Bengaluru (Karnataka) [India], November 2, 2026: SecureDApp, a Bengaluru-based security technology company, has launched SecureCMS, a DPDP consent management platform built for banks, non-banking financial companies (NBFCs) and the wider financial sector. The launch coincides with the Consent Manager provisions of the Digital Personal Data Protection (DPDP) Rules, 2025 taking effect on 13 November 2026. The core notice, consent, security and breach obligations follow six months later, on 13 May 2027.
The DPDP consent management platform records verified customer consent across branches, apps, DSAs and call centres, pushes withdrawals to core banking systems, and keeps the evidence lenders will need if a consent is ever challenged.
For lenders, six months is not much time. Consent under the DPDP Act is a record that must survive scrutiny, and in banking that record is spread across branches, apps, agents, partners and decades-old core systems.
Why consent is harder for lenders than for most businesses
Take an ordinary retail customer. She opens a savings account at a branch, uses the mobile app, takes a personal loan through a direct selling agent and is offered insurance by a partner. Each is a separate purpose under the Act, with its own lawful basis.
Section 6 of the DPDP Act says consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action and limited to the data actually needed. A single “I agree” at onboarding that covers marketing, cross-selling and partner sharing does not meet that standard.
The bigger issue is proof. Section 6(10) places the burden on the business. If a customer says she never agreed to loan offers on WhatsApp, the bank has to show which notice she saw, in which language, on which channel, at what time, and what she did. Many institutions store consent as a yes or no flag in a CRM. A flag has no history, and history is what a regulator will ask for.
The numbers behind the urgency
Scale is the first challenge. According to NPCI data, UPI processed 24.07 billion transactions worth ₹29.37 lakh crore in September 2026, roughly 802 million a day, each one touching personal data held by a bank or payment app.
Risk is the second. The Reserve Bank of India’s Report on Trend and Progress of Banking in India 2024-25 put the amount involved in bank frauds at ₹34,771 crore, nearly three times the previous year, with card and internet frauds making up 66.8 per cent of cases. In August 2026, Minister of State for Electronics and IT Jitin Prasad told the Rajya Sabha that CERT-In had detected 5,70,108 cyber incidents in the banking sector in 2025, and another 3,48,607 in the first half of 2026.
The DPDP Act attaches serious penalties to failures in this area. Not taking reasonable security safeguards to prevent a breach can cost up to ₹250 crore. Failing to notify the Data Protection Board and affected individuals of a breach can cost up to ₹200 crore. Other violations, including notice and consent failures, carry penalties of up to ₹50 crore.
Where RBI rules and the DPDP Act meet
NBFCs carry an extra layer. The RBI (Digital Lending) Directions, 2025, issued on 8 May 2025, require need-based data collection with prior, explicit consent and audit trails. The purpose must be disclosed at every interaction point, and consent must be granular, including the right to deletion. Lending apps are barred from accessing files and call logs.
NBFCs are also the heaviest users of the Account Aggregator network. Sahamati data reported by Business Standard shows NBFCs accounted for 60.08 per cent of Account Aggregator consents in FY25. A common mistake is to assume AA consent covers DPDP obligations. It does not. AA consent governs sharing financial information for a specific request; DPDP consent governs everything else, from marketing calls to sharing records with a collection agency.
Then there is the conflict that every compliance head in banking already knows. Section 6(4) lets a customer withdraw consent at any time, and withdrawal must be as easy as giving consent. Yet the Prevention of Money Laundering Act and RBI’s KYC rules require certain records to be kept for years after a relationship ends. A consent system that simply deletes data on withdrawal breaks one law. One that ignores withdrawal breaks another.
