The Digital Personal Data Protection Act (DPDPA) 2023 has significant implications for portfolio managers handling investor data. This article explains the compliance requirements.
What is DPDPA?
Definition
The Digital Personal Data Protection Act, 2023 (DPDPA) aims to safeguard individual privacy while ensuring accountability for organizations processing personal data.
Purpose
The DPDPA sets forth key obligations that will affect the operational process of financial institutions related to collection, storage, processing, transfer, deletion and disposal of personal data.
Key Obligations
Data Protection
Portfolio managers must:
- Protect personal data in their possession or control
- Maintain reasonable security standards to prevent breach
- Ensure confidentiality of client information
Consent Management
Under the DPDPA, the consent manager concept provides tools for users to manage and revoke consent efficiently.
Breach Reporting
Portfolio managers must:
- Report data breaches to the Data Protection Board and the Data Principal
- Take appropriate action in case of breach
Impact on Portfolio Managers
Data Handling Practices
The DPDPA will affect how capital markets handle customer data, requiring:
- Greater transparency
- Enhanced security measures
- Specific consent management processes
Compliance Costs
The DPDPA may introduce new compliance requirements and costs for capital market intermediaries.
Interaction with Existing Laws
Compliance with RBI, SEBI, or IRDAI frameworks does not automatically ensure DPDPA compliance. Organizations must map and align both regulatory obligations — particularly around consent management, retention, and breach reporting.
Key Requirements for Portfolio Managers
Data Collection
Portfolio managers must:
- Collect only necessary personal data
- Obtain explicit consent for data collection
- Inform data principals about data use
Data Storage
Portfolio managers must:
- Store personal data securely
- Implement appropriate security measures
- Limit access to personal data
Data Processing
Portfolio managers must:
- Process data only for specified purposes
- Ensure data accuracy
- Maintain data quality
Data Transfer
Portfolio managers must:
- Ensure data is not transferred outside India without appropriate safeguards
- Comply with data localisation requirements
Data Retention
Portfolio managers must:
- Retain data only for as long as necessary
- Dispose of data securely when no longer needed
Compliance Considerations
DPDPA Awareness
APMI has conducted introductory sessions to help portfolio managers understand the implications of the Act for PMS operations.
Mapping Obligations
Portfolio managers must map and align both regulatory obligations — particularly around consent management, retention, and breach reporting.
Implementation
Portfolio managers must:
- Implement compliant data protection practices
- Train staff on DPDPA requirements
- Update policies and procedures
Consequences of Non-Compliance
Penalties
Non-compliance with the DPDPA would lead to severe penalties which can hinder the entity's reputation and its financial standing.
Regulatory Action
Non-compliance can result in action by the Data Protection Board.
Reputational Damage
Data breaches and non-compliance can cause significant reputational damage.
Expert Legal Guidance
Anuj Desai & Associates provides expert legal advisory services on DPDPA compliance for portfolio managers. Our securities law experts help clients implement compliant data protection practices, manage consent, and ensure regulatory compliance. Contact us for guidance on DPDPA and other regulatory matters.