DPDP, RBI and SEBI: Where India's Compliance Obligations Now Intersect

Regulatory compliance in India's financial and corporate sectors has stopped being a set of parallel obligations administered by separate departments. Data protection, cybersecurity, outsourcing, financial regulation, disclosure and board accountability now attach to the same operations, the same vendor contracts and the same incidents — on different timetables, to different regulators, under different materiality tests. The clearest demonstration is what happens in the first six hours after a security incident at a listed non-banking financial company. This note sets out where each framework actually stands, where they collide, and what general counsel and chief compliance officers should be doing in the period before the substantive data protection obligations commence.

1. Where the DPDP framework actually stands

Most published commentary gets this wrong, and getting it wrong in either direction is expensive. A board told that the Digital Personal Data Protection Act, 2023 already binds it will spend against the wrong deadline; a board told it can be deferred will find the preparation window shorter than the compliance date suggests. The Act was brought into force in tranches, and the position as at the date of this note is as follows.

Two consequences follow.

The obligations that matter commercially are not yet in force. Notice and consent, security safeguards, breach intimation and Data Principal rights all sit in the final tranche. An organisation that has not begun has time; one that waits for the commencement date will not have enough, because data inventory and consent architecture are multi-quarter engineering projects rather than drafting exercises. The Board itself has been established, though a Lok Sabha answer of 12 August 2026 recorded no appointments made.

Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 remain operative in the interim, being omitted only when the final tranche commences, under section 44(2) of the Digital Personal Data Protection Act, 2023. Until then the enforceable data protection exposure for a financial institution is the existing sensitive-personal-data regime, not the new one — and a programme built solely around the DPDP Act leaves that exposure unaddressed.

One live uncertainty. Press reporting in January 2026 indicated that the Ministry of Electronics and Information Technology had proposed compressing the window for Significant Data Fiduciary obligations from eighteen months to twelve. No instrument altering the commencement periods has been notified: this is a proposal, not law. Sources also differ by one day on the computed tranche dates, so the precise date should be taken from the Gazette before it enters a board paper or a compliance calendar.

2. The six-hour problem: one incident, several clocks

The integration point is not conceptual. It is operational, and it arrives at the worst possible moment. Consider a security incident at a listed NBFC that processes customer data through a lending service provider: the following obligations can attach to the same facts.

The five obligations do not have the same legal character, and the distinction governs how each is argued. The CERT-In six-hour requirement and the DPDP breach intimation are direct statutory and subordinate-legislative requirements. The RBI Master Direction and the Digital Lending Directions are regulatory directions binding on specified categories of regulated entity. Regulation 30 is a conditional obligation: it bites only once materiality is established under a policy the entity itself frames. The CSCRF sits between a direction and a standard, with obligations scaled by entity category.

Three features matter more than any individual deadline.

The fastest clock is six hours, and it is already running. The CERT-In obligation has been in force since 2022, applies to body corporates generally rather than to a regulated category, and does not wait for a materiality assessment. Non-compliance may attract punitive action under section 70B(7) of the Information Technology Act, 2000.

Materiality and reporting are decided at different speeds. Regulation 30 requires a judgment applied through a board-approved policy. Most such policies were drafted for corporate events — acquisitions, management changes, litigation — and do not address information security incidents at all, which converts a twelve-hour disclosure decision into an unassisted judgment made under pressure.

The frameworks do not cross-reference each other. No instrument tells a compliance officer that the CERT-In report, the RBI escalation, the exchange disclosure and the eventual DPDP intimation must be consistent. They must be, because they will be read together in any subsequent proceeding, and an inconsistency between them is itself a finding.

3. RBI: governance, and the limits of delegation

For banks, NBFCs, payments banks, small finance banks, credit information companies and the specified financial institutions, the RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices has applied since 1 April 2024. Regional rural banks and NBFC-core investment companies are outside its scope — an illustration of the general point that RBI directions do not apply uniformly, and that applicability must be established by entity category before any obligation is assumed.

The Direction's architecture is governance-first. It requires a board-level IT Strategy Committee of at least three directors, chaired by an independent director with IT expertise and meeting quarterly; an IT Steering Committee drawn from technology and business functions; a technically competent head of IT; and a chief information security officer who does not report to the head of IT and carries no business targets. These are structural requirements, and a board cannot satisfy them by adopting a policy. On third-party arrangements, the Direction requires vendor risk assessment addressing concentration risk, conflict of interest, single points of failure, protection of customer data, availability and supply chain risk.

The Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025 and applicable to commercial banks, co-operative banks, NBFCs and all-India financial institutions, sharpen the point. A regulated entity must have a written agreement with each lending service provider recording roles, rights and obligations, must act on contractual breach, and must monitor portfolios originated through it. Offshore processing of lending data is permitted, but the data must be brought back to India and deleted from foreign servers within twenty-four hours of processing. Digital lending apps were to be reported to the RBI's CIMS portal by 15 June 2025 with certification by the chief compliance officer or a board-designated official, and the regime for lending service providers operating across multiple lenders took effect on 1 November 2025.

The principle running through all of it is that outsourcing reallocates performance and not accountability. The contract is the instrument through which a regulated entity retains the ability to discharge its own obligations — audit rights, incident notification, processing restrictions, business continuity, exit. A vendor agreement lacking them has transferred the work and kept the risk.

4. SEBI: when a technology failure becomes a governance question

For listed entities, the material point is that Schedule III to the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 contains no paragraph expressly addressed to cyber incidents or data breaches. Disclosure therefore runs through the general materiality route: the event is assessed against the entity's own policy, framed under Regulation 30(4) and approved by its board.

That places the decision where SEBI intends it — with the board — and exposes a common gap. A materiality policy silent on information security leaves the company secretary to construct the test during the incident, and leaves the company without a documented basis for a decision not to disclose, which is the decision most likely to be examined afterwards.

The SEBI Cybersecurity and Cyber Resilience Framework of 20 August 2024 operates separately. It applies across SEBI-regulated entities, categorises them as market infrastructure institutions, qualified, mid-size, small-size or self-certification entities by thresholds set at the start of each financial year, and superseded SEBI's earlier cyber circulars. Entities previously covered by those circulars were to adopt it by 1 January 2025 and others by 1 April 2025. It requires an incident response management plan, a current cyber crisis management plan, root cause analysis and, where that is inconclusive, forensic analysis.

Technology risk has therefore become a corporate governance item — not because any regulator has said so in terms, but because the disclosure and accountability provisions were drafted widely enough to capture it.

5. What legal and compliance teams should be doing now

The period before the final DPDP tranche is the planning window — the time to do the work that cannot be done quickly later.

Establish applicability before obligation. Record, entity by entity, which RBI directions apply, which SEBI category the entity falls into, and whether it is likely to be notified a Significant Data Fiduciary. Most gaps found on inspection are not failures to comply but failures to have established what applied.

Build the data inventory. Consent architecture, purpose limitation, retention and deletion, and rights fulfilment all depend on knowing what personal data is held, where, on what basis and for how long. It is the longest-lead item in the programme and the least amenable to acceleration.

Rewrite the materiality policy. Add information security incidents expressly, with worked thresholds, and record the basis on which non-disclosure may properly be decided.

Run one incident playbook, not five. A single trigger assessment, factual record and approval chain, with parallel outputs for CERT-In, the RBI, the exchanges, the SEBI portal and in due course the Board. Test it against the six-hour clock, because that is the one that fails first.

Review third-party contracts against the regulatory allocation rather than the commercial one. A notification clause giving a vendor forty-eight hours is incompatible with a six-hour obligation.

Document the reasoning, not only the conclusion. A contemporaneous record of how a question was analysed is frequently worth more in a proceeding than the answer reached.

6. Enforcement, and why documentation decides outcomes

Exposure materialises through inspection findings, supervisory observations, show-cause notices, adjudication and appeal, and through disputes between a regulated entity and its service provider about who bore which obligation. Penalties under the Digital Personal Data Protection Act, 2023 are imposed by the Data Protection Board under provisions in the final tranche, with appeals to the Telecom Disputes Settlement and Appellate Tribunal.

What distinguishes a manageable proceeding from a difficult one is rarely the strength of the underlying compliance position. It is whether the entity can show, from records made at the time, what it knew, when it knew it, what assessment it made and who made it. That is a drafting and record-keeping question long before it is a litigation question — which is why preventive work and dispute preparedness are the same exercise viewed from opposite ends.

7. Sagar & Sagar: an integrated regulatory and disputes practice

Sagar & Sagar Law Offices has been in continuous practice in New Delhi since 2000, founded by Advocate Rajeev Sagar and Advocate Sanjeev Sagar. The firm acts for banks, financial institutions, non-banking financial companies, asset reconstruction companies, public sector undertakings, insurers and corporate clients before the Supreme Court of India, the High Courts and the principal tribunals and commissions. One of the founding partners, Sanjeev Sagar, was designated a Senior Advocate by the High Court of Delhi in November 2024.

