Select Your Location
Financial Sector stores sensitive and personal data of individuals. Data Protection in financial sector is necessary to mitigate the risk of privacy violations. Since the data is personal and sensitive, privacy violations should not be taken lightly as it adversely affects the individual whose data is breached. The manner in which data breach can take place in the financial sector include: sharing information with third parties without the prior consent of the individual, collecting more information than what is necessary, incorrect recording of personal information, leakage/loss of an individual’s information due to improper security measures.
At present, Data Protection in Financial Sector in India is not codified like the European Union which sets out the standards of data protection to be maintained by individuals and entities. The Personal Data Protection Bill, 2019 was introduced in the lower house of the Parliament however, it was not enactment. This Bill if enacted would have established data protection laws in India. The Information Technology Act, 2000 (“IT Act”) and the rules framed thereunder are applicable for data protection relating to some sensitive data and personal information. Apart from the IT Act, there is some sector-specific regulation that intends to maintain the secrecy and confidentiality of data.
Table of Contents
In India, Data Protection in Financial Sector is governed by the IT Act along with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (IT (SPDI) Rules). The IT (SPDI) Rules prescribe the obligations of the data collectors who collect and process personal or sensitive data of data subjects who are individuals who provide their personal data. As per the IT (SPDI) Rules, personal information means data relating to an individual which is capable of identifying the individual and which either directly or indirectly combines with other data available or likely to be available with the data collector. Data Protection in Financial Sector under the IT (SPDI) Rules include financial data such as bank account details, debit and credit card details or details relating to any other payment instrument. Apart from the financial data, the IT (SPDI) Rules also cover passwords, biometric information, physical, physiological and mental health conditions, and medical records which might be collected by the data collectors in the financial industry. When it comes to receiving and handling sensitive personal data, section 43-A of the IT Act holds data collectors responsible for any negligence in implementing and maintaining reasonable security. In furtherance to this, if any wrongful loss or wrongful gain arises to any person due to the negligence of the data collector then the data collector shall be liable to pay damages to the person(s) affected. In addition, section 72-A of the IT Act provides punishment for disclosure of data that either leads to a breach of lawful contract or was disclosed without the consent of the data subject.
Apart from the IT Act and rules, data protection in financial sector is also dealt with by certain banking secrecy and other regulatory laws. These laws lay down the obligations of the data collectors to maintain the secrecy and confidentiality of data. These laws have been discussed in brief below:
RBI issues guidelines relating to data protection in financial sector from time to time which shall be adhered to by the data collectors. One such direction issued by the RBI requires all banks and payment system providers to localize payment transactions in India and to restrict the storage of personal data outside of India. RBI has also laid down directions to safeguard customer information and the type of arrangement banks and non-banking financial companies should have with third parties.
The RBI has adopted the Basel norms by the Basel Committee on Banking Supervision. It issued the Master Circular on Basel III Capital Regulation, 2015 which sets out the applicability of Basel norms in India. The Master circular lays down various provisions on data adequacy and quality concerning the collection of information for internal assessment and risk management. Master Circular on Customer Service in Banks, 2015 was issued by the RBI obligating the banks to maintain secrecy about information arising out of the contractual relationship between the bank and the customer and that no information should be disclosed to third parties except under the prescribed circumstances. The RBI also introduced the Cyber Security Framework in Banks, 2016 which intends to enhance the resilience of the Indian Banking System by improving the mechanism adopted by the banks while addressing and managing cyber risks. Similarly, for NBFCs the RBI has issued the Master Direction on Information Technology Framework for the NBFC Sector, 2017 which focuses on IT governance, IT Policy, information and cybersecurity, IT operations, information security audits, IT services outsourcing, and business continuity planning.
This Act obligates insurance providers to maintain the confidentiality of policy holder’s information and to have adequate security measures in place. It also obligates the insurance providers to ensure that any disclosure to a third party for services outsourced to such third parties is subject to the data privacy standards and policies of such insurance providers. Only legally permitted disclosures to statutory authorities are allowed to be made by the Insurance providers under the Act. Certain additional requirements are imposed by the IRDAI to ensure confidentiality. They are mainly in the form of regulations issued by the IRDAI like the IRDAI (Maintenance of Insurance Records) Regulations, 2015 which ensures that the records are stored with the necessary security and exclusively in India. The IRDAI (Protection of Policyholder’s Interest) Regulations, 2017 ensures the maintenance of total confidentiality of policy holder’s information except when it becomes necessary to disclose the information to statutory authorities due to the operation of any law. Further, the IRDAI (Outsourcing of Activities by Indian Insurers) Regulations, 2017 require the insurers to ensure that their outsourcing service providers maintain confidentiality in policy holder’s data and have adequate security policies to ensure such confidentiality and it also ensures that in case the outsourcing agreement is terminated, the customer data is retrieved and not used by the outsourcing service provider.
This Act prescribes the data protection requirements relating to bookkeeping and maintenance of information relating to transactions. Further, the income tax authorities are entitled to seek disclosure of certain personal information which shall be disclosed in accordance with the provisions of the IT Act or the IT (SPDI) Rules.
