Digital Personal Data Protection Act, 2023 (DPDPA) Compliance for AIF Investor Data

Most AIF Managers have spent years building SEBI compliance muscle and almost none building data protection muscle — and the Digital Personal Data Protection Act, 2023 is about to test that gap directly. Here's what changes for a fund manager sitting on investor KYC files, PAN details, and bank information.

Why AIF Managers Are Squarely in Scope

An AIF Manager processes exactly the kind of personal data the DPDPA is built around — investor names, PAN, Aadhaar-linked KYC records, bank account details, contact information, and in many cases sensitive financial history gathered during onboarding and ongoing AML checks. Under the Act, the Manager entity is a Data Fiduciary in relation to this investor data, and every accredited investor, HNI, or family office LP whose data it holds is a Data Principal with statutory rights over that data. This isn't an adjacent compliance obligation sitting next to SEBI's framework — it runs concurrently with it, and the two regimes don't always sit comfortably together (SEBI's own record-retention mandates, for instance, can pull in a different direction from a Data Principal's erasure request).

Consent Architecture for Investor Onboarding

The Act requires clear, specific, informed consent obtained before or at the time personal data is collected, through a notice in plain language covering what data is collected, for what purpose, and for how long it will be retained. For AIF onboarding, this means the existing KYC and subscription agreement paperwork likely needs an explicit DPDPA-compliant consent layer added — not assumed to be covered by the general "consents to processing" boilerplate many subscription agreements already carry, which typically predates the Act and won't meet its specificity requirements.

The Retention-vs-Erasure Tension

This is where AIF Managers face a genuinely awkward overlap. SEBI's AIF framework and anti-money-laundering rules require investor records to be retained for extended periods after an investor exits a fund. The DPDPA, on the other hand, gives Data Principals a right to request erasure of their personal data once the purpose for which it was collected is no longer being served. The resolution isn't to pick one regime over the other — it's to document, in the Manager's data retention policy, exactly which retention obligation under SEBI/PMLA law overrides the erasure right for each data category, so that a refusal to erase is backed by a specific statutory retention requirement rather than a generic "we need to keep this" justification.

Significant Data Fiduciary Status — A Threshold Worth Watching

The Act allows the Central Government to notify certain Data Fiduciaries as Significant Data Fiduciaries, based on factors including volume and sensitivity of data processed, risk to Data Principal rights, and potential impact on India's sovereignty and electoral democracy — triggering additional obligations like a Data Protection Officer, periodic data audits, and Data Protection Impact Assessments. Large multi-scheme AIF Managers or those with a substantial NRI/foreign investor base should watch this designation closely rather than assume it only applies to big tech platforms.

Cross-Border Data Transfer for NRI and Foreign LPs

AIFs routinely onboard NRI and foreign investors, meaning investor data frequently needs to move across borders — to overseas custodians, co-investment vehicles, or the investor's own jurisdiction for tax reporting. The DPDPA's cross-border transfer provisions (transfers permitted except to countries specifically restricted by government notification) need to be built into the Manager's data-sharing agreements with offshore administrators and custodians, rather than handled as an afterthought once a transfer is already underway.

Breach Notification and Vendor Risk

Fund administrators, RTAs, and custodians handling investor data on the Manager's behalf are processors, not fiduciaries — but the Manager remains accountable for how they handle that data. Data processing agreements with these vendors need updating to reflect DPDPA breach-notification timelines and security standards, since a breach at the RTA's end is still the Manager's regulatory problem to manage.

Building the DPDPA Layer Now, Not After the Rules Bite

DPDPA compliance for an AIF Manager isn't a document exercise — it requires mapping exactly what investor data is held, where it sits, who has access, and which retention rule wins when SEBI and the DPDPA pull in different directions. We help fund managers build this mapping and the underlying consent and retention documentation before a Data Principal complaint or a SEBI inspection forces the issue.

This article is for general informational purposes and does not constitute data protection or regulatory advice specific to any fund manager's circumstances. Readers should verify the current implementation status of DPDPA rules before relying on specific compliance timelines.