Total confidentiality, privacy, and security of customer information (Know Your Data).

Data storage in centers located & maintained in India, that is, the RBI has issued directions that require all fintech providers to localize payment transaction data in India (Data Localization).

Outsourcing of activities by fintech companies: Customer information is to be protected, by following appropriate practices to mitigate the risk involved with outsourcing / third parties (Third-party data sharing/Privacy Intelligence).

Handing Data Subject Requests (referred to as DSR’s - correction, updation, deletion, etc.,).

Data Discovery: Managing consumer data and the individual customer’s digital identity in the evolving fintech space. Cloning of the digital identity of the individual customer also poses a significant challenge.

Localization: “Proof of Data Localization” to government bodies.

CERT-IN provisions read with Section 70B(6) of the IT Act: The Indian Computer Emergency Response Team (CERT-In) has issued directions, under sub-section (6) of Section 70(B) of the Information Technology Act, 2000, relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet. It also provides the types of cyber security incidents mandatorily to be reported by body corporate.

Data Subject Rights Fulfillment: Lack of meaningful KYC data protection solutions.

Outsourcing–Third-Party Data Sharing: “Data theft by third parties” like partners, vendors, and within the supply chain.

Retention/Minimization/Data Deletion: Untimely action or inaction on the customer data, by not disposing the same in a secure manner, in spite of the fact that the customer has unsubscribed from the use of the services of the organization (fintech company).