Does the DPDP Act apply to fintech apps?

Yes. A fintech that decides why and how its users’ personal data is processed is a Data Fiduciary. It must give a clear notice, obtain valid consent where it relies on consent, use processors only under a contract, keep reasonable security safeguards, report personal data breaches, and respond to users’ rights requests. Most of these obligations apply from 13 May 2027.