DPDP Act for Financial Advisors: The Inconvenience It Brings and How to Deal With It
The DPDP Act for financial advisors starts with a phone call like this one. Say a client rings on a Saturday. Her son has found an old folder and wants to know who holds her PAN, her Aadhaar copy and her cancelled cheque. You check. Two copies sit on a staff member's phone. A third is in a shared inbox that three people can open. Nobody wrote down who opened what, or when.
Does the DPDP Act apply to a financial advisor?
Yes, if you handle digital personal data about individuals, and KYC and investment files usually involve exactly that. Personal data collected on paper and digitised later is covered too. The main duties under the Digital Personal Data Protection Rules, 2025 apply from about 13 May 2027, unless the government shortens the period. There is no blanket exemption for small businesses, so a one-person advisory desk has duties too.
Which client files hold personal data?
Most advisory files do. Check your own folders against this list:
- PAN and Aadhaar copies used for KYC
- Bank statements and cancelled cheques
- Nominee, family and address details
- FATCA and CRS self-declarations for NRI investors
- Insurance claim papers, including medical bills
- KYC records linked with CKYC
Keeping records the law requires falls under a legitimate use without consent, under section 7. For other uses, plan a clear notice first. The KYC document list for mutual fund and insurance advisors shows which papers these usually are.
Where the inconvenience starts
The practical steps for small businesses cover the basics. These are the daily frictions that make the basics hard.
KYC photos on WhatsApp. A photo sent at nine at night is easy. The file then sits on a phone you may replace next year.
Shared logins and inboxes. Two people on one login mean no answer when a client asks who opened the file. Certain logs must be kept for at least one year, so the question has to be answerable.
Old files that never go. Keeping everything "just in case" holds more personal data than the work needs. Set a deletion date when an engagement closes, except for the records the law requires you to keep.
No notice and no route for requests. Clients can ask for access, correction and erasure under sections 11 and 12, and raise a grievance under section 13. One named person and one email address handle those. Our guide to the client consent notice has the structure for the notice itself.
A breach with no plan. Tell affected people promptly, in plain language. Tell the Board without delay, with full details within 72 hours, unless the Board allows longer. The Schedule sets a maximum of ₹250 crore for failing reasonable security safeguards. That figure is not the point. The habit is.
How the Saturday call ends well
Back to the phone call. The better version starts with one folder for the client. You open it, see the access log, and answer in five minutes. The notice was given at onboarding. The client knows where to write with a request.
Five habits make that call easy:
- One folder per client, with access only for staff who serve that client.
- A plain notice given at onboarding.
- A log of every open and download.
- A deletion date for files the law does not need you to keep.
- A breach plan with the 72-hour step written down.
Collect the KYC pack without the WhatsApp trail
Reposha, DPDP-ready document management for advisors, moves the collection off chat. You send one upload link for the full KYC pack, and each Client gets a folder. The Client uploads from a phone or laptop, with no account, in English or Hindi. Reposha logs every open and download, so the Saturday question has an answer.
When a client changes a mobile number or address, use the KYC modification documents for investors list before you ask for anything.
Is your office ready for the DPDP Act? Start at reposha.com.
Questions people ask
When do DPDP duties start for a financial advisor?
The main duties under the DPDP Rules, 2025 apply from about 13 May 2027, unless the government shortens the period.
Does the DPDP Act apply to a one-person advisory practice?
Yes. There is no blanket exemption for small businesses, so a one-person practice that handles digital personal data has duties under the Act.
What is the biggest DPDP problem for financial advisors?
Client papers spread across WhatsApp, personal email and staff phones. An advisor cannot secure, track or delete files they cannot see.
How do I collect KYC documents from clients without losing track of them?
Send one secure upload link per client. Reposha, DPDP-ready document management for advisors, gives each Client a folder and logs every open and download.
General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.
Open the demo account to see how requests, folders and the activity record look. No sign-up needed.