The practice is organised around the frameworks governing India's banking system, its financial institutions and its commercial relationships, giving clients continuity of counsel across the lifecycle of a matter — from regulatory and transactional advice, through litigation and enforcement, to appellate proceedings — rather than separate advisers at each stage. For the subject of this note, the relevant capabilities sit across NBFC, FinTech and financial regulatory advisory, regulatory, competition and compliance, banking, finance and debt recovery, technology, AI, data privacy and cybersecurity, corporate and commercial work including vendor and outsourcing contracts, and litigation and arbitration where regulatory or contractual disputes follow.

The firm's approach is to build the record at the earliest stage — in documentation, in the first response to a notice, and in pleadings — on the footing that it will be tested later on appeal, in adjudication or in enforcement. Where the quality of contemporaneous records frequently determines the outcome of a proceeding, that discipline is the substance of the advice rather than a description of it.

Advocate Rajeev Sagar, the firm's Founding and Managing Partner, leads its litigation and dispute resolution practice and has directed the firm's development since 2000 across banking and financial services, insolvency, corporate-commercial and regulatory work. The principal office is in New Delhi, with a working chamber at the Delhi High Court and a further office in Mumbai, and the firm operates through advocates and associated counsel in other major Indian cities.

Document-intensive regulatory work — contract review against a revised allocation of responsibility, regulatory research, due diligence, compliance documentation and litigation support — is also handled through the firm's legal process outsourcing desk, staffed and supervised from within the practice. It is a means of performing defined work under professional supervision, not a substitute for legal judgment or for the statutory accountability that remains with the regulated entity.

Frequently asked questions

Is the DPDP Act in force in India?

▾

Partly. Sections 1(2), 2, 18–26, 35, 38–43, 44(1) and 44(3) of the Digital Personal Data Protection Act, 2023, together with Rules 1, 2 and 17–21 of the Digital Personal Data Protection Rules, 2025, commenced on 13 November 2025 under G.S.R. 843(E), and the Data Protection Board of India was established the same day. The substantive obligations — notice and consent, security safeguards, breach intimation, Data Principal rights, Significant Data Fiduciary obligations and cross-border transfer — are scheduled for the eighteen-month tranche falling in May 2027. The precise date should be confirmed against the Gazette.

What governs personal data protection in India in the meantime?

▾

Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 remain operative. Section 43A is omitted only when the final DPDP tranche commences, under section 44(2) of the Digital Personal Data Protection Act, 2023. A compliance programme addressed only to the DPDP Act leaves the currently enforceable regime unaddressed.

How quickly must a cyber incident be reported in India?

▾

The shortest applicable deadline is six hours. The CERT-In Directions No. 20(3)/2022-CERT-In of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, require specified cyber incidents to be reported within six hours of noticing them or being brought to notice of them, and require ICT logs to be maintained for a rolling period of 180 days within Indian jurisdiction. Separate obligations may arise under the applicable RBI framework, under SEBI's Cybersecurity and Cyber Resilience Framework, and under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015.

How does DPDP compliance affect NBFCs?

▾

An NBFC processing customer personal data digitally will be a Data Fiduciary once the substantive provisions commence, and will carry notice and consent obligations, a duty to implement reasonable security safeguards, breach intimation duties under Rule 7 of the Digital Personal Data Protection Rules, 2025, and obligations to give effect to Data Principal rights. Those duties sit alongside, and do not displace, the RBI framework applicable to the entity — including the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices and, for digital lending, the Reserve Bank of India (Digital Lending) Directions, 2025. Whether an NBFC is additionally notified a Significant Data Fiduciary is a matter for Central Government notification.

What are the RBI's principal compliance requirements for NBFCs in this area?

▾

For NBFCs within its scope, the RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, notified on 7 November 2023 and effective from 1 April 2024, requires a board-level IT Strategy Committee of at least three directors chaired by an independent director with IT expertise, an IT Steering Committee, a technically competent head of IT, and a chief information security officer who does not report to the head of IT. Regional rural banks and NBFC-core investment companies are outside its scope. Applicability must be established by entity category before any obligation is assumed.

How do RBI outsourcing requirements affect fintech partnerships?

▾

Outsourcing reallocates performance, not accountability: the regulated entity continues to answer for the outsourced function. The RBI Master Direction on Information Technology Governance requires vendor risk assessment addressing concentration risk, conflict of interest, single points of failure, protection of customer data, availability and supply chain risk. The contract is the mechanism through which the entity retains the ability to discharge its own obligations, principally through audit rights, incident notification on a timeline compatible with its own deadlines, processing restrictions, business continuity and exit arrangements.

