Consent by Fine Print, and a Vendor's Foreign Bucket

No, and the gap is fundamental. Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the purpose for which it is given. A single bundled clause covering 'products and services of the Bank and its partners' is the opposite of specific: it does not name the purpose (behavioural profiling of transaction history to generate pre-approved credit offers), it is not granular, and it cannot be read as informed consent to profiling.

What must change before launch:

• Unbundle it. Separate, itemised consent for this purpose at the point of use, distinct from consent for account operation and from any other marketing.
• A proper notice stating the purpose, the categories of data used, the parties it will be shared with, the retention period and the grievance contact - in English or any of the Eighth Schedule languages.
• Affirmative opt-in, with the consent artefact recorded: timestamp, notice version, purpose code, channel.
• Withdrawal as easy as giving, propagating downstream to the model, the CRM and any list passed to partners, and stopping processing prospectively.
• Minimisation: three years of spend history is more than the purpose needs; justify the lookback or shorten it.

The 'partners' formulation must go entirely. It cannot support onboarding a new partner later, and it is the clause most likely to be quoted back at the bank.

This is a personal data breach and the delay is a separate failure. Under the DPDP Act the Data Fiduciary must notify the Data Protection Board and each affected Data Principal without delay, in the prescribed form and manner, giving the nature and extent of the breach, its timing and location, the likely impact, the mitigation taken, and the contact of the person answerable. The obligation bites on knowledge, not on certainty of scope - eleven days of silence cannot be justified by an unfinished investigation.

Second track: if this is a cyber incident, CERT-In's 6-hour reporting window was crossed long ago. That is a distinct violation with its own consequences.

Now, in order:

1. Contain - revoke the vendor's access, obtain verified deletion of the US copy and written certification.
2. Scope precisely - which rows, which fields, were identifiers included, can individuals be re-identified.
3. Assess harm per data principal and draft the notification.
4. Notify the Board, notify affected customers with practical guidance, and brief the board and the regulator together.
5. Preserve evidence and the internal timeline, including who knew what on which date - that record will be requested.
6. Repaper the vendor: the bank as Data Fiduciary is accountable for its processor's acts, so the contract needed breach notification, audit, no-sub-processing and India-residency clauses.

Penalty exposure is material: the DPDP schedule provides for failure to take reasonable security safeguards and for failure to notify a breach.

Appoint a DPO now. The role must be a named individual resident in India, responsible to the board (not to the marketing or IT function), and the single point of contact for data principals and the Board. A vacant post while building a profiling engine is itself a finding.

Consent Manager. Decide whether to integrate with a registered Consent Manager or build an internal consent artefact system with the same properties: purpose-level granularity, versioned notices, a machine-readable artefact, and withdrawal that propagates. Set a target of one dashboard where a customer can see and revoke every consent.

Significant Data Fiduciary duties, on the assumption of designation: an independent Data Protection Officer, periodic Data Protection Impact Assessments for high-risk processing such as the cross-sell engine, periodic audits by an independent auditor, algorithmic due-diligence on automated decisions, and a grievance-redressal mechanism with published timelines. Build the DPIA template before the engine goes live, not after.

Retention and erasure. A board-approved schedule by data category and purpose, with verified deletion, deletion certificates from processors, and a rule that analytics extracts do not outlive their purpose.

Foundations: data inventory and record of processing, vendor register with DPDP clauses, a rewritten breach-response policy with decision rights and clocks, staff training, and a quarterly board dashboard. Map the whole plan to the phased timelines in the Rules and report progress quarterly.