DPDP Rules 2025: What Banks and NBFCs Must Do as Significant Data Fiduciaries Before May 2027

The Digital Personal Data Protection Act, 2023 established the framework. The DPDP Rules, 2025 — notified on November 13, 2025, with full obligations enforceable from May 13, 2027 — make it operational. For banks, NBFCs, and insurers, the Rules do two things that directly affect AI systems: they create a Data Protection Impact Assessment requirement for algorithmic processing, and they operationalize the Significant Data Fiduciary designation that will make India's largest financial institutions subject to heightened AI data governance obligations.

This page focuses specifically on the DPDP Rules 2025 — the operational instrument. Our separate page on the DPDP Act and AI covers the Act's framework provisions. These are distinct: the Rules contain the specific AI-related obligations (DPIA requirement, SDF criteria, consent specificity for AI pipelines) that the Act establishes only in outline.

Significant Data Fiduciary Designation — Who Will Qualify

The Rules establish SDF designation criteria under Section 10 of the DPDP Act. MeitY has signaled that designation will be based on:

Criterion	Threshold (indicative)	Relevance to BFSI
Volume of personal data processed	Large-scale processing of financial, health, or sensitive personal data	Banks processing KYC, transaction, and account data of millions of customers; NBFCs with large retail portfolios; health insurers
Risk to data principals	High risk of harm from data processing errors, breaches, or AI-driven decisions	Credit scoring AI (affects credit access), insurance underwriting AI (affects coverage), KYC AI (affects account access)
National security or public order sensitivity	Data whose compromise poses systemic risk	Core banking data, payment system data, inter-bank transaction data
Impact of data processing on sovereignty or integrity	Cross-border data flows, foreign entities processing Indian personal data	Offshore cloud deployments, international AI vendors processing Indian financial data

Expected SDF designations in BFSI: large scheduled commercial banks (PSU and private), large NBFCs (by AUM), life and health insurers, payment system operators, and large fintech platforms with significant retail user bases.

The DPIA Requirement for AI Systems

What Triggers a DPIA Under DPDP Rules 2025

The Rules require SDFs to conduct Data Protection Impact Assessments for "algorithmic software used for specified processing activities." In BFSI, this covers:

• Credit scoring models: AI/ML models that process personal financial data to generate credit scores affecting loan approval, pricing, or limit-setting
• Insurance underwriting AI: models that process personal health, lifestyle, or financial data to determine insurance eligibility, premium, or coverage terms
• AI-driven KYC/onboarding: models that use personal data (facial recognition, document AI, behavioral biometrics) to verify identity or assess risk
• Collections and recovery AI: models that process personal financial behavior data to determine collection strategies or contact frequencies
• AML/fraud detection AI: models that process transaction patterns and personal data to generate risk flags

What a DPDP DPIA Must Cover (for AI Systems)

A DPDP-compliant DPIA for an AI system is not the same as a model risk assessment or a NIST AI RMF evaluation. It has three specific components:

1. Purpose specification: identify every purpose for which the AI processes personal data. An AI model that uses the same data for credit assessment AND product recommendation requires separate purpose documentation — DPDP requires "specific" consent, which means one consent cannot cover two purposes.
2. Risk to data principals: identify whether the AI's decisions or outputs create "risk to data principals' rights" — defined as risk of harm, reputational damage, financial loss, or discriminatory impact. This is different from operational model risk: a credit scoring model that works perfectly from a statistical standpoint can still pose "risk to data principals' rights" if it produces disparate impact on protected groups.
3. Mitigation measures: for each identified risk, document the mitigation — human oversight, explainability mechanisms, challenge/appeal processes, bias testing. The DPIA must verify that these mitigations reduce risk to an acceptable level before the AI system is deployed or continues operating.

