DPDP Act for SEBI Research Analysts and Investment Advisers

The DPDP Act 2023 and the DPDP Rules notified on 13 November 2025 make SEBI research analysts and investment advisers responsible for the personal data they hold on clients. Most duties apply about 18 months after notification, around May 2027, so now is the time to prepare.

Book a demo

See pricing

Last updated: 29 October 2026

The Digital Personal Data Protection (DPDP) Act 2023 applies to every SEBI research analyst and investment adviser that collects clients' personal data digitally: PAN, Aadhaar-based KYC, contact details, bank details and risk profiles. Under the DPDP Rules notified on 13 November 2025, most obligations come into force 18 months later, around May 2027. Records you keep for SEBI, such as client records kept for the required period, sit alongside the new duties rather than against them.

This guide explains when the rules apply, what an RA or IA has to do, how DPDP fits with SEBI's five-year record keeping, and what to prepare. It is a summary, not legal advice; check the Act, the Rules and any later notifications with your adviser.

When does the DPDP Act apply to RAs and IAs?

The Act and Rules come into force in stages from 13 November 2025, the date on the gazette notification.

Stage	When	What comes into force
On notification	13 November 2025	The Data Protection Board and its procedures
After 1 year	Around November 2026	Registration of Consent Managers
After 18 months	Around May 2027	Most Data Fiduciary duties: notice, consent, security, breach notification, retention, rights, and penalties

So as of October 2026 the core duties and penalties are not yet enforceable, but 18 months is not long to change onboarding, contracts and data handling. Watch for amendments to the timeline.

Is a research analyst a Data Fiduciary?

Yes. A Data Fiduciary decides why and how personal data is processed. An RA or IA collecting KYC, consent and payment details from clients is one, whether it is an individual or a firm.

Your vendors are Data Processors

Your CRM, e-sign provider, payment gateway and messaging tools process data on your behalf. You stay responsible for them and may use them only under a valid contract.

Significant Data Fiduciary

The government designates Significant Data Fiduciaries, which carry extra duties such as a Data Protection Officer and data audits. A small RA or IA practice is unlikely to be designated.

What does the DPDP Act require from an RA or IA?

Clear notice

Give clients a standalone notice in plain language that lists the personal data you collect and the specific purpose for each, with how to withdraw consent, exercise their rights and complain to the Board.

Consent you can withdraw

Withdrawing consent must be as easy as giving it. Consent Managers, registered with the Board, can also handle consent for clients.

Security safeguards

Rule 6 sets a minimum: encryption, masking or tokenisation; access controls; logs and monitoring; backups; and security clauses in contracts with processors.

Breach notification

Tell affected clients without delay what happened and what they can do, and inform the Board without delay, followed by a detailed report within 72 hours.

Retention and erasure

Erase personal data when consent is withdrawn or the purpose is served, unless another law requires you to keep it. Keep processing logs for at least one year.

Client rights

Clients can ask for a summary of their data, correction, erasure, grievance redressal and a nominee. The Rules set a maximum of 90 days for responses.

A contact point

Publish the contact details of a person who can answer questions about how you process personal data, on your website or app.

Children's data

Data of anyone under 18 needs verifiable parental consent. This rarely affects RA or IA clients, but check your onboarding age rules.

How does DPDP fit with SEBI's five-year record keeping?

The Act's duty to erase data does not apply where retention is necessary to comply with another law. SEBI's regulations require RAs and IAs to keep records for at least five years, so those records stay; the Act's own example is a bank keeping KYC records for the period banking law requires.

Data	SEBI requirement	DPDP position
KYC, agreements and consent	Keep for at least five years	Keep, under the legal-retention exception
Recommendations, rationale and reports	Keep for at least five years	Keep, under the legal-retention exception
Leads who never became clients	No SEBI record duty in most cases	Erase when the purpose is served or consent is withdrawn
Marketing lists	None	Use only with consent, and erase on withdrawal

See research analyst record keeping for what SEBI expects you to keep.

What are the penalties under the DPDP Act?

Breach	Maximum penalty
Failing to take reasonable security safeguards	₹250 crore
Failing to notify a personal data breach	₹200 crore
Breaching duties on children's data	₹200 crore
Breaching duties of a Significant Data Fiduciary	₹150 crore
Any other breach of the Act or Rules	₹50 crore

The Data Protection Board decides penalties, and appeals go to TDSAT. Penalty provisions come into force with the 18-month stage.

Does SEBI's cybersecurity framework apply as well?

SEBI's clarifications of 30 April 2025 on its Cybersecurity and Cyber Resilience Framework (CSCRF) exempt RAs and IAs that are not registered with SEBI in any other capacity. If you hold another SEBI registration, check which CSCRF category applies. We haven't found SEBI guidance specifically on DPDP for RAs and IAs, so the DPDP Rules are the main reference.

What should you prepare before May 2027?

Map the personal data you hold: where it comes from, where it is stored, and which vendors touch it.
Write a plain-language notice for onboarding and your website, with a way to withdraw consent.
Review contracts with your CRM, e-sign, payment and messaging vendors for security and deletion clauses.
Set access by role so staff see only the client data they need.
Write a breach response plan that can meet the 72-hour report.
Separate data you must keep for SEBI from data you can erase, such as cold leads.
Publish a contact for data questions, and a way to handle requests within 90 days.

Keep client data organised and access controlled

Finuro keeps onboarding documents, consent and recommendations against each client, with role-based access for your team and an audit trail of who changed what and when. That makes it easier to see what you hold and who can reach it. Your DPDP obligations stay with you as the Data Fiduciary, so review your setup with your adviser.

Related Finuro features

Record retention: keeping SEBI records for the required period
Consent records: what each client agreed to, and when
Roles and permissions: access only to what each person needs
Audit trail: a record of every change

Frequently asked questions

Answers to common questions on this topic.

Does the DPDP Act apply to SEBI research analysts?

Yes. An RA or IA that collects clients' personal data digitally, such as KYC, PAN, contact and bank details, is a Data Fiduciary under the Act.

When do DPDP obligations start?

The DPDP Rules were notified on 13 November 2025. Most Data Fiduciary duties and the penalties come into force 18 months later, around May 2027.

Do I have to delete client data if a client asks?

Not records you must keep under another law. SEBI requires RAs and IAs to keep records for at least five years, and the Act's erasure duty doesn't override that. Data you don't need to keep, such as marketing lists, should be erased on request.

How quickly must I report a data breach?

Inform affected clients and the Data Protection Board without delay, and send the Board a detailed report within 72 hours, unless the Board extends the time.

What are the DPDP penalties?

Up to ₹250 crore for failing to take security safeguards, up to ₹200 crore for failing to report a breach, and up to ₹50 crore for other breaches, decided by the Data Protection Board.

Built for SEBI RAs and IAs

Keep client records organised and secure

Onboarding, consent, records and role-based access for SEBI RAs and IAs in one platform.