Is Your Bank Ready for DPDP? SecureCMS Simplifies Consent Management

SecureDApp Introduces SecureCMS to Assist Indian Banks and NBFCs in Achieving DPDP and RBI Consent Compliance by May 2027. Bengaluru (Karnataka) [India], November 2, 2026: Bengaluru-based security technology firm SecureDApp has rolled out SecureCMS, a DPDP consent management platform designed specifically for banks, non-banking financial companies (NBFCs), and the broader financial services industry. This launch arrives as the Consent Manager requirements under the Digital Personal Data Protection (DPDP) Rules, 2025, are set to become active on 13 November 2026. The primary obligations regarding notice, consent, security, and breach reporting will follow six months later, on 13 May 2027.

The DPDP consent management platform captures verified customer consent across various touchpoints—including branches, mobile applications, DSAs, and call centres—while syncing withdrawals to core banking systems and maintaining the audit trails lenders require to defend consent decisions. For financial institutions, the six-month window is tight. Under the DPDP Act, consent must be a verifiable record capable of withstanding scrutiny, yet in banking, this data is often fragmented across branches, apps, agents, partners, and legacy core systems.

Why lenders face greater consent challenges than other sectors

Consider a typical retail banking client. She might open a savings account at a branch, utilize a mobile app, secure a personal loan via a direct selling agent, and purchase insurance through a partner. Each interaction constitutes a distinct purpose under the Act, requiring its own legal basis.

Section 6 of the DPDP Act mandates that consent must be free, specific, informed, unconditional, and unambiguous, provided through a clear affirmative action and restricted to the data actually necessary. A generic "I agree" checkbox during onboarding that bundles marketing, cross-selling, and partner data sharing fails to meet this standard.

The more significant challenge is proof. Section 6(10) shifts the burden of proof onto the business. If a customer disputes agreeing to loan offers via WhatsApp, the bank must demonstrate which notice was presented, in what language, on which channel, at what time, and the specific action taken by the customer. Many institutions currently rely on a simple yes or no flag within a CRM. A flag lacks history, and history is precisely what regulators will demand.

The data driving the urgency

Scale is the primary hurdle. According to NPCI data, UPI processed 24.07 billion transactions worth ₹29.37 lakh crore in September 2026, averaging roughly 802 million daily, with each transaction involving personal data managed by a bank or payment app.

Risk is the second factor. The Reserve Bank of India's Report on Trend and Progress of Banking in India 2024-25 indicated that the value involved in bank frauds reached ₹34,771 crore, nearly triple the previous year, with card and internet frauds accounting for 66.8 per cent of incidents. In August 2026, Minister of State for Electronics and IT Jitin Prasad informed the Rajya Sabha that CERT-In identified 5,70,108 cyber incidents within the banking sector in 2025, followed by another 3,48,607 in the first half of 2026.

The DPDP Act imposes severe penalties for non-compliance. Failing to implement reasonable security safeguards to prevent a breach can result in fines up to ₹250 crore. Neglecting to notify the Data Protection Board and affected individuals of a breach can lead to penalties of up to ₹200 crore. Other infractions, such as failures regarding notice and consent, carry penalties of up to ₹50 crore.

Aligning RBI mandates with the DPDP Act

NBFCs face additional complexities. The RBI (Digital Lending) Directions, 2025, issued on 8 May 2025, mandate need-based data collection supported by prior, explicit consent and audit trails. The purpose must be clearly disclosed at every interaction, and consent must be granular, including the right to deletion. Furthermore, lending apps are prohibited from accessing files and call logs.

NBFCs are also the most frequent users of the Account Aggregator network. Sahamati data cited by Business Standard indicates that NBFCs were responsible for 60.08 per cent of Account Aggregator consents in FY25. A common misconception is that AA consent satisfies DPDP obligations. It does not. AA consent covers the sharing of financial information for a specific request, whereas DPDP consent covers all other activities, from marketing communications to sharing records with collection agencies.

Then there is the conflict that every compliance head in banking is aware of. Section 6(4) allows a customer to withdraw consent at any time, and this withdrawal process must be as straightforward as the initial consent. However, the Prevention of Money Laundering Act and RBI's KYC regulations require certain records to be retained for years after the customer relationship concludes. A consent system that automatically deletes data upon withdrawal violates one law, while one that ignores the withdrawal violates another.

