DPDPA, CERT-In and RBI: Navigating India’s Overlapping Data Rules in 2026

The DPDP Act is a horizontal law. It applies to everyone who processes digital personal data in India. It does not replace the sectoral rules that already apply to banks, insurers, telecom companies and listed entities. Section 38 says the Act is in addition to, not in derogation of, other laws, and that where there is a conflict, the DPDP Act prevails to the extent of the conflict.

In 2026, with RBI and other regulators also issuing fresh data-governance guidance, regulated businesses are planning for several regimes at once.

Breach reporting: three clocks

Regime	Who you tell	When
CERT-In Directions (April 2022)	CERT-In	Within 6 hours of noticing a reportable cyber incident
DPDP Act s.8(6) + Rule 7 (from May 2027)	Data Protection Board and each affected Data Principal	Board: intimation without delay, then a detailed report within 72 hours. Individuals: without delay
Sectoral (e.g. RBI, SEBI, IRDAI)	Your regulator	As set out in the relevant cyber-security framework

These duties are cumulative. Filing with CERT-In does not satisfy the DPDPA, and the DPDPA covers every personal data breach, not just the incident types that CERT-In lists. Read the 72-hour breach playbook for the DPDPA steps.

Design tip: run a single incident-triage process that, within the first hour, asks three questions. Is this a CERT-In reportable incident? Is personal data involved? Does a sectoral obligation apply? Each "yes" opens a filing track with its own deadline and owner.

Retention versus erasure

The DPDPA requires erasure once the purpose is served (Section 8(7)), unless retention is necessary for compliance with any law. That exception matters:

• RBI KYC and PMLA rules require transaction and KYC records to be kept for set periods after the relationship ends.
• CERT-In requires ICT system logs to be kept for 180 days in India.
• DPDP Rule 8(3) itself requires certain personal data, traffic data and logs to be retained for at least one year.

An erasure request does not override a statutory retention duty. Your retention schedule should map each data category to its longest applicable legal requirement, and then erase it promptly when that period ends.

Localisation and cross-border transfers

The DPDPA uses a negative-list model: transfers are allowed except to countries the government restricts (Section 16, Rule 15). Section 16(2) preserves stricter sectoral rules. RBI's 2018 payment-data storage directive still requires payment-system data to be stored only in India, whatever the DPDPA allows. See cross-border transfers under DPDPA.

Consent

Sectoral consent requirements, for example for credit information or Account Aggregator flows, sit alongside DPDPA consent. Where both apply, the stricter or more specific standard governs your user experience. In practice that usually means the DPDPA standard (free, specific, informed, unconditional, unambiguous, clear affirmative action) plus any sector-specific disclosures.

One control set, many regulators

The efficient approach is to map controls once and tag each one with every regulation it satisfies, so one piece of evidence can answer several auditors. Data Adhikaar's agents do this by default. Vidhi tracks updates from MeitY, CERT-In, RBI and SEBI, and Suraksha runs parallel breach-filing tracks with separate deadlines. See our BFSI and fintech pages.

Position as of 15 October 2026. Sectoral requirements change frequently, so confirm current circulars with your regulator. Not legal advice.