DPDP for Fintech

Example: a customer turns off offers

1. Use a test account to turn off promotional messages in your app.
2. Check that your customer database and each message tool save the change.
3. Check messages already scheduled to send. If an update fails, ask someone to fix it and test again.
4. Review account messages, such as payment alerts, separately with your legal team.

What else should your team check?

• For a new customer, list each detail you collect and why you need it. Include identity checks, often called KYC.
• List which apps and suppliers receive those details.
• Keep a copy of the privacy notice and the choices each customer made.
• Ask legal which records must be kept and when other records should be deleted. Include files saved outside the main app.
• Try the fintech self-check with the people who run these tasks.

These are suggested checks. Read the DPDP Act and its start dates alongside the rules for your business.

What to bring to a review

Get help with the fixes

• Agree which apps and records MBS will check before the assessment starts.
• Give each fix a person responsible and a date. Keep the results so the team can check the work.
• Before work starts, agree who will do each task and which banks or suppliers need to help.
• See how we help with the fixes and what each stage includes.

Common questions

What should we bring to an assessment?

Bring a list of apps and suppliers, your privacy notices, sample customer choices and rules for deleting old records. Include the staff who use these systems.

Which tools should we include in the test?

Include the app, customer database, message providers and any supplier that sends offers for you. Ask each team to show the saved result.

How long does the work take?

MBS starts with a four-week gap assessment to find what needs fixing. The agreed fixes take two to three months. A final assessment checks the completed work.