A Project by Meridian Bridge Strategy
Archived analysis

This page is old. Upstox was reviewed on 2026-02-23.

This is a historical, policy-only review. Policies, product behavior and source URLs may have changed since this analysis was published.

For current public evidence from website trackers, policy findings and proof samples, go to State of Privacy 2026.

View current public evidence
Fintech

Upstox

Ready Score 50/100
Functional Gaps vs Industry Avg: 48
Sushant Pasumarty
ANALYSIS SUPERVISED BY Sushant Pasumarty
📅 23 Feb 2026

Discuss this page with an LLM

ChatGPT Claude Gemini Perplexity

Executive Summary

Upstox, handling investment data for 1Cr+ users, scores 50/100 on DPDP readiness. Like Zerodha and Groww, SEBI compliance provides a baseline, but DPDP adds consent granularity and data rights requirements beyond what securities regulation demands. API trading users create additional data governance challenges.

How To Read This Analysis

This is an archived policy-only review of the company's public privacy policy. It is not a government certification and it is not legal advice.

For current public evidence from website trackers, policy findings and proof samples, see State of Privacy 2026.

We look for:

  • Notice and consent clarity
  • Purpose limitation
  • Data minimization
  • Retention and deletion language
  • Vendor and processor disclosures
  • Data Principal rights
  • Grievance redressal
  • Breach and security posture

Source Check

  • Source policy was reviewed for this archived analysis, but the old policy URL is not linked because public policy locations may have changed.
  • Date reviewed: 2026-02-23
  • Company: Upstox
  • Readiness score: 50/100
  • Policies and product behavior may have changed since review
  • Whether the current source policy still matches this archived policy-only review
  • Whether app, web and product flows match the policy

What To Do With This

If your company has a similar data model, use this analysis as a warning map. Do not copy the score. Map your own data flow.

Ask internally:

  • Do we collect similar categories of personal data?
  • Do we share data with the same number or type of vendors?
  • Can users understand why their data is shared?
  • Can we prove deletion, retention and grievance workflows?
  • What evidence would we show if questioned?

If this analysis resembles your business model, the next step is not a better privacy-policy paragraph. It is a data map and gap analysis.

Book a DPDP readiness call

⚠️ Compliance Gaps

  • No DPDP Act 2023 reference — relies on SEBI and IT Act
  • Investment behavior data retention undefined
  • Ratan Tata-backed platform but no Tata ecosystem data governance mentioned
  • No Data Protection Board grievance escalation
  • API trading data handling for algo traders not addressed
  • Nomination rights under Section 14 absent

✅ Strengths

  • SEBI regulatory compliance
  • Two-factor authentication for account access
  • Encryption of financial data
  • Grievance officer with SEBI SCORES escalation
  • Clear data categories tied to regulatory requirements

Overview

Upstox is India’s second-largest discount brokerage by active users, processing equity, derivatives, and mutual fund transactions. Like other brokerages, it faces the SEBI-DPDP dual compliance challenge, but its emphasis on API-first trading creates additional data considerations for algorithmic trading users.

Key DPDP Concerns

API Trading Data

Upstox’s API platform is popular with algo traders who generate massive volumes of automated trades. This creates:

  • High-frequency trading data patterns (strategy IP)
  • API authentication tokens (security credentials)
  • Automated portfolio management data

Under DPDP, API-generated data is still personal data if linked to an identifiable person. Algo traders’ strategies, reflected in their trading patterns, may constitute sensitive commercial information requiring enhanced protection.

SEBI-DPDP Dual Compliance

Same challenge as Groww and Zerodha — SEBI mandates minimum data requirements while DPDP adds maximum retention and enhanced rights.

Recommendations

  1. Address API trading data under DPDP — Acknowledge algo traders’ data as potentially commercially sensitive
  2. Create SEBI-DPDP compliance matrix for transparent regulatory mapping
  3. Add Data Protection Board escalation alongside SEBI SCORES
  4. Implement Section 14 nomination — Critical for investment platforms
  5. Define non-regulatory data retention beyond SEBI minimums

📖 Related Compliance Guides

city DPDP Consulting in Lucknow → city DPDP Consulting in Noida → guide DPDP Data Breach Notification Compliance →

What Should You Do Next?

🔍 Map Your Own Exposure

Book a DPDP readiness call if this analysis resembles your business model.

🎓 Train Your Team

Book a DPDP compliance workshop — available online, onsite, and hybrid.

📰 Stay Updated

Get the daily DPDP news digest. Track enforcement, breaches, and policy changes.

Fix these compliance gaps today.

Book 1:1 Consultation >
Book clarity call