ComplyDP's Breakthrough: India's DPDP Act Compliance Solved for Banks?

Data security is impossible without visibility: ComplyDP's Vipul Abhishek on creating India's native solution for the GDPR-era compliance landscape. As banks, NBFCs, insurers, and capital market entities gear up for the DPDP Act, the co-founder and CTO of ComplyDP outlines how a unified suite bridges the gap from initial assessment to full compliance, emphasizing that discovery is the foundation, data must remain local, and the system must satisfy every regulatory body governing a financial group.

India's Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 mandate that most requirements take effect on 13 May 2027. For financial institutions, this legislation does not exist in a vacuum. It operates alongside RBI directives, SEBI regulations, CERT-In reporting mandates, and CERSAI filings, each carrying distinct timelines and evidentiary requirements.

Key takeaways

• What it is: ComplyDP is a Bengaluru based, all in one DPDP compliance suite for Indian organisations, including banks, NBFCs, insurers and capital market firms.
• How it works: neurosymbolic compliance, zero PII ingestion through proprietary connectors, and data discovery, mapping and ROPA across multi entity groups.
• Breach response: one workflow covering DPDP, CERT-In, RBI and SEBI reporting deadlines.
• Deadline: most DPDP obligations apply from 13 May 2027, with penalties up to Rs 250 crore per breach.

Vipul Abhishek, co-founder and CTO of ComplyDP, a Bengaluru based DPDP compliance platform, notes that many existing compliance solutions were originally engineered for Europe's GDPR and subsequently retrofitted for the Indian market. ComplyDP was developed with the opposite philosophy.

The disparity is evident. According to ComplyDP's State of DPDP Readiness research, which analyzed 1,680 company websites, 82.4% of financial services companies had no consent banner detected.

"Indian financial groups do not need a GDPR tool with an India settings page," Abhishek said. "They need software that starts from the DPDP Act and understands the RBI, SEBI and CERT-In obligations that sit around it. That is what we have built in India."

Neurosymbolic compliance: findings that trace back to the law

Neurosymbolic compliance combines formal logic, which turns the law into rules a machine can check, with AI models used only where legal text needs interpretation. ComplyDP utilizes this methodology. By encoding the DPDP Act and Rules into formal logic, compliance decisions are based on explicit, verifiable rules. AI language models are reserved strictly for navigating the ambiguous areas where legal text requires interpretation.

"A regulator will not accept a confidence score," Abhishek said. "When we say a process is non compliant, we can show the exact provision, the exact rule and the exact evidence that led there. In BFSI, that audit trail is the product."

Zero PII ingestion through proprietary connectors

The primary concern financial institutions express regarding compliance vendors is the movement of sensitive customer information outside their secure perimeters. ComplyDP addresses this with zero PII ingestion. Zero PII ingestion means personal data is scanned where it sits, inside the client's systems, and only metadata and findings leave.

The company's proprietary connectors run inside the client's own environment. They perform scans on databases, applications, and file stores locally, transmitting only metadata and insights—such as identifying which systems house specific categories of personal data—back to the platform. Actual customer records are never copied to ComplyDP.

"It makes no sense to fix a privacy problem by creating a new copy of everyone's data," Abhishek said. "Our connectors go to the data. The data never comes to us."

Data discovery, data mapping and ROPA come first

Abhishek contends that many DPDP initiatives fail because they prioritize policy over data.

"You cannot protect data you have not found," he said. "A bank's personal data does not live only in its core system. It sits in loan origination tools, call centre recordings, KYC folders, marketing platforms and vendor systems. Discovery tells you where it is. Mapping tells you how it moves. Without both, a privacy notice is guesswork."

For lenders, this mapping must also encompass data shared externally, such as KYC records submitted to the Central KYC Registry run by CERSAI and security interest filings. "Regulatory filings are personal data flows too," Abhishek said. "They belong on the map like any other."

ComplyDP generates a Record of Processing Activities (ROPA) from this map, detailing what personal data is collected, the purpose, the legal basis, storage locations, sharing partners, and retention periods. While the DPDP Act does not explicitly use the term ROPA, Abhishek notes that this record is essential for proving compliance across all obligations, including accurate notices, consent management, Data Principal Requests (DPRs), and data erasure.

Built for complex multi entity groups

Large financial organizations rarely function as a single entity. A group might encompass a bank or NBFC, an insurance division, a brokerage, and a technology subsidiary, each acting as a distinct data fiduciary under its own regulator.

ComplyDP maps data flows across entities, identifying where customer information is shared within the group, the legal basis for that sharing, and which entity holds accountability at each stage. "Group structures are where accountability gets lost," Abhishek said. "Each entity needs to know what it holds, what it received from a sister company, and what it is answerable for."

One breach, many clocks

A data breach within an Indian financial institution can trigger multiple reporting obligations simultaneously. Under the DPDP Rules, firms must notify the Data Protection Board and every affected individual, with a comprehensive report submitted to the Board within 72 hours. Simultaneously, CERT-In mandates that cyber incidents be reported within six hours, while RBI and SEBI regulated entities face their own specific cyber resilience and incident reporting requirements.

ComplyDP's breach response system consolidates these duties into a single workflow. It identifies affected data and individuals using the data map, monitors the deadline for each regulator, and generates the necessary notices and evidence required by each authority.

"In a breach, nobody has time to work out which regulator needs what," Abhishek said. "The system should already know which data was affected, who has to be told and by when, across DPDP, CERT-In, RBI and SEBI. That is preparation you do now, not on the day."

One suite, from zero to one

ComplyDP provides an all in one DPDP compliance suite designed to take an organization from zero to one: moving from a state of uncertainty regarding data location to a fully demonstrable compliance program.

The platform integrates every stage of the process: a public readiness scan for websites and apps, data discovery and mapping via zero PII connectors, the ROPA, consent management, Data Principal Request (DPR) handling, compliance audits with provision level findings, and the breach response system.

"Most companies today buy a consent tool from one vendor, run a spreadsheet for their data map and hire a consultant for the audit," Abhishek said. "Nothing connects, so nothing can be proved. We built one suite so that the data map drives the notice, the notice drives consent, and consent drives what happens when a customer makes a request or a breach occurs. That is how you go from zero to one in DPDP compliance."

Security the sector can verify

ComplyDP holds ISO 27001 certification, the global benchmark for information security management. Abhishek emphasizes that this is critical for BFSI clients who must vet every vendor against stringent security and outsourcing standards.

"Financial institutions are right to be demanding about who touches their systems," he said. "We built for that from day one: zero PII ingestion, connectors that stay inside the client's environment, and a certified security programme."

The clock is running

The DPDP Rules were notified on 13 November 2025, coinciding with the constitution of the Data Protection Board of India. Obligations regarding notice, consent, rights, security safeguards, breach reporting, and children's data become enforceable on 13 May 2027, with penalties under the Act reaching up to Rs 250 crore per breach.

"For BFSI, May 2027 is closer than it looks," Abhishek said. "Discovery and mapping across a multi entity group takes months. The institutions that start now will be the ones that can prove compliance when it is asked for."

ComplyDP is operated by Nihonium Labs Private Limited and is supported by NVIDIA Inception, Google Cloud for Startups, T-Hub and DST. It is a member of DSCI.

About ComplyDP: ComplyDP is a Bengaluru based DPDP compliance platform operated by Nihonium Labs Private Limited. Its methodology is published at complydp.com/methodology.