Digital Personal Data Protection Act – Implications For Financial Entities And Fin-tech Sector

The Digital Personal Data Protection Act, 2023 ('Act') has been notified¹ in the Gazette but is yet to come into effect. It introduces a comprehensive framework governing processing of personal data including notice² and consent requirements³, compliance with principles-based obligations⁴ in respect of processing personal data of individuals (referred to as 'Data Principals'). Additional requirements are also provided for the processing personal data of children and persons with disabilities⁵ and extending certain rights to individuals⁶.

Entities determining means and purpose of processing ('Data Fiduciaries'), complying with the existing law may have to realign their approach in collecting and processing personal data. In effect, their business practices and operations will have to transition from expanding data collection to minimizing it to 'fit-for-purpose' to reduce exposure. Given its sector-agnostic approach, this law is likely to have a significant