This Act allows regulatory and investigating authorities to seek disclosure of certain data subject to the provisions of the IT Act and IT (SPDI) Rules.
This Act prohibits public financial institutions from disclosing or sharing any information relating to the affairs of the clients.
This Act along with the associated regulations contain principles of privacy regulating the collection, retention and security of customer data.
This Act prescribes the manner in which credit information companies should handle data. It sets out obligations of credit information companies concerning access to data, fidelity and secrecy of data, collection of data of limited purposes, norms for disclosure, and obligation to maintain confidentiality and accuracy. Further, the regulatory authority under the Act is empowered to lay down standards for data retention from time to time.
Under this Act, the officers of banks are prohibited from disclosing bank records to anyone except when specifically ordered by a court of law for a reason.
This Act regulates the payment services such as debit and credit card transactions, smart card operations, money transfer operations or any other similar operations. It ensures the confidentiality of documents or any other data obtained from participants in the payment system other than where the court has passed orders. The RBI has issued a Circular on Storage of Payment Data, 2018 requiring all payment system providers to store the data in India and the transactions should be end-to-end encrypted and processed as a part of payment instructions. Only where the transaction involves a foreign leg, the data may if required, be stored in the foreign country. The RBI has also introduced the Framework for Outsourcing of Payment and Settlement Related Activities by Payment System Operators, 2021 which obliges the payment system operators to outsource their activities like that of banks.
The data management and data protection in financial sector across various industries are subject to IT (SPDI) Rules. The IT Act and the IT (SPDI) Rules require a data collector to obtain prior written or electronic consent from the data subject for the collection of information. As per the IT (SPDI) Rules, the collection of information is to be done after providing the following information to the data subject:
Further, the data collectors must allow the data subjects to not disclose or withdraw consent to the disclosure of or retention of sensitive personal data by the data collectors at any time in writing.
Banks, financial institutions or any other institution in the financial sector that is a data collector is obliged to publish their privacy policies on their website specifying the following:
Data protection in financial sector has always been important. However, with the advancement in technology, rise in complexity in transactions and involvement of intermediaries in transactions, it has become easier for data and information to be breached. Thereby increasing the need for data protection law. In India, though there are several laws regulating data protection in financial sector but India still lacks a codified data protection law like the EU General Data Protection Rules which gives high regard to the consent of an individual for the collection of data and expressly prescribes rights and obligations of various parties.
Also Read:Data Protection and Offshore BankingData Protection in the Banking Industry
Ankita is an Advocate and has joined Enterslice as a Legal Researcher. Her work focuses on General Civil and Commercial laws, Corporate Taxation Laws, Labour and Employment Laws and Dispute Resolution. She is a law graduate from School of Law, University of Petroleum and Energy Studies. Prior to joining Enterslice, Ankita has the experience of practicing law in Delhi and Odisha.
In the recent past, India has seen burgeoning demand for internet and smartphones. The rapid ri...
The Securities and Exchange Board of India (SEBI), the capital markets regulator, has recommend...
The objective of the enactment of the Prevention of Money-laundering Act, 2002, i.e. PMLA (the...
Tax planning is a continuing effort and a management strategy for ensuring the minimization of...
On 18th May 2023, the Securities Exchange Board of India (SEBI) released a Consultation Paper o...
Infrastructure and real estate have been regarded as India's "sunshine sector" since the turn o...
On 22nd May 2023, the Central Board of Direct Taxes (CBDT) issued a new circular under secti...
Anyone can have different sources of income. With globalization and the opening up of economies...
The Reserve Bank of India (RBI) is crucial in regulating NBFC, including branch openings and cl...
In India, Non-Banking Financial Companies are subject to certain restrictions from taking publi...
Are you human?: 8 + 5 =
Easy Payment Options Available No Spam. No Sharing. 100% Confidentiality
The Digital Personal Data Protection Bill 2022 is a vital step towards protecting the privacy and personal data of...
07 Mar, 2023
The technological advancement of the securities market has increased the need for robust cyber security and cyber r...
13 May, 2023
Red Herring Top 100 Asia enlists outstanding entrepreneurs and promising companies. It selects the award winners from approximately 2000 privately financed companies each year in the Asia. Since 1996, Red Herring has kept tabs on these up-and-comers. Red Herring editors were among the first to recognize that companies such as Google, Facebook, Kakao, Alibaba, Twitter, Rakuten, Salesforce.com, Xiaomi and YouTube would change the way we live and work.
Researchers have found out that organization using new technologies in their accounting and tax have better productivity as compared to those using the traditional methods. Complying with the recent technological trends in the accounting industry, Enterslice was formed to focus on the emerging start up companies and bring innovation in their traditional Chartered Accountants & Legal profession services, disrupt traditional Chartered Accountants practice mechanism & Lawyers.
Stay updated with all the latest legal updates. Just enter your email address and subscribe for free!
Chat on Whatsapp
Hey I'm Suman. Let's Talk!