How SecureCMS manages consent for financial institutions

SecureCMS was engineered to address these specific overlaps rather than functioning as a simple website cookie banner. Its primary capabilities include:

• OTP-verified consent across branches, mobile and net banking, DSAs, business correspondents, call centres, and WhatsApp
• Purpose-level records for every product, archiving the notice version and language, with notices available in English and the 22 Eighth Schedule languages
• Real-time withdrawal synchronization with core banking, loan origination, CRM, and marketing systems via APIs, webhooks, and SDKs
• A legal-hold engine that distinguishes between "stop processing" and "erase," ensuring compliance with PMLA and RBI retention mandates
• Data limiting controls for DSAs, collection agencies, and other third-party partners
• Workflows for rights requests and grievances, with escalation paths to the Data Protection Officer
• A tamper-evident audit trail that can be exported for auditors or the Data Protection Board

"Most banks we speak to are not short of consent forms. They are short of consent records," said Abhishek Singh, Co-Founder and CEO, SecureDApp. "When a customer withdraws consent in the app on a Sunday night, the question on Monday morning is whether the marketing team, the DSA and the collection agency all know. Under the DPDP Act, the bank has to prove that they did. SecureCMS was built so that answer is a report, not a week of email threads."

Himanshu Gautam, Co-Founder and CTO, SecureDApp, noted that the most significant engineering challenge was not capturing consent, but maintaining its consistency. "A large bank can have a core banking system, a loan origination system, two CRMs and dozens of partner integrations, all holding copies of the same customer. We treat every consent and withdrawal as an event that each of those systems must acknowledge, and we log the acknowledgement. If one system misses it, the compliance team sees that gap the same day."

This same DPDP consent management software is deployed across 13 industry frameworks, including fintech, insurance, stock broking, healthcare, ecommerce, SaaS, edtech, schools, telecom, HR, and startups, in addition to banks and NBFCs. Each implementation packages the specific DPDP consent management tools required by that sector, identifying where consent is necessary versus where a legal duty takes precedence.

Recommended steps for lenders ahead of May 2027

SecureDApp advises banks and NBFCs that have not yet begun their compliance journey to take these five steps:

• Map every touchpoint where customer data is collected, from branches and agents to apps and partners.
• Assign each purpose a specific legal basis, such as a KYC obligation, or obtain explicit consent.
• Revise notices so they are standalone, clearly list the data required for each purpose, and are provided in the languages customers actually read.
• Integrate consent status with all downstream systems to ensure withdrawals halt processing within hours, not weeks.
• Select ten random customers and attempt to generate their complete consent history. If this process takes more than a few minutes, the current setup is insufficient.

One frequent misunderstanding requires clarification. SecureCMS is a consent management platform, not a registered Consent Manager under Rule 4 of the DPDP Rules. Consent Managers are independent entities that will register with the Data Protection Board to act on behalf of individuals. Banks and NBFCs are not required to become Consent Managers, but they do need robust consent management for DPDP compliance within their own operations. SecureCMS is built to operate alongside registered Consent Managers as that ecosystem develops.

"May 2027 is not the date to start," Abhishek Singh added. "It is the date the Board can start asking questions. The institutions that use the next six months to fix their consent records will spend 2027 serving customers instead of answering notices."

Banks, NBFCs, and other regulated entities can explore the platform's functionality and schedule a demonstration on the SecureCMS DPDP consent management page.

About SecureDApp

SecureDApp (Vettedcode Technologies India Pvt. Ltd.) is a Bengaluru-based security technology company. Its products span smart contract security audits, real-time blockchain threat monitoring, digital signatures, enterprise HSM key management and, with SecureCMS, consent management under the DPDP Act for Indian enterprises.

The company was co-founded by Abhishek Singh and Himanshu Gautam, Co-Founder and CEO, has more than 16 years of experience in India's internet and media sectors, including senior marketing roles at Via.com, CommonFloor, Vakilsearch and Hirect India. He holds a PhD in Cybersecurity and Marketing from Alliance University and an MBA from Bangalore University, and is a certified independent director.

Himanshu Gautam, Co-Founder and CTO, is an IIT Kanpur graduate with bachelor's and master's degrees in engineering. He was a software engineering manager at Gaana and has led blockchain engineering teams in India and Singapore. He is named on patent filings covering post-quantum secure messaging, digital identity credential verification and cybersecurity threat detection, and SecureDApp's SecureX DID was a finalist at the Data Security Council of India (DSCI) Grand Challenge 2.0.