Data Protection, Cyber Security and Digital Banking Compliance
This domain tests data protection, cyber security and digital banking compliance at the branch and in outsourced channels.
Core rules
- The Digital Personal Data Protection Act, 2023 (DPDP) requires lawful purpose, consent, purpose limitation, data minimisation, retention limits and breach notification; data principals have rights to access, correction and grievance redressal.
- RBI's cyber security framework and Digital Payment Security Controls (2021) require MFA, tokenisation, no storage of card data and incident response.
- CERT-In directions require reporting of specified cyber incidents within six hours.
- Digital lending guidelines (2022) require due diligence on lending service providers, a Key Fact Statement, a cooling-off period and no automatic credit-limit increase.
- V-CIP and digital KYC must meet the same CDD standards as branch onboarding.
Worked example
A branch shares customer contact data with a marketing vendor without consent. This is a DPDP breach and a confidentiality breach. The branch must stop the sharing, assess the scope, notify the Data Protection Board and affected customers as required, and report a cyber incident to CERT-In if the incident falls within its list.
Traps
Assuming DPDP does not apply to banks; late CERT-In reporting; storing card data; outsourcing to an LSP without due diligence; treating digital lending as only an app issue.