Interactive Checklist

C-18 Sector Specific (BFSI) Sector & Business Unit Lead

The Sector Overlay Application Checklist (BFSI)

Specialized sector checklist harmonizing DPDP Act obligations with RBI Master Directions, SEBI regulations, PMLA retention, and IRDAI rules.

Statutory Source: Ch. 31 + calendar layer 4: dual clocks, KYC retention minima, outsourcing boundaries, examiner artefacts

Total Verification Points: 6 Audit Checks

C-18Ch. 31 + calendar layer 4: dual clocks, KYC retention minima, outsourcing boundaries, examiner artefacts

The Sector Overlay Application Checklist (BFSI)

BFSI assessment deliverable

Readiness Score

0 / 6 checks

Digital Lending App (DLA) Segregation: Biometric and phone contact access removed from lending customer journeys.

RBI Digital Lending Guidelines

KYC / PMLA Retention Priority: 5-year statutory retention enforced under PMLA overrides consent withdrawal erasure.

Section 8(8) & PMLA 2002

Dual Breach Notification Clocks: CERT-In 6-hour intimation and DPBI / Principal intimation run in parallel.

CERT-In 2022 & DPDP Rule 7

Account Aggregator Consent Flow: NBFC-AA consent artifact reconciled with statutory Consent Manager standards.

Section 6(9) & RBI Master Directions

Payments Data Localization: End-to-end transaction data stored exclusively within India per RBI circular.

Section 16(2) & RBI 2018

Credit Bureau Statutory Reporting: Mandatory sharing with CICs grounded in statutory compliance (s.7(b)).

Section 7(b) & CICRA 2005

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 5

Section 6

Section 8(7)

Section 16(2)

Section 17

Statutory Context:

This checklist is directly anchored in Ch. 31 + calendar layer 4: dual clocks, KYC retention minima, outsourcing boundaries, examiner artefacts. Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-001 Architecture Spec →

Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-004 Architecture Spec →

Enterprise Cloud Data Warehouse

Purpose-partitioned analytical warehouse staging operational reporting

SYS-008 Architecture Spec →

Foreign-Region Secondary Backup Replica

Offshore disaster recovery replica; isolated pending cross-border transfer checks

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-05 Workpaper →

Control Dossier OBL-05

OBL-13 Workpaper →

Control Dossier OBL-13

OBL-22 Workpaper →

Control Dossier OBL-22

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-17 — The SDF Readiness Checklist

Next Checklist

C-19 — The Sector Checklist Set (Retail / Health / Employment)