As banks, NBFCs, insurers and capital market firms prepare for the DPDP Act, ComplyDP’s co-founder and CTO explains how an all in one suite takes them from zero to one, why compliance has to start with discovery, run without copying personal data, and hold up across every regulator a financial group answers to.
India’s Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 bring most obligations into force on 13 May 2027. For financial institutions, the law does not arrive alone. It sits alongside RBI directions, SEBI norms, CERT-In reporting rules and CERSAI filings, each with its own timelines and evidence standards.
Key takeaways
- What it is:ComplyDP is a Bengaluru based, all in one DPDP compliance suite for Indian organisations, including banks, NBFCs, insurers and capital market firms.
- How it works:neurosymbolic compliance, zero PII ingestion through proprietary connectors, and data discovery, mapping and ROPA across multi entity groups.
- Breach response: one workflow covering DPDP, CERT-In, RBI and SEBI reporting deadlines.
- Deadline: most DPDP obligations apply from 13 May 2027, with penalties up to Rs 250 crore per breach.
Vipul Abhishek, co-founder and CTO of ComplyDP, a Bengaluru based DPDP compliance platform, says most compliance tools on the market were designed for Europe’s GDPR and then adapted for India. ComplyDP was built the other way round.
The gap is visible from the outside. In ComplyDP’s State of DPDP Readiness research, a scan of 1,680 company websites, 82.4% of financial services companies had no consent banner detected.
“Indian financial groups do not need a GDPR tool with an India settings page,” Abhishek said. “They need software that starts from the DPDP Act and understands the RBI, SEBI and CERT-In obligations that sit around it. That is what we have built in India.”
Neurosymbolic compliance: findings that trace back to the law
Neurosymbolic compliance combines formal logic, which turns the law into rules a machine can check, with AI models used only where legal text needs interpretation.ComplyDP is built on this approach. The DPDP Act and Rules are encoded into formal logic, so a compliance decision follows explicit rules that can be checked. AI language models are used only for the grey areas where legal text needs interpretation.
“A regulator will not accept a confidence score,” Abhishek said. “When we say a process is non compliant, we can show the exact provision, the exact rule and the exact evidence that led there. In BFSI, that audit trail is the product.”
Zero PII ingestion through proprietary connectors
The biggest objection financial institutions raise about compliance vendors is simple: they do not want customer data leaving their systems. ComplyDP’s answer is zero PII ingestion. Zero PII ingestion means personal data is scanned where it sits, inside the client’s systems, and only metadata and findings leave.
The company’s proprietary connectors run inside the client’s own environment. They scan databases, applications and file stores where they sit, and send back only metadata and findings, such as which systems hold which categories of personal data. Customer records themselves are not copied to ComplyDP.
“It makes no sense to fix a privacy problem by creating a new copy of everyone’s data,” Abhishek said. “Our connectors go to the data. The data never comes to us.”
Data discovery, data mapping and ROPA come first
Abhishek argues that most DPDP programmes go wrong by starting with policies instead of data.
“You cannot protect data you have not found,” he said. “A bank’s personal data does not live only in its core system. It sits in loan origination tools, call centre recordings, KYC folders, marketing platforms and vendor systems. Discovery tells you where it is. Mapping tells you how it moves. Without both, a privacy notice is guesswork.”
For lenders, that map also has to cover data shared outside the institution, such as KYC records uploaded to the Central KYC Registry run by CERSAI and security interest filings with CERSAI. “Regulatory filings are personal data flows too,” Abhishek said. “They belong on the map like any other.”
ComplyDP builds a Record of Processing Activities (ROPA) from that map: what personal data is collected, for which purpose, on what legal basis, where it is stored, who it is shared with and how long it is kept. The DPDP Act does not use the term ROPA, but Abhishek says the record is what makes every other obligation provable, from accurate notices and consent to Data Principal Requests (DPRs), retention and erasure.
Built for complex multi entity groups
Large financial groups rarely operate as one company. A single group may run a bank or NBFC, an insurance arm, a broking business and a technology subsidiary, each a separate data fiduciary with its own regulator.
ComplyDP maps data flows across entities, showing where customer data is shared within the group, under which consent or legal basis, and which entity is accountable at each step. “Group structures are where accountability gets lost,” Abhishek said. “Each entity needs to know what it holds, what it received from a sister company, and what it is answerable for.”
One breach, many clocks
A data breach at an Indian financial institution can trigger several reporting duties at once. Under the DPDP Rules, the company must inform the Data Protection Board and every affected individual, with a detailed report to the Board within 72 hours. CERT-In directions require cyber incidents to be reported within six hours. RBI and SEBI regulated entities have their own incident reporting and cyber resilience requirements.
ComplyDP’sbreach response system brings these into one workflow. It identifies the affected data and individuals from the data map, tracks each regulator’s deadline, and prepares the notices and evidence each one requires.
“In a breach, nobody has time to work out which regulator needs what,” Abhishek said. “The system should already know which data was affected, who has to be told and by when, across DPDP, CERT-In, RBI and SEBI. That is preparation you do now, not on the day.”
One suite, from zero to one
ComplyDP offers an all in one DPDP compliance suite that takes an organisationfrom zero to one: from not knowing where its personal data sits to a programme it can demonstrate to a regulator.
The suite brings every stage onto one platform: a public readiness scan of websites and apps, data discovery and mapping through zero PII connectors, the ROPA, consent management, Data Principal Request (DPR) handling, compliance audits with provision level findings, and the breach response system.
“Most companies today buy a consent tool from one vendor, run a spreadsheet for their data map and hire a consultant for the audit,” Abhishek said. “Nothing connects, so nothing can be proved. We built one suite so that the data map drives the notice, the notice drives consent, and consent drives what happens when a customer makes a request or a breach occurs. That is how you go from zero to one in DPDP compliance.”
Security the sector can verify
ComplyDP is ISO 27001 certified, the international standard for information security management. Abhishek says this matters to BFSI buyers who must assess every vendor against their own security and outsourcing requirements.
“Financial institutions are right to be demanding about who touches their systems,” he said. “We built for that from day one: zero PII ingestion, connectors that stay inside the client’s environment, and a certified security programme.”
The clock is running
The DPDP Rules were notified on 13 November 2025, when the Data Protection Board of India was constituted. Notice, consent, rights, security safeguards, breach reporting and children’s data obligations apply from 13 May 2027, and penalties under the Act go up to Rs 250 crore per breach.
“For BFSI, May 2027 is closer than it looks,” Abhishek said. “Discovery and mapping across a multi entity group takes months. The institutions that start now will be the ones that can prove compliance when it is asked for.”
ComplyDP is operated by Nihonium Labs Private Limited and is supported by NVIDIA Inception, Google Cloud for Startups, T-Hub and DST. It is a member of DSCI.
