DPDPA Compliance for MFDs in India

Yes. The Act draws no line by turnover, AUM or headcount — if you determine the purpose and means of processing personal data, you are a Data Fiduciary, and a solo distributor working from a laptop is squarely inside it. What differs is scale of effort, not scope of duty. Your baseline obligations are: a clear notice at collection, a lawful ground for each purpose, purpose limitation, accuracy, reasonable security safeguards, erasure once the purpose ends, breach notification, and a published grievance channel with a named contact and a response timeline. On the lawful ground, Section 6 consent is your default — itemised by purpose, plain language, in English or any Eighth Schedule language, and as easy to withdraw as to give. Section 7(a) gives you some room where a client voluntarily hands over data for a specified purpose and hasn't indicated otherwise, but it is tied tightly to that purpose. It does not stretch to cross-selling insurance, PMS or AIFs, to broadcast marketing, or to passing a client's details to another distributor or an NBFC partner. Those need separate consent. Note also that DPDPA has no "sensitive personal data" tier — PAN, bank details and a phone number sit under one legal standard.

Split it into three buckets. The AMC and the RTA are Data Fiduciaries in their own right for the folio — they hold the investment relationship, have their own lawful ground and their own retention duties, and they are not your processors. You do not carry their liability, and they do not carry yours. Your own bucket is everything in your practice: the CRM, the reporting and portfolio-tracking software, the goal-planning tool, the WhatsApp business account, the Google Sheet of prospects, the KYC scans in your Downloads folder. There, your software vendor and cloud host are Data Processors — they may process client data only under a valid written contract specifying purpose, security obligations, sub-processing limits and deletion on exit. Most MFD tech is signed up on a click-through plan with no such contract, which is a straightforward gap to close. Liability for a processor's failure stays with you and cannot be contracted away. The third bucket is people you bring in: sub-distributors under your ARN, referral partners, your operations assistant, a part-time telecaller. Their access is your processing.

Two separate questions. On notice: Section 5(2) requires that where consent was obtained before the Act commenced, you give those Data Principals the required notice as soon as reasonably practicable — so a one-time notice exercise across your existing book is unavoidable, not optional, and it is the cleanest single task to start with. On erasure: the duty to erase on withdrawal or once the purpose is served is qualified by the retention exception where a law requires you to keep the record, so your PMLA and AMFI-mandated KYC and transaction records stay put for their prescribed period even if a client asks you to delete everything. What you cannot justify keeping is the rest — rejected prospects from 2016, exited clients' scanned cheques, WhatsApp media folders full of statements, spouse and child details captured "for planning" and never used. Two further points specific to your book: minor folios trigger Section 9, meaning verifiable parental or guardian consent and no behavioural tracking or targeted advertising directed at that child, with the consent shifting to the investor at 18; and nominee and joint-holder data you collected from the primary investor belongs to those individuals, who have their own access and correction rights over it.

Two clocks start at detection and both must be met; they are cumulative, not alternatives. CERT-In requires reporting of covered cyber incidents within 6 hours. Separately under DPDPA, you must intimate every affected client without delay (Rule 7(1)), give the Board an initial description without delay (Rule 7(2)(a)), and file detailed particulars within 72 hours (Rule 7(2)(b)) — and "I'm a small distributor" is not an exemption from either. Failure to maintain reasonable security safeguards attracts up to ₹250 crore under Section 8(5), and failure to give the required breach intimation is assessed separately at up to ₹200 crore under Section 8(6), with the Board deciding actual quantum on the facts, including the scale of the operation. An unencrypted laptop with client KYC on it is the single most common failure mode here, and full-disk encryption plus two-factor authentication on your CRM and email closes most of it. On the heavier obligations: annual DPIAs, independent data audits, algorithmic due diligence and an India-based Data Protection Officer bind Significant Data Fiduciaries only, and SDF status is conferred by Central Government notification — it is not triggered automatically by client count or AUM. No MFD practice becomes an SDF by growing. You still owe the baseline duties in full.