Overview
Paytm Money (a subsidiary of One97 Communications Ltd.) operates in a highly regulated environment, handling sensitive personal data including KYC documents, bank account details, trade history, and investment patterns. As a fintech intermediary, its data processing is governed by both SEBI regulations and the DPDP Act 2023. The current policy is optimized for financial transparency but lacks the individual-centric rights framework introduced by India’s new data law.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice ⚠️
Paytm Money utilizes a “deemed consent” approach via site usage and bundled acceptance. Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional, and an affirmative action.
What the policy says: “By using the Website/App and/or by providing your information, you consent to the collection and use of the information you disclose.”
Gap: This “take it or leave it” model is legally fragile under DPDP. There is no evidence of a “Notice” (Section 5) that must precede consent, listing the data collected and the purpose in a clear, separate format. Users cannot opt-out of marketing analytics while opting-in for brokerage services.
Section 8 — Obligations of Data Fiduciary ✅
Paytm Money demonstrates high readiness in technical safeguards. As a regulated entity, it already implements “reasonable security safeguards” to prevent data breaches.
Strength: The policy highlights 128-bit encryption, firewalls, and restricted access. These measures align with Section 8(5) of the DPDP Act, which requires fiduciaries to protect personal data in their possession or control.
Section 9 — Data Retention 🔴
Critical gap. The DPDP Act requires the Data Fiduciary to erase personal data upon the withdrawal of consent or as soon as it is reasonable to assume that the specified purpose is no longer being served.
What the policy says: “We will retain your information for as long as it is necessary for the purposes for which it was collected or as required by applicable law.”
Gap: While SEBI requires record-keeping for up to 8 years, the policy does not distinguish between “regulatory data” (which must be kept) and “behavioral/marketing data” (which must be erased). There is no “Right to be Forgotten” implementation path described for the user.
Section 11 — Rights of Data Principal ⚠️
The policy allows users to “review and correct” data, which addresses Section 11(1). However, the broader suite of DPDP rights is missing:
- Right to Erasure: Only offered “subject to legal requirements” without a clear mechanism for non-regulated data.
- Right to Nominate (Section 14): Totally absent. There is no provision for a user to nominate a person to exercise their rights in case of death or incapacity.
Section 12 — Right of Grievance Redressal ⚠️
Paytm Money provides a clear escalation path to a Grievance Officer. However, to be DPDP-compliant, the policy must inform the Data Principal that they have the right to lodge a complaint with the Data Protection Board of India if they are unsatisfied with the internal resolution. The current policy makes no mention of the Board.
Section 16 — Cross-Border Data Transfer ✅/⚠️
The policy states that data is primarily stored in India but may be shared with partners who might process it elsewhere.
DPDP Alignment: The Act allows cross-border transfers unless restricted by the Central Government. While Paytm Money is currently compliant, they lack the required disclosure of where the data might go, which may be required under future DPDP rules.
Risk Assessment
| Category | Risk Level | Description |
|---|---|---|
| Consent | High | Bundled consent is no longer valid; requires granular “check-box” architecture. |
| Data Retention | Medium | Conflict between SEBI retention mandates and DPDP erasure mandates needs explicit clarity. |
| Rights | High | Absence of nomination rights and DPB escalation path creates regulatory exposure. |
| Security | Low | Existing fintech security protocols are largely sufficient for Section 8 compliance. |
Recommendations
- Notice Layering: Implement a DPDP-compliant “Notice” before the consent screen, available in English and scheduled 8th Schedule languages.
- Granular Consent: De-link marketing and analytics consent from the core brokerage service agreement.
- Nomination Module: Add a feature in the “Profile” section allowing users to nominate a data representative.
- Board Integration: Update the Grievance Redressal section to include the Data Protection Board of India as the statutory appellate body.