Skin
Free gap analysis · Banks

DPDP Gap Analysis for Banks

Measure your bank’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to Indian banks, including public sector banks, private sector banks, small finance banks and cooperative banks, subject to their applicable regulatory requirements.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the bank assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the bank assessed its obligations under the DPDP Act and Rules, along with applicable Reserve Bank of India (RBI) requirements?
03 Are data protection responsibilities clearly defined across departments, branches and business units?
04 Does senior management periodically review data protection compliance, risks and corrective actions?
2. Personal Data Inventory and Mapping
05 Has the bank identified the personal data it collects and processes about customers, employees, job applicants, vendors and other individuals?
06 Has the bank documented the purposes for processing personal data, including Know Your Customer (KYC) verification, account operations, lending, payments, fraud prevention and marketing?
07 Has the bank mapped how personal data flows between branches, core banking systems, mobile applications, websites, vendors and other systems?
08 Does the bank maintain an inventory of systems, databases and third parties that store or process personal data?
09 Has the bank identified personal data shared with credit information companies, payment networks, regulators, outsourcing partners and other recipients?
3. Privacy Notices and Consent
10 Does the bank provide clear privacy notices explaining what personal data is processed, why it is processed and how individuals can exercise their rights?
11 Has the bank identified which processing activities require consent and which qualify as certain legitimate uses permitted under the DPDP Act?
12 Where consent is required, does the bank obtain and maintain records of valid, purpose-specific consent?
13 Can customers withdraw consent through accessible channels, and does the bank stop the relevant processing unless another legal basis permits or requires its continuation?
14 Are appropriate privacy notices and consent mechanisms implemented across branches, websites, mobile banking applications and other customer channels?
4. Data Principal Rights and Grievance Redressal
15 Can individuals exercise their applicable rights to access information about their personal data, request corrections or updates, and request erasure?
16 Does the bank have documented procedures for verifying, tracking and responding to Data Principal requests?
17 Can requests received through branches, call centres, email and digital channels be recorded, tracked and resolved?
18 Does the bank have an accessible grievance redressal mechanism for personal data protection complaints?
19 Does the bank maintain records of requests, responses, actions taken and supporting evidence?
5. Data Retention and Erasure
20 Has the bank defined retention periods for different categories of personal data, considering applicable RBI, KYC, Anti-Money Laundering (AML), tax and other legal requirements?
21 Does the bank have procedures to erase personal data when it is no longer required and no applicable law requires its retention?
22 Can the bank implement and verify personal data deletion across relevant systems and third-party Data Processors?
6. Data Security and Breach Management
23 Has the bank implemented appropriate technical and organisational security safeguards to protect personal data?
24 Are access to personal data and privileged activities appropriately controlled, monitored and logged?
25 Does the bank have documented procedures to detect, investigate, respond to and record personal data breaches?
26 Can the bank notify affected individuals and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendor Management and Cross-Border Processing
27 Does the bank maintain an inventory of vendors and service providers that process personal data on its behalf?
28 Do contracts with Data Processors include appropriate provisions for data protection, security, breach reporting, confidentiality and deletion?
29 Does the bank periodically assess the data protection practices of its Data Processors and outsourcing partners?
30 Has the bank identified personal data processed or accessed outside India and assessed applicable DPDP and RBI restrictions?
8. Training, Risk Assessment and Compliance Monitoring
31 Are employees, including branch personnel and customer service teams, trained on their responsibilities under the DPDP Act?
32 Does the bank assess privacy risks before introducing new products, applications, technologies or significant changes to personal data processing?
33 Does the bank conduct Data Protection Impact Assessments (DPIAs) and other additional assessments where legally required, including if designated a Significant Data Fiduciary?
34 Does the bank periodically review the effectiveness of its data protection controls and track corrective actions?
35 Does the bank maintain sufficient documentation and evidence to demonstrate compliance during internal audits and regulatory inspections?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.