Data Sharing with Partners
The moment you share customer data with a partner, regulators treat that partner as an extension of you. Its conduct becomes your responsibility.
Say your financial services business shares customer data with a partner. Regulators then treat that partner as an extension of your business. So the partner's conduct becomes your problem, too.
The contract expectations below were written against RBI's pre-consolidation outsourcing circulars. On 28 November 2025, RBI withdrew those circulars. RBI then consolidated them into entity-specific Master Directions. For NBFCs, this is the Reserve Bank of India (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025. Parallel Directions apply to commercial banks and All India Financial Institutions. The transition deadline for existing IT outsourcing agreements was renewal, or 10 April 2026, whichever came first. That deadline has passed. So those Directions now apply in full. We are re-checking each statement on this page against them. Until that check is recorded, treat this page as orientation only.
That is why the RBI outsourcing framework expects a written contract. The contract must set out three things:
- Exactly which data fields you are sharing.
- Exactly which purposes each field is shared for.
- What happens to the data when the relationship ends.
A vague master services agreement is not enough.
Am I a Data Fiduciary?
Partner-sharing arrangements in finance sit on top of your DPDP obligations to the user. Run the self-check to confirm your role before you draft partner terms.
Run it nowThe deletion plan matters as much as the sharing plan. When the partnership ends, you must remove customer data from the partner's systems in a defined way. Plan this wind-down at the point of signing, so the data does not linger for years inside their tools.
This page summarises finance and fintech expectations for orientation. For binding rulings on your product, consult qualified counsel and the primary source below.
RBI/DOR/2025-26/363, DOR.ORG.REC.No.282/21-04-158/2025-26. Effective 28 November 2025. Existing IT outsourcing agreements had to comply at renewal or by 10 April 2026, whichever was earlier. That deadline has passed, so the Directions apply in full to existing arrangements. The claims on this page have not yet been re-checked against this instrument.
RBI — pre-consolidation outsourcing circulars
Formerly at rbi.org.in NotificationUser.aspx?Id=12086. Withdrawn on 28 November 2025 — the source this page's contract expectations were originally written against.
Status unverified — no status check recorded. Replaced by Entity-specific outsourcing Directions issued on 28 November 2025 (NBFCs; Commercial Banks; All India Financial Institutions)