DPDP Guide for Mutual Fund Platforms
Mutual fund platforms handle PAN, bank accounts, and investment history. Learn how DPDP impacts KYC, RTAs, and data retention for Indian wealth tech.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Guide for Mutual Fund Platforms, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Handling Third-Party Data Flows
Mutual fund platforms act as intermediaries between investors, Asset Management Companies (AMCs), and Registrar and Transfer Agents (RTAs). Every API call that transfers a PAN, bank account number, or nominee detail to an RTA is a data processing event. Under DPDP, your platform is responsible for ensuring these partners handle data securely. You must verify that your contracts with RTAs and payment gateways specifically define them as Data Processors with limited usage rights.
Managing Statutory Retention Conflicts
SEBI regulations require mutual fund platforms to maintain transaction records for at least eight years after a business relationship ends. DPDP requires data deletion once the specific purpose of processing is fulfilled. To remain compliant with both laws, platforms must implement “legal hold” tags. These tags should prevent automated deletion while the SEBI retention period is active but must also block the data from being used for any secondary purpose, such as marketing or user analytics.
Data Types in Investment Workflows
| Workflow | Personal Data Involved | DPDP Risk Level |
|---|---|---|
| KYC Onboarding | PAN, Aadhaar, Video-IPV, Signature | Very High |
| Payment Processing | Bank Account, IFSC, UPI ID | High |
| Nominee Management | Nominee Name, Relationship, DOB | Medium |
| Portfolio Tracking | Net Worth, Holdings, Transaction History | High |
| Redemptions | Payout Details, Tax Status | High |
Consent Specificity in Wealth Tech
Generic consent for “platform improvement” or “sharing with partners” is insufficient for mutual fund platforms. You must provide a notice that lists the specific categories of entities receiving data, such as KYC Registration Agencies (KRAs) or specific fund houses. If a user switches from a regular plan to a direct plan, or moves assets between different fund houses, the platform must track which entity has the legal right to process that specific transaction data at any given time.
This week
Map the data flow for a single “New SIP” transaction. List every third-party API that receives the investor’s PAN or bank details during this flow and verify if you have a signed Data Processing Agreement (DPA) with each provider.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Do we need separate consent for every new mutual fund purchase?
No, you can obtain consent for the platform's core services during onboarding. However, if you share data with a new type of third party or use it for a new purpose like cross-selling insurance, you must get fresh consent.
How does DPDP affect our family folder or joint account features?
Each individual in a family folder must consent to their data being visible to the primary account holder. For joint accounts, the platform must provide a notice to both holders explaining how their shared transaction data is processed.
What happens to data for investors who have closed their accounts?
You must stop using this data for marketing or profiling immediately. You are allowed to retain it only to satisfy SEBI record-keeping requirements and must delete it once that statutory period expires.