How SecureCMS handles consent for banks and NBFCs
SecureCMS was designed around these overlaps rather than around a website cookie banner. Its core capabilities include:
- OTP-verified consent at branches, mobile and net banking, DSAs, business correspondents, call centres and WhatsApp
- Purpose-level records per product, storing the notice version and language, with notices in English and the 22 Eighth Schedule languages
- Real-time withdrawal sync to core banking, loan origination, CRM and marketing systems through APIs, webhooks and SDKs
- A legal-hold engine that separates “stop processing” from “erase”, so PMLA and RBI retention rules are respected
- Data limiting for DSAs, collection agencies and other third parties
- Rights requests and grievance workflows with escalation to the Data Protection Officer
- A tamper-evident audit trail exportable for auditors or the Data Protection Board
“Most banks we speak to are not short of consent forms. They are short of consent records,” said Abhishek Singh, Co-Founder and CEO, SecureDApp. “When a customer withdraws consent in the app on a Sunday night, the question on Monday morning is whether the marketing team, the DSA and the collection agency all know. Under the DPDP Act, the bank has to prove that they did. SecureCMS was built so that answer is a report, not a week of email threads.”
Himanshu Gautam, Co-Founder and CTO, SecureDApp, said the hardest engineering problem was not capturing consent but keeping it consistent. “A large bank can have a core banking system, a loan origination system, two CRMs and dozens of partner integrations, all holding copies of the same customer. We treat every consent and withdrawal as an event that each of those systems must acknowledge, and we log the acknowledgement. If one system misses it, the compliance team sees that gap the same day.”
The same DPDP consent management software runs across 13 industry frameworks, covering fintech, insurance, stock broking, healthcare, ecommerce, SaaS, edtech, schools, telecom, HR and startups as well as banks and NBFCs. Each packages the DPDP consent management tools that sector needs, mapping where consent applies and where a legal duty applies instead.
What lenders should do before May 2027
SecureDApp recommends five steps for banks and NBFCs that have not yet started:
- Map every point where customer data enters, from branches and agents to apps and partners.
- Assign each purpose either consent or a specific legal basis, such as a KYC obligation.
- Rewrite notices so they stand alone, list the data for each purpose, and use the languages customers actually read.
- Connect consent status to every downstream system, so a withdrawal stops processing within hours, not weeks.
- Pick ten random customers and produce their full consent history. If that takes more than a few minutes, the setup is not ready.
One frequent misunderstanding is worth clearing up. SecureCMS is a consent management platform, not a registered Consent Manager under Rule 4 of the DPDP Rules. Consent Managers are independent entities that will register with the Data Protection Board and act for individuals. Banks and NBFCs do not need to become one, but they do need consent management for DPDP compliance in their own operations. SecureCMS is designed to work alongside registered Consent Managers as that ecosystem forms.
“May 2027 is not the date to start,” Abhishek Singh added. “It is the date the Board can start asking questions. The institutions that use the next six months to fix their consent records will spend 2027 serving customers instead of answering notices.”
Banks, NBFCs, and other regulated entities can see how the platform works and book a demonstration on the SecureCMS DPDP consent management page.
About SecureDApp
SecureDApp (Vettedcode Technologies India Pvt. Ltd.) is a Bengaluru-based security technology company. Its products span smart contract security audits, real-time blockchain threat monitoring, digital signatures, enterprise HSM key management and, with SecureCMS, consent management under the DPDP Act for Indian enterprises.
The company was co-founded by Abhishek Singh and Himanshu Gautam, Co-Founder and CEO, has more than 16 years of experience in India’s internet and media sectors, including senior marketing roles at Via.com, CommonFloor, Vakilsearch and Hirect India. He holds a PhD in Cybersecurity and Marketing from Alliance University and an MBA from Bangalore University, and is a certified independent director.
Himanshu Gautam, Co-Founder and CTO, is an IIT Kanpur graduate with bachelor’s and master’s degrees in engineering. He was a software engineering manager at Gaana and has led blockchain engineering teams in India and Singapore. He is named on patent filings covering post-quantum secure messaging, digital identity credential verification and cybersecurity threat detection, and SecureDApp’s SecureX DID was a finalist at the Data Security Council of India (DSCI) Grand Challenge 2.0.
Media contact: hello@securedapp.in | +91 96060 15868
