Indian Banks Urged to Embrace AI for Digital Data Protection Compliance

Protiviti's report recommends Indian banks adopt AI, privacy-enhancing technologies, and privacy-by-design to comply with the new Digital Personal Data Protection Act. As significant data fiduciaries, banks must align with DPDPA while integrating privacy solutions across operations to mitigate risks such as algorithmic profiling and customer consent management.

Indian banks are being urged to leverage artificial intelligence, privacy-enhancing technologies, and privacy-by-design strategies as they navigate the requirements of the Digital Personal Data Protection Act (DPDPA). Unveiled at the 4th IBA CISO Summit 2025 by the Indian Banks' Association, a report by Protiviti highlights the critical need for banks to re-engineer their operations to align with India's most comprehensive data protection legislation.

The report outlines the extensive regulatory impact of the DPDPA, emphasizing the necessity for banks to integrate privacy-by-design principles into essential functions. It provides insights for harmonizing DPDPA compliance with existing rules from the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (SEBI). Key privacy risks identified include algorithmic profiling, third-party data sharing, and the management of customer consent.

The Protiviti study further asserts that banks, due to their handling of large volumes of sensitive data, are likely to be classified as Significant Data Fiduciaries under DPDPA. This classification necessitates enhanced compliance efforts, such as conducting Data Protection Impact Assessments and ensuring algorithmic transparency. The report advises banks to adopt a risk-based, adaptive compliance model and embed AI-driven privacy solutions to enhance operational efficiency while ensuring alignment with regulatory advancements.

(With inputs from agencies.)