Document Overlap
7.9%
← Content Overlap Report
A-063
→
First documentRBI vs DPDP: Erasure When KYC Retention Still AppliesOpen original ↗
A-042
Second documentHandling Legacy Data Collected Before DPDP: A Board-Level PlanOpen original ↗
Low overlap
Top paragraph overlap
35.1%Page comparison
Paragraph matches
Strongest non-zero match for each paragraph.
First paragraph231 words
Common questions about erasure when KYC retention still applies
From a DPDP perspective, using processors or cross-border infrastructure does not dilute your obligation to honour erasure requests or to retain data where the law requires it. Contracts with processors and cloud vendors should require them to support your retention schedules and erasure workflows, including the ability to delete, archive, or restrict data on your instructions and to provide evidence of those actions. Where data is transferred outside India, you also need to account for any government notifications that restrict transfers to particular jurisdictions, but the basic logic remains the same: for data that can be erased, your processors must execute deletions end-to-end; for data that must be retained under RBI, PMLA, or other laws, they must preserve it securely for the required period and not repurpose it beyond your documented instructions. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) - Ministry of Law and Justice, Government of India (Gazette of India) Digital Personal Data Protection Rules (2025) – PwC India overview - PwC India FAQs – The Digital Personal Data Protection Act, 2023 - Cyril Amarchand Mangaldas Record Maintenance Policy of the Bank (Updated up to Dec-2022) - Central Bank of India Unravelling the Importance of the DPDP Act for the BFSI Sector - CyberNX Frequently Asked Questions: Digital Personal Data Protection Framework – Notice Management - Data Security Council of India (DSCI) Digital Anumati – DPDP Act Consent Management Solution - Digital Anumati
35.1%
Second paragraph300 words
Executive checklist and common questions on DPDP legacy data
DPDP sits alongside, not above, sectoral and general laws that impose record-keeping duties. If RBI, SEBI, IRDAI, TRAI, or tax statutes require you to retain certain records for a defined number of years, you generally must continue to hold that data even if a Data Principal withdraws consent or asks for erasure, to the extent necessary to meet those legal obligations. Under DPDP, this can operate as a lawful basis under the category of compliance with law or legitimate uses. However, that does not give you a free licence to use the same data for unrelated purposes, such as marketing or broad profiling, once consent is withdrawn or the original purpose has been served. The practical approach is to build and maintain a retention schedule that clearly maps each category of data to its governing laws and minimum retention periods, ensure that fields kept solely for statutory purposes are segregated and access-controlled, and delete or anonymise non-essential fields when they are no longer needed. Where sectoral regulators issue their own privacy or cyber guidelines, align your legacy data programme with those expectations as well, so that you can show both the Data Protection Board and your primary regulator that you have reconciled the two regimes in a thoughtful, documented way. [2] Digital Personal Data Protection Act, 2023 - Ministry of Electronics and Information Technology, Government of India DPDP Rules, 2025 Notified – A Citizen-Centric Framework for Privacy Protection and Responsible Data Use - Press Information Bureau, Government of India Decrypting India’s New Data Protection Law: Key Insights and Lessons Learned - Bird & Bird Top 10 operational impacts of India’s DPDPA – Individual rights - International Association of Privacy Professionals (IAPP) Summary of DSCI’s submission to MeitY on Draft Digital Personal Data Protection Rules, 2025 - Data Security Council of India
First paragraph54 words
Executive checklist and cost of delaying an erasure-ready KYC strategy
Are our privacy notices, KYC forms, and offboarding screens explicit about which data cannot be deleted due to RBI, PMLA, tax, or other legal obligations, and which data will be erased or minimised? Can we, within a short timeframe, demonstrate to internal audit how the last few erasure requests were handled end-to-end?
31.1%
Second paragraph47 words
Executive checklist and common questions on DPDP legacy data
Have we agreed which classes of data we will not attempt to re-use because reaching Data Principals is impractical, and instead plan to anonymise or retire them? Can we respond to a representative set of access and erasure requests across legacy systems within the statutory timelines?
First paragraph146 words
Common questions about erasure when KYC retention still applies
Clarity early in the relationship is more effective than defensive explanations at offboarding. Privacy notices, account-opening forms, and digital consent flows should state in plain language that certain records—such as KYC documents and transaction histories—must be retained for specific periods to comply with RBI, PMLA, tax, and other laws, and will only be used for those regulatory and dispute-resolution purposes once the relationship ends. At the same time, they should make clear that marketing and optional analytics uses are subject to consent and can be withdrawn. When responding to a concrete erasure request, explain which categories of data you have deleted or minimised and which you are required to keep, referencing the underlying legal obligations rather than generic ‘policy’. Customers are more likely to accept limits when they can see that you are applying a consistent, law-based rule rather than improvising.
30.1%
Second paragraph300 words
Executive checklist and common questions on DPDP legacy data
DPDP sits alongside, not above, sectoral and general laws that impose record-keeping duties. If RBI, SEBI, IRDAI, TRAI, or tax statutes require you to retain certain records for a defined number of years, you generally must continue to hold that data even if a Data Principal withdraws consent or asks for erasure, to the extent necessary to meet those legal obligations. Under DPDP, this can operate as a lawful basis under the category of compliance with law or legitimate uses. However, that does not give you a free licence to use the same data for unrelated purposes, such as marketing or broad profiling, once consent is withdrawn or the original purpose has been served. The practical approach is to build and maintain a retention schedule that clearly maps each category of data to its governing laws and minimum retention periods, ensure that fields kept solely for statutory purposes are segregated and access-controlled, and delete or anonymise non-essential fields when they are no longer needed. Where sectoral regulators issue their own privacy or cyber guidelines, align your legacy data programme with those expectations as well, so that you can show both the Data Protection Board and your primary regulator that you have reconciled the two regimes in a thoughtful, documented way. [2] Digital Personal Data Protection Act, 2023 - Ministry of Electronics and Information Technology, Government of India DPDP Rules, 2025 Notified – A Citizen-Centric Framework for Privacy Protection and Responsible Data Use - Press Information Bureau, Government of India Decrypting India’s New Data Protection Law: Key Insights and Lessons Learned - Bird & Bird Top 10 operational impacts of India’s DPDPA – Individual rights - International Association of Privacy Professionals (IAPP) Summary of DSCI’s submission to MeitY on Draft Digital Personal Data Protection Rules, 2025 - Data Security Council of India