Overview
Razorpay is one of India’s leading fintech companies, processing billions in transactions annually. As a payment gateway handling sensitive financial data, DPDP compliance is critical.
DPDP Readiness Assessment
Section 4: Consent & Notice ⚠️
Razorpay provides a standard privacy notice, but it does not specifically reference the DPDP Act 2023 or use the terminology defined in the Act (e.g., “Data Principal,” “Data Fiduciary”). The notice should be updated to clearly state the purpose of data processing as required under Section 4.
Section 5: Lawful Purpose 🔴
While Razorpay lists purposes for data collection, the mapping to “lawful purpose” as defined under DPDP is incomplete. Payment processing data is covered under “legitimate use,” but marketing data processing lacks explicit consent mechanisms compliant with DPDP Section 6.
Section 6: Right to Withdraw Consent ⚠️
The policy mentions the ability to opt out of marketing communications, but does not provide a clear, easily accessible mechanism for withdrawing consent for all processing activities. Under DPDP, withdrawal must be as easy as giving consent.
Section 8: Data Security ✅
Razorpay demonstrates strong technical safeguards including encryption, PCI DSS compliance, and regular security audits. This aligns well with Section 8 requirements for reasonable security safeguards.
Section 11: Data Principal Rights ⚠️
The policy acknowledges some data subject rights but does not comprehensively address all rights under Section 11 of the DPDP Act, including the right to correction, the right to nominate, and access to information about data sharing with third parties.
Section 17: Cross-Border Transfer 🔴
The policy mentions data may be transferred internationally but lacks specificity on which countries and whether those jurisdictions are on the approved list under Section 17. This is a significant compliance gap.
Recommendations
- Update privacy policy to explicitly reference DPDP Act 2023
- Define clear data retention periods with specific timelines
- Add Data Protection Board as a grievance mechanism
- Map cross-border transfers to approved jurisdictions
- Implement DPDP-compliant consent withdrawal mechanism
- Add Data Principal rights portal for Section 11 compliance
Risk Assessment
| Risk Category | Level | Impact |
|---|---|---|
| Regulatory fine risk | Medium | Up to ₹250 Cr under DPDP |
| Customer trust impact | Low | Strong existing security posture |
| Operational readiness | Medium | Needs policy + process updates |