No. PCI DSS covers card data only. The DPDP Act covers all personal data and adds obligations PCI DSS does not have, such as consent, individual rights, breach notices to customers and erasure.

Can we keep KYC records after a customer closes their account?

Yes, where another law requires it. PMLA requires identity records to be kept for five years after the relationship ends, and the DPDP Act allows retention needed to comply with law.

Does the DPDP Act replace RBI’s data localisation rule?

No. Section 16(2) keeps stricter sectoral rules in force, so payment system data must still be stored only in India.

What is a consent manager?

A consent manager is a registered Indian company that lets individuals give, manage and withdraw consent across businesses through one platform. Their registration rules apply from about November 2026.

What is the maximum DPDP penalty for a data breach?

Up to Rs 250 crore for failing to take reasonable security safeguards, and up to Rs 200 crore for failing to notify a breach.