GDPR vs DPDP & what it means to BFSI

The recently enacted Digital Personal Data Protection Act, 2023, of India, has cast itself as a game-changing framework for addressing the privacy and data protection needs of a rapidly digitizing nation.

- Dr. Sivaramakrishnan R Guruvayur

It draws inspiration from global standards like the European Union's General Data Protection Regulation while trying to balance India's unique socioeconomic and technological context with the promotion of innovation.

Both GDPR and DPDP Act have their similarities but diverge significantly in structure, scope, and operationalization, considering that the banking, finance, and fintech sectors are those where immense volumes of sensitive personal data are indeed processed. Here is a detailed comparative analysis between GDPR and DPDP in terms of its implications for the BFSI sector.

SCOPE & APPLICABILITY

GDPR is relevant to banking, finance, and fintech entities are data-intensive and process personal and sensitive personal data, such as financial records, payment information, and credit history. It applies to both organizations based in the EU and non-EU organizations offering goods/ services to EU residents or monitoring their behavior.

It also requires compliance for cross-border services like international remittances, global banking systems, and EU citizen financial transactions. Global banking and fintech organizations must align local processing systems with GDPR's high compliance standards and perform data audits for EU customers.

The DPDP Act applies to digital personal data processed within India or concerning the offering of goods/services in India. Indian banks, NBFCs, and fintech companies are 'data fiduciaries,' and major ones will be treated as Significant Data Fiduciaries (SDFs). The Act is domesticcentric with some extraterritorial applicability for businesses whose target is an Indian resident.

DATA CATEGORIES & SENSITIVITY

GDPR imposes high-level security for sensitive data to avoid data breaches, including credit card fraud and identity theft. PIA for processing operations, for example, a system for automated approval of loans or profiling credit risk.