Dhristhi DPDP
Legal Register
Visual Infographic
I-20 Sector Overlays 👤 BFSI Legal Counsel, Compliance Officers & FinTech Architects
← All 27 Infographics

Sector Conflict Map (BFSI & FinTech)

Managing Overlaps: DPDP vs RBI KYC/Retention Mandates, PMLA, and CERT-In Directions

Financial sector enterprises do not operate under DPDP in a regulatory vacuum; they must harmonize DPDP rules with preexisting sector regulations from the Reserve Bank of India (RBI), SEBI, IRDAI, and the Prevention of Money Laundering Act (PMLA 2002). The golden rule is 'Map, don't flatten': DPDP Section 8(7) erasure duties yield to statutory retention mandates under PMLA (10-year KYC/transaction retention), while DPDP notice and security standards apply concurrently.

Statutory Source: Ch. 5, Ch. 31
Archetype: sector conflict
I-20 DiagramArchetype: SECTOR CONFLICT

Sector Conflict Map (BFSI & FinTech)

Statutory Conflict Harmonization (Map, Don't Flatten)

KYC & Transaction Retention

DPDP Rule: s.8(7) Erase data upon purpose completion or consent withdrawal
Sector Rule: PMLA s.12 & RBI Master Direction: Retain KYC and records for 5–10 years
⚖️ Harmonization Rule: PMLA retention takes statutory precedence under s.17(1)(b) / s.7(d). Quarantine data in cold compliance vault.

Data Localization

DPDP Rule: s.16(1) Cross-border transfers permitted to all non-blacklisted countries
Sector Rule: RBI 2018 Payment Data Localization: Unconditional storage in India only
⚖️ Harmonization Rule: Strict sector rule applies. Payment system data must remain exclusively stored on Indian servers.

Breach Reporting

DPDP Rule: s.8(6) & r.7 Notify Board and Principals immediately / 72h
Sector Rule: CERT-In 6-hour report + RBI 2-6 hour cyber incident reporting
⚖️ Harmonization Rule: Dual notifications mandatory. Report to CERT-In/RBI within 6h; notify DPBI/Principals under Rule 7.

💡 Core Architectural Insights & Takeaways

Key technical and regulatory takeaways established by this architecture diagram.

✦ Where sector laws explicitly mandate data retention, DPDP Section 8(7) erasure is overridden.
✦ Quarantined compliance data cannot be used for commercial or analytical purposes.
✦ Payment data localization mandates from RBI remain fully binding despite general DPDP transfer rules.

📜 Statutory Grounding & Legal Perimeter

Primary Act and subordinate Rule provisions establishing the enforceable legal mandate for this diagram.

Enforceable Provisions:
Section 7(b)Section 8(7)Section 17(1)(b)RBI DirectionsPMLA Section 12

🏗️ Target Architecture & Impacted Systems

Enterprise nodes and store topologies impacted by this architectural pattern.

View Complete Topology (SYS-001..014) →
SYS-001 Details →
Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-002 Details →
Core Lending Monolith & Transaction Store

Domestic production database and primary system of record for loan servicing

SYS-004 Details →
Enterprise Cloud Data Warehouse

Purpose-partitioned analytical warehouse staging operational reporting

SYS-010 Details →
Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

⚙️ Associated Operational Controls

Control Master Matrix obligations enforcing the standards illustrated in this infographic.

Open Control Matrix →
OBL-06 Workpaper →
Control Dossier OBL-06
OBL-14 Workpaper →
Control Dossier OBL-14
OBL-46 Workpaper →
Control Dossier OBL-46
OBL-48 Workpaper →
Control Dossier OBL-48

🛠️ Implementation Guidance & Traps

Recommended technical sequencing and operational failure modes to avoid.

Recommended Implementation Sequence

  1. Tag financial datasets with statutory retention codes (e.g. RET-PMLA-10Y).
  2. Configure automated data quarantine routing for closed lending and deposit accounts.
  3. Align breach incident response playbooks with both RBI and DPDP reporting trees.

Enterprise Traps & Failure Modes

  • ⚠️ Blindly deleting core banking records upon customer consent withdrawal, violating PMLA.
  • ⚠️ Exporting Indian payment card transactions to global cloud analytics platforms.

📁 Verifiable Evidence Artifacts Vault

Required evidentiary workpapers for regulatory inspections and SDF audits.

📄 BFSI Sector Regulatory Harmonization Matrix (/sectors/bfsi-fintech/)
📄 PMLA Retention Override Register
📄 Payment Data Residency Audit Certificate
← Previous Infographic
I-19: The Evidence Grid (Control-to-Specimen Crosswalk)
Next Infographic →
I-21: The Regulatory Monitoring Loop