According to a senior official, “We have time till May 2027 to be compliant and we will be ready before that. SBI has procured software and hardware required to comply with the provisions of DPDP, we will deploy them and will be compliant with regulations much earlier, by the end of December.”
The Digital Personal Data Protection (DPDP) Act, 2023, is India’s principal law governing the collection, processing and protection of digital personal data. It gives individuals (Data Principals) control over their personal information and holds businesses — especially financial institutions — strictly accountable for how that data is handled.
The DPDP Act is being implemented in phases rather than coming into effect in its entirety on a single date. The government notified the Digital Personal Data Protection Rules, 2025, on November 14, 2025, setting out the framework for operationalising the law. While certain provisions took effect immediately, the government has provided an 18-month transition period for the core obligations under the Act and the Rules. These provisions are therefore expected to become applicable from May 2027.
The transition period was significant for lenders as they needed time to make changes to their technology infrastructure, data-governance processes and customer-facing systems to meet the requirements. Banks are also required to align their data-processing practices with the new framework while continuing to comply with existing regulations on customer data, cybersecurity and confidentiality.