What are the regulatory obligations of digital lending businesses?

▾

The Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025, apply to commercial banks, co-operative banks, NBFCs and all-India financial institutions. A regulated entity must have a written agreement with each lending service provider recording roles, rights and obligations, must act on contractual breach and must monitor portfolios originated through it. Offshore processing of lending data is permitted, but the data must be brought back to India and deleted from foreign servers within twenty-four hours of processing. Digital lending apps were to be reported to the RBI's CIMS portal by 15 June 2025, and the regime for lending service providers operating across multiple lenders took effect on 1 November 2025.

What are the key SEBI compliance requirements for listed companies on technology risk?

▾

Two frameworks operate. Under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 with Schedule III, material events must be disclosed to the stock exchanges; because Schedule III contains no paragraph expressly addressing cyber incidents, the assessment runs through the entity's materiality policy framed under Regulation 30(4). Separately, SEBI's Cybersecurity and Cyber Resilience Framework of 20 August 2024 applies across SEBI-regulated entities, categorising them by thresholds set at the start of each financial year and requiring an incident response management plan, a cyber crisis management plan and root cause analysis.

Must a listed company disclose a data breach to the stock exchanges?

▾

If the event is material. Schedule III to the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 contains no paragraph expressly addressing cyber incidents, so the assessment runs through the entity's materiality policy framed under Regulation 30(4). Where disclosure is required, the timeline is twelve hours from occurrence if the event emanates from within the entity, twenty-four hours if it does not, and thirty minutes from the close of a board meeting where it arises from a board decision. A materiality policy silent on information security leaves that judgment to be constructed during the incident.

What should a company do after a personal data breach?

▾

Treat the reporting obligations as parallel rather than sequential. The CERT-In six-hour obligation under section 70B(6) of the Information Technology Act, 2000 is already in force and does not wait for a materiality assessment. Depending on the entity, reporting to the RBI and IB-CART, disclosure to the stock exchanges under Regulation 30 of the SEBI LODR Regulations, and reporting through SEBI's incident portal may also apply. From the final DPDP tranche, Rule 7 of the Digital Personal Data Protection Rules, 2025 will additionally require intimation to each affected Data Principal without delay and a detailed report to the Data Protection Board within seventy-two hours of becoming aware. The reports must be factually consistent, because they will be read together.

How should companies review third-party data-processing contracts?

▾

Against the regulatory allocation rather than the commercial one. The review should establish whether the notification period the vendor owes the entity is short enough for the entity to meet its own six-hour and twelve-hour deadlines; whether audit and inspection rights are exercisable in practice; whether processing, sub-contracting and localisation restrictions match the applicable RBI direction; whether business continuity and exit arrangements are specified; and whether the indemnity reflects that statutory responsibility remains with the regulated entity regardless of contractual allocation.

Does outsourcing to a fintech partner transfer regulatory responsibility?

▾

No. Under the RBI framework the regulated entity remains answerable for the outsourced function, and the Reserve Bank of India (Digital Lending) Directions, 2025 require a written agreement with each lending service provider recording roles, rights and obligations, together with monitoring of portfolios originated through it. The contract allocates loss between the parties; it does not relocate the regulatory duty.

When should a business seek external regulatory legal advice?

▾

Four points recur. When applicability is genuinely unsettled — whether a direction covers the entity category, or whether it is likely to be notified a Significant Data Fiduciary. When a contract has to be drafted or renegotiated to carry a regulatory allocation rather than a commercial one. When an incident has occurred and several reporting obligations run at once on inconsistent timetables. And when a notice, inspection observation or show-cause proceeding has been received, where the record made in the first response frequently determines the outcome of the proceeding.

Corporate and Regulatory Legal Advisory

Organisations reviewing applicable Indian regulatory requirements, financial-sector compliance, data governance, corporate governance obligations or related legal exposure may refer to the firm's practice areas or contact the firm directly.

Telephone

+91 98100 21846

Direct partner line — by phone and on WhatsApp

WhatsApp

info@sagarandsagar.in

Office: +91-11-47543981 (Mon–Sat, 10:00–18:00 IST)

CONTACT US

Sagar & Sagar Law Offices
18 Hargobind Enclave, IInd Floor, Bhartendu Harish Chandra Marg, New Delhi 110092

This article is published for general information and professional commentary. It is not legal advice, does not create an advocate-client relationship, and is not an advertisement or solicitation of work. Commencement dates and regulatory requirements change; the position stated reflects the sources consulted at the date of publication and should be confirmed against the Gazette and the relevant regulator's current instruments before being relied upon.