India vs Global Finance Privacy
Most countries pick one style of financial-privacy oversight. India runs three at once. It also adds Account Aggregator on top.
Different countries protect financial data in different ways.
- The EU leans on one comprehensive privacy law, the GDPR.
- The US relies on sector-specific laws, like the Gramm-Leach-Bliley Act.
- Some other markets lean mainly on prudential supervision by the central bank.
India runs all three approaches at the same time:
- DPDP acts as the general privacy law.
- Sector rules from RBI, SEBI, and IRDAI sit on top of that.
- Prudential supervision runs alongside both.
So a fintech in India answers to more than one regime at once. It does not face them one after another.
Am I a Data Fiduciary?
India's finance-privacy stack starts with DPDP as the general law — use the self-check to see how DPDP applies to you before layering sector regulators on top.
Run it nowIndia also adds two features that are unusual worldwide:
- Strong data-localisation rules for payments.
- A consent-driven data-sharing system, the Account Aggregator framework. India built it for Indian finance rather than adapting it from another country.
This page summarises finance and fintech expectations for orientation. For binding rulings on your product, consult qualified counsel and the primary source below.
Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).