DPDP Rule 6 safeguards come into force, 13 May 2027
Data protection and governance
Data protection and governance for banks and NBFCs
Data protection in banking and lending means sensitive customer data, such as Aadhaar numbers in KYC and loan files, is masked, access-controlled and traceable wherever it is stored. HabileLabs has published Aadhaar masking projects for five BFSI clients, including 2.8 lakh documents masked in one week at Utkarsh Small Finance Bank without the data leaving the bank.
- On your own servers, in your AWS account or as an API
- Aadhaar numbers and QR codes, in English and Hindi
- DocuSwift is AWS Qualified Software
Aadhaar masking results
Five BFSI clients, five published masking projects
Financial services
1.5 million
Documents on Amazon S3 processed across every format and type
Choice FinservHousing finance
2 TB
Of loan applications, CIBIL reports and bank statements masked
Wonder Home Finance
Each figure is quoted from that client's published case study; the client name links to it. The Aavas Financiers figure comes from its Aadhaar masking case study, where the masking engine is built into DocuSwift.
Batch or live masking
Mask the archive you hold, then every new file
Batch masking processes the documents you already hold, such as historical loan and KYC files, in one run instead of one file at a time. It is usually a one-time job on your own servers, followed by masking at the point of capture.
Batch: the archive you hold
- Historical loan and KYC files, masked in one run
- Files that are already masked are found first, as at Utkarsh
- About 500 pages a minute with 40 parallel masking environments
- 2.8 lakh documents at Utkarsh; 1.5 million on Amazon S3 at Choice Finserv
- Runs offline when no data can leave the building
Old files or new ones?
Live: every new document
- A REST API connects masking to your existing document management system
- 0.3 sec per file at Art Housing Finance, in line with daily intake
- Under 300 ms per file at Wonder Home Finance
- Built into DocuSwift, as at Aavas Financiers
- Inside FinHub's verification APIs, with consent capture and audit logs
More on batch Aadhaar masking for document archives.
How Aadhaar masking works
How we find and mask Aadhaar data
Six steps, as our masking products and client case studies describe them.
Find what still needs masking
AI and OCR analyze the repository and report which files are already masked. At Utkarsh, models for Aadhaar number detection and QR code identification were built from the 200 sample files available.
Cover the number and the QR code
The first eight digits of each Aadhaar number are covered and the last four stay readable, UIDAI's masked form. Aadhaar QR codes are covered completely.
Keep the document usable
Masking must not damage the file. Choice Finserv's case study reports zero document quality degradation across 1.5 million documents on Amazon S3.
Run where the data has to stay
An on-premises edition, an AWS Marketplace edition that masks files in your own S3 bucket and deletes them within a day, and a SaaS API. At Utkarsh, the data never left the bank's infrastructure.
Scale with parallel processing
About 500 pages a minute with 40 parallel masking environments. Utkarsh's run used a 16-core server configured for parallel processing.
Connect it and keep the evidence
A REST API connects masking to the existing document management system (DMS). In DocuSwift, audit logs are system-generated and immutable, and the audit trail is hash-chained.
See it on your own document types: book an Aadhaar masking demo.
Client projects
Data protection that fits the environment the data lives in
Each project had its own constraint: no data leaving the building, 1.5 million files on Amazon S3, an air-gapped network, a one-month timeline.
Banking · Offline
Utkarsh Small Finance Bank
99% masking accuracy across 2.8 lakh documents in one week. No data left the bank.
Case studyFinancial services · Amazon S3
Choice Finserv
95% masking accuracy, held consistently with no manual review, across 1.5 million documents.
Case study
NBFC · DocuSwift
Aavas Financiers
95% Aadhaar masking accuracy from the masking engine built into DocuSwift, and 100% RBI compliance on Aadhaar masking.
Case studyHousing finance · Air-gapped
Wonder Home Finance
99% masking accuracy on 2 TB of documents, under 300 ms per file, through a REST API to the existing DMS.
Case studyHousing finance · Offline
Art Housing Finance
Live within one month, from scoping to deployment with DMS integration, at 99% masking accuracy.
Case study
SaaS · Amazon RDS
iSEEit
Masking sensitive data in testing and backups was a requirement. Separate KMS key policies per environment and future-ready sanitization practices support adherence to India's DPDP Act, 2023.
Case studyProducts
Three HabileLabs products behind the protection
These are products we build and run. Their figures are product claims, not client results.
DocuSwift: a document repository built for audit
DocuSwift is a serverless document management system (DMS) on AWS for lenders and other regulated teams. It stores, searches and controls every document, with pricing based on the storage you use, not the number of users.
- Documents in Amazon S3, metadata in Amazon DynamoDB
- Immutable, hash-chained audit trail
- Keeps only the metadata needed for operations and audit
- AWS Qualified Software, through the AWS Foundational Technical Review
Aadhaar Masking: as an API, in your AWS account or on your servers
Masks Aadhaar numbers and QR codes in KYC and loan files, as an API, in your AWS account or on your own servers.
