DPDP Rule 6 safeguards come into force, 13 May 2027

Your documents went digital. Did they go governed?

Digitization was only the first step. Once KYC, Aadhaar, PAN and loan documents are digital, they still need to be modernized, protected, governed and made intelligent, not just stored.

Assess your document governance See our approach

Modernize
Protect
Govern
Extract intelligence

The BFSI problem

Most BFSI/NBFCs have already digitized. That was step one.

Once loan files, KYC records and agreements go digital, a different set of problems shows up. These are the ones we hear most often from BFSI, NBFC and HFC technology and operations teams.

Documents spread across multiple systems, not one governed source
Difficult to search across formats, branches and years of records
Full of unstructured data that nobody has time to classify
Carrying sensitive PII, Aadhaar and PAN included, with no consistent masking
Accessed by multiple teams with no single access-control policy
Hard to govern at scale as loan volumes and branches grow
Disconnected from a clear, auditable consent trail
Still dependent on legacy DMS or general-purpose storage

So the challenge today isn't digitization. It's modernizing, protecting, governing and extracting intelligence from what's already digital.

Why this is on the agenda now

Four existing directions, one operational question

What's in your documents, who can reach it, and can you prove it, on demand.

Regulatory references: DPDP Rules, 2025 (MeitY) · KYC Master Direction (RBI, 2016) · IT Governance Directions (RBI, 2023)

DPDP RULES 2025 · RULE 3
Know what personal data you're processing
Requires clarity on exactly what personal data is being processed and why, not a general statement that KYC documents are "on file somewhere."
DPDP RULES 2025 · RULE 6
Control access, mask what's sensitive
Names access controls, monitoring, logging, encryption, obfuscation and masking among the reasonable security safeguards expected for personal data.
DPDP ACT 2023 · S.5–6
Keep consent traceable
Notice under section 5 and consent and withdrawal under section 6 need a record, not a memory: what was shown, what was agreed to, and what changed since.
RBI KYC & IT GOVERNANCE
Retrieve records fast, prove governance
RBI's KYC direction expects records retrievable easily and quickly whenever required; its IT Governance direction adds controls, risk, resilience and disaster recovery.

Key DPDP obligations, including Rule 6 on reasonable security safeguards, take effect on 13 May 2027, with no grace period announced. The Act's Schedule sets a maximum penalty of ₹250 Cr per violation for failing the security safeguard obligations, one reason this is now a working window most BFSI, NBFC technology and risk teams are planning against, not a compliance calendar entry.

This page references the Digital Personal Data Protection Rules, 2025 (MeitY), the Digital Personal Data Protection Act, 2023, the RBI Master Direction on KYC (2016), and the RBI IT Governance, Risk, Controls and Assurance Practices Directions, 2023, for context. It is provided for informational purposes and does not constitute legal or compliance advice, and does not imply certification of DPDP or RBI compliance.

Our approach

The end-to-end digital document lifecycle

FinHub by HabileLabs' role begins after your documents become digital. We work across four stages, not one point solution, so modernization, protection, governance and intelligence all sit on the same foundation.

STAGE 01
Modernization
Move off legacy DMS and branch storage onto a cloud-native document layer built for scale, retrieval and resilience.
- DocuSwift
- AWS
STAGE 02
Protection
Mask Aadhaar and PAN automatically, and run notice, consent capture and an auditable withdrawal trail through ConsentGuard.
- Aadhaar/PII Masking
- ConsentGuard
STAGE 03
Governance
Role-based access, tamper-proof audit trails and lifecycle governance built for DPDP and RBI-regulated environments.
- DocuSwift
STAGE 04
Intelligence
Classify documents and extract data from what's already stored, turning archives into usable business intelligence.
- DocuSwift
- Smart OCR by FinHub

Digitization was only the first step.

Once documents are digital, they need to be modernized, protected, governed and made intelligent.

Assess your document governance

Proof, not promises

Built on nearly a decade in BFSI document infrastructure

FinHub by HabileLabs has partnered with BFSI, NBFCs and HFCs on document modernization, masking and governance since well before DPDP made it urgent.

35+ TB
financial records governed for Aavas Financiers, via DocuSwift
2.8L+
Aadhaar documents masked for Utkarsh Bank in 7 days, 99% accuracy
60%
lower document infrastructure cost vs. legacy DMS licensing
10+ yrs
partnering with BFSI, NBFCs and HFCs on document infrastructure

Trusted by BFSI, NBFCs and HFCs including

Aavas Financiers, Utkarsh Bank, Choice, Kogta Financial, Wonder Finance, IFFCO Kisan Finance and Valuefy.

What actually happens

The assessment, in plain terms

A working session, not a sales call. You get a written view of where your document environment stands today.

A 30–45 min working session
With whoever owns document, KYC or compliance operations on your side.
A stage-by-stage read
Modernization, protection, governance and intelligence, mapped against DPDP Rule 6 and RBI expectations.
A written gap list
Specific to what we hear from you. No numbers or claims we can't stand behind.
A next step, if useful
Only if there's a real fit. You keep the gap list either way.

What this isn't: a compliance certification, legal advice, or a guarantee of DPDP or RBI compliance. It's a working diagnostic your own compliance and legal teams can act on.

Common questions

Before you book the session

Straight answers, so there are no surprises on the call.

Yes. There's no cost and no commitment attached to the session itself.

No product pitch happens in the session itself. It's a working read of your document environment. If there's a real fit for FinHub, DocuSwift or another HabileLabs capability, that comes up as a next step afterward, not during.

No. The assessment looks at what you have today, wherever your documents and verification workflows currently live, and maps it against the four-stage lifecycle. Nothing needs to change beforehand.

No. It's a working diagnostic, not a compliance certification, legal advice or a guarantee of DPDP or RBI compliance. Your own compliance and legal teams remain the ones who determine and confirm compliance.

That's when DPDP Rule 6 safeguards come into force, covering how personal data, including identity documents, must be secured and governed. It's one of the regulatory reference points the assessment is built around.

Consent management, notice configuration, consent capture across channels, and a portal where your customer can view, edit or withdraw consent, is live, as is data discovery, which finds personal data sitting in your databases, document stores and file shares. Data mapping and DPIA tooling are still in active development, so we won't position those as available in the assessment itself.

Whoever owns document, KYC or compliance operations on your side. Many teams also bring someone from IT or risk, since the conversation spans modernization, protection, governance and intelligence.

You get a written gap list specific to what we heard from you. If there's a next step worth having, we'll suggest it. If not, you keep the gap list regardless.

Assess your document governance

For BFSI, NBFC, HFC and digital lending leaders who want a factual answer before the May 2027 deadline turns this into a scramble. No cost, no commitment, and no product pitch in the session itself. Delivered by a team with 10+ years partnering with BFSI, NBFCs and HFCs, including Aavas Financiers. You keep the written gap list regardless of what you decide afterward. We'll respond from a HabileLabs email within one business day to schedule the session.