Consent Specificity for AI Pipelines — The Architecture Problem

Why Most Current AI Pipelines Have a Consent Gap

DPDP requires consent that is "free, specific, informed, and unambiguous." The "specific" requirement creates a structural problem for multi-purpose AI pipelines — the kind most fintech and banking AI systems are:

What Needs to Change

1. Consent architecture audit: map every AI system to the specific personal data it processes and the specific purpose it serves. This audit will likely reveal that multiple AI systems are operating under consent that does not satisfy DPDP's specificity requirement.
2. Purpose-separated consent flows: redesign consent capture for AI pipelines so each material purpose has a distinct, revocable consent. This is a product engineering change, not just a legal documentation change.
3. Consent withdrawal chain: when a customer withdraws consent for a purpose, the AI model trained on that customer's data for that purpose may need retraining or the model's outputs for that customer may need to be suppressed. This is a technical AI pipeline requirement, not just a data deletion requirement.

Account Aggregator Integration — The Consent Revocation Chain

The DPDP Rules 2025 formalize the Account Aggregator (AA) framework as the consent management mechanism for financial data. This creates a specific AI governance obligation for institutions using AA-sourced data in their AI models:

When a data principal revokes an AA consent, the revocation must propagate through the full data processing chain — including any AI model that was trained on or currently processes that data. An institution that has used AA-sourced financial data to train a credit scoring model faces a question: does consent revocation require model retraining, output suppression for that individual, or both?

DPDP Rules 2025 do not specify the technical mechanism, but they are clear that "erasure" of personal data must be "complete and verifiable." For AI models, this is technically complex — a model trained on personal data does not straightforwardly "forget" that data when told to. Financial institutions need a documented position on model unlearning or retraining triggers before May 2027.

The Quasi-Explainability Duty

DPDP does not have a GDPR Article 22-style blanket prohibition on automated decisions or a right to obtain human review of automated decisions. However, DPDP's accuracy obligation for data fiduciaries — which requires that personal data be "accurate and complete" when used to make decisions affecting data principals — creates a functional explainability requirement for AI-driven financial decisions.

A credit rejection driven by an AI model that relies on inaccurate data is a DPDP violation — the institution has made a decision affecting the data principal using inaccurate personal data. To demonstrate compliance with the accuracy obligation, institutions need to be able to show which data the AI used to make a given decision. That demonstration is, functionally, an explainability requirement.

Practical implication: AI models used for credit, insurance, and other decisions affecting individual data principals need audit trails sufficient to identify which personal data inputs drove the output — even without a formal GDPR-style "right to explanation."

Enforcement Timeline and What to Build Before May 2027

Full obligations enforceable from May 13, 2027 — 18 months from DPDP Rules notification.

Frequently Asked Questions

What is a Significant Data Fiduciary under DPDP Rules 2025 and which banks will qualify?

Significant Data Fiduciaries (SDFs) are designated by MeitY under Section 10 of the DPDP Act 2023 based on criteria including volume of personal data processed, risk to data principals, and national security sensitivity. India's large scheduled commercial banks (PSU and private sector), large NBFCs, and major insurance companies are expected to be designated SDFs based on the scale of personal financial data they process. SDFs face additional obligations including Data Protection Impact Assessments for algorithmic software and higher accountability standards.

Does DPDP Rules 2025 require a "right to explanation" for AI-driven credit decisions?

DPDP Rules 2025 do not create a GDPR Article 22-style right to explanation or to human review of automated decisions. However, DPDP's accuracy obligation — which requires that personal data be accurate and complete when used to make decisions affecting data principals — creates a functional explainability requirement. Banks using AI for credit decisions must be able to demonstrate that the data used by the model was accurate, which requires audit trails showing which data inputs drove the model's output.

How does DPDP Rules 2025 interact with the Account Aggregator framework for AI models?

DPDP Rules 2025 formalize the Account Aggregator framework as the consent management mechanism for financial data. When a data principal revokes an AA consent, the revocation must propagate through any AI model processing that data. Institutions using AA-sourced financial data to train credit scoring or risk models need a documented position on model retraining or output suppression when consent is revoked — this is a technical AI pipeline obligation, not just a data deletion process.