- 99.94% of Aadhaar numbers and 100% of QR codes masked in a test on 10,001 real loan files
- English and Hindi documents, about 500 pages a minute
- On-premises edition, AWS Marketplace edition and SaaS API
- AWS Marketplace edition: files masked in your own S3 bucket and deleted within a day
FinHub: verification APIs with masking, consent and audit logs
FinHub is HabileLabs' API platform for lenders: 60+ plug-and-play verification APIs behind one integration, with consent capture, Aadhaar masking and audit logs built in.
- Aadhaar masking module: detects and covers Aadhaar numbers and QR codes with AI
- Income, GST, bank statement and UPI validation
- Consent logs and audit dashboards
- Smart fallback switching with 99.99% uptime
Document governance
Masking is one stage of document governance
Digitization was only the first step. Once KYC, Aadhaar, PAN and loan documents are digital, they still need to be modernized, protected, governed and made intelligent, not just stored.
01
Modernize
Move documents onto a repository that grows from gigabytes to terabytes, with documents in Amazon S3 and metadata in Amazon DynamoDB.
02
Protect
Mask Aadhaar numbers and QR codes in stored and incoming files, and capture consent through ConsentGuard.
03
Govern
Find any file by loan number, barcode or client ID, and keep an immutable, hash-chained audit trail.
04
Extract intelligence
Classify documents and extract data from what's already stored, with FinHub's document analyzer for financial information.
Further reading: what DPDP Rule 6 actually requires of NBFCs and why document governance proof matters.
Free BFSI document governance assessment
Find the gaps in your document estate
A free 30–45 minute session that maps your documents against DPDP Rule 6 and RBI expectations, followed by a written gap list.
We'll respond from a HabileLabs email within one business day to schedule the session.
A 30–45 min working session
With whoever owns document, KYC or compliance operations on your side.
A written gap list
No numbers or claims we can't stand behind.
No cost, no commitment
There's no cost and no commitment attached to the session itself.
What this isn't
A compliance certification, legal advice, or a guarantee of DPDP or RBI compliance.
Keep exploring
More on protecting and moving data
BFSI document governance
The free assessment, the four-stage document lifecycle and the regulations behind it.
BFSI document governanceBatch Aadhaar masking
Mask Aadhaar numbers across your whole document archive, offline on your servers or in your AWS account.
Batch maskingDatabase migration and modernization
Legacy and self-managed databases moved to managed platforms, with encryption and backups set up on the way.
Database modernizationData services
Data engineering, migration, analytics and protected data that AI can use.
Data and AI servicesData case studies
Our published data results, grouped by the work: migration, protection, platforms and the data behind AI.
Data case studies
Data protection FAQs
Aadhaar masking and data governance, answered
What masking does, where it runs, how accurate it is, and what the free assessment is and is not.
Aadhaar masking hides the first eight digits of an Aadhaar number and leaves the last four readable, which is UIDAI's masked form, and covers the Aadhaar QR code completely. HabileLabs finds Aadhaar numbers and QR codes in KYC and loan files with AI and OCR, and masks them as an API, in your AWS account or on your own servers.
Batch masking processes the documents you already hold, such as historical loan and KYC files, in one run instead of one file at a time. It is usually a one-time job on your own servers, followed by masking at the point of capture. Our batch runs process about 500 pages a minute with 40 parallel masking environments.
Yes. The on-premises edition runs on your own servers. At Utkarsh Small Finance Bank, sensitive Aadhaar data for over 2.8 lakh customers was processed entirely within the bank's offline environment and never left its infrastructure, and Wonder Home Finance's loan files were masked in an air-gapped environment. The AWS Marketplace edition masks files in your own S3 bucket and deletes them within a day.
In client projects: 99% masking accuracy at Utkarsh Small Finance Bank, Wonder Home Finance and Art Housing Finance, 95% at Choice Finserv with no manual review, and 95% at Aavas Financiers. In a product test, the Aadhaar Masking API masked 99.94% of Aadhaar numbers and 100% of QR codes on 10,001 real loan files.
No. At Art Housing Finance and Wonder Home Finance, a REST API connects the masking to the existing document management system (DMS). Art Housing Finance went from scoping to live deployment, including DMS integration, in one month.
No. The BFSI document governance assessment is a 30–45 minute working session and a written gap list, mapped against DPDP Rule 6 and RBI expectations. It is not a compliance certification, legal advice, or a guarantee of DPDP or RBI compliance.
On 13 May 2027. The free document governance assessment maps your documents against DPDP Rule 6 and RBI expectations, and our blog post on DPDP compliance for NBFCs covers what Rule 6 requires and what is due by May 2027.
DocuSwift, a serverless document management system on AWS with an immutable, hash-chained audit trail; the Aadhaar Masking API, available as an on-premises edition, an AWS Marketplace edition and a SaaS API; and FinHub, an API platform for lenders with 60+ verification APIs and consent capture, Aadhaar masking and audit logs built in.
Next step
Start with a free document governance assessment
Bring whoever owns document, KYC or compliance operations. We map your documents against DPDP Rule 6 and RBI expectations in one working session, and you get a written gap list.
- A 30–45 min working session
- A written gap list
- No cost, no commitment
The assessment is not a compliance certification, legal advice, or a guarantee of DPDP or RBI compliance.