Get Summary
A loan officer at a regional NBFC sits across from a customer in a small town outside Nagpur. The customer speaks Marathi, reads it comfortably, and manages just enough English to sign his name. The loan agreement on the tablet in front of him is in English, the consent checkbox says "I agree to the terms and conditions," and the officer, pressed for time, talks him through the gist of it in Marathi before asking him to tap accept.
Nothing about this moment feels unusual. It happens thousands of times a day across India's BFSI and NBFC sectors. But under the Digital Personal Data Protection Act, 2023, that tap on the checkbox is not valid consent. The customer never actually understood, in a language he could read, what data was being collected, why, or how to withdraw it later. This is the quiet operational reality the DPDP Act is forcing into the open, and the timeline to fix it is shorter than most compliance teams have registered.
What Is the DPDP Act, and Why Does It Apply to BFSI Now?
From the Puttaswamy Judgement to the DPDP Act, 2023
The DPDP Act traces back to a 2017 Supreme Court judgement, Justice K.S. Puttaswamy versus Union of India, in which a nine-judge bench held that privacy is a fundamental right under Article 21 of the Constitution. That ruling set the process in motion for a dedicated data protection law, which was eventually passed as the Digital Personal Data Protection Act in August 2023, followed by the Digital Personal Data Protection Rules notified on November 13, 2025.
DPDP Act Implementation Timeline: Phases 1, 2, and 3
The Act is not switching on all at once. It is being implemented in three stages:
Phase 1 (effective November 13, 2025): the Data Protection Board of India is established
Phase 2 (effective November 13, 2026): Consent Manager provisions come into force under Rule 4
Phase 3 (effective May 13, 2027): the full substantive provisions of the Act become enforceable
The staged rollout creates a false sense of runway. Phase 2 lands in a little over a year, and it reshapes the compliance landscape well before the final deadline arrives.
Why Regional Language Consent Matters Under DPDP?
The reason that Marathi-speaking customers' consent falls short is not an edge case; it is the norm across a sector that serves customers in dozens of languages and literacy levels. The DPDP Act requires consent to be free, specific, informed, and unambiguous, and it requires notices to be available in English or any of the twenty-two languages listed in the Eighth Schedule of the Constitution. A tablet screen showing English legal text, translated verbally and informally by a loan officer under time pressure, does not meet that bar, however well intentioned the officer is.
How the November 2026 Consent Manager Deadline Affects Lenders
This scenario is where the Consent Manager provisions arriving in November 2026 become relevant to every BFSI and NBFC business, not just the entities that plan to register as one. Consent Managers are registered platforms that let a customer grant, review, and withdraw consent across multiple institutions from a single interoperable interface, with auditable logs kept for a minimum of seven years and a minimum net worth requirement of ₹2 crore for the Consent Manager itself. Lenders integrating with a registered consent manager will be expected to feed it consent that is genuinely specific and informed in the first place. A vague, English-only checkbox does not become compliant just because it now routes through a better platform.
Multilingual Consent: What Informed Consent Actually Requires
Go back to the loan agreement. Informed consent, in a market where customers span dozens of languages and a wide range of English literacy, breaks down into a few concrete requirements:
An itemised list of the data being collected, translated accurately rather than word for word
The specific purpose of processing (loan servicing, credit scoring, marketing communication) is stated separately, in plain regional language wording
Withdrawal instructions that are just as easy to find in the Marathi, Tamil, or Bengali version as they are in English
Bundling all of this into one checkbox, in one language, fails the standard no matter how the rest of the compliance programme is built.
Why Translation at Scale Is a Compliance Function, Not a One-Time Project
A single loan agreement is one document. A mid-sized NBFC updates disclosures, product terms, and KYC language regularly, across every state it operates in. Most institutions quietly fall behind when they need to reproduce each change accurately and consistently in ten or more languages on a compliance timeline instead of relying on a translation agency's timeline. This is the specific gap in sovereign language infrastructure of the kind Devnagri builds for BFSI and government-facing platforms that is designed to close: treating language accuracy as an ongoing compliance function rather than a one-off translation project.
DPDP Data Security Requirements and Penalties for BFSI
Imagine the same NBFC a year later. A misconfigured server exposes a folder of KYC documents, Aadhaar copies, and loan applications for two days before anyone notices. Under the DPDP Act, such an event is a personal data breach with no materiality threshold. It must be reported.
The single highest penalty category under the Act, up to ₹250 crore, is reserved specifically for failing to take reasonable security safeguards to prevent exactly this kind of breach. That figure sits above the penalty for most other violations, which signals where the regulator's priorities sit. The DPDP Rules spell out the concrete minimums expected: encryption, obfuscation, or masking of personal data; access controls over the systems handling it, logging and monitoring capable of detecting unauthorised access; and backups to preserve continuity if data is compromised.
The 72-Hour Breach Notification Rule Under DPDP
Once the NBFC discovers the exposed folder, the Data Protection Board must be notified without delay, with detailed information following within 72 hours. There is no threshold for severity. A two-day exposure of a few hundred files still counts. A 72-hour response process cannot be assembled within the 72 hours after a breach is discovered. It has to exist beforehand, tested and ready.
Data Localisation and Sovereignty for Regulated Lenders
For a lender handling KYC data, loan records, and credit history, the physical location of that data is as much a security question as encryption. VPC and on-premise deployment, zero data retention policies, and immutable audit logs are the infrastructure choices that determine whether an institution can actually meet the DPDP Rules' security minimums rather than just assert that it does on paper. This phase is the layer where a platform built with a three-layer architecture, the way Devnagri structures its infrastructure for BFSI and government clients, becomes a genuine risk control rather than a marketing line, particularly for institutions where a lapse is not just a technical incident but a potential ₹250 crore exposure.
DPDP Readiness Checklist for BFSI and NBFCs
Picture the loan officer and the exposed server as two moments in the same institution's life, months apart. One is a consent failure, the other a security failure, and the DPDP Act treats them as two sides of the same obligation: protect the customer's data and make sure the customer actually understood what they agreed to.
A short list is more useful here than a long one:
Map every point where customer data is collected; in every language it is collected in
Audit consent flows for whether they are genuinely understandable in the customer's language, not just technically translated
Confirm security safeguards meet the DPDP Rules minimums before Phase 2 enforcement begins in November 2026
Document a breach response process now, rather than improvising one after a folder is already exposed
The customer in Nagpur and the exposed KYC folder are not two unrelated risks. They are the same underlying gap, showing up at two different points in the lending lifecycle. Solving them together, treating language accuracy and data security as one connected compliance function rather than separate checklists, is what actually gets a BFSI institution ready before enforcement catches up to it.
