DPDP Act for SEBI Research Analysts: What Applies from 13 May 2027
Your client folder holds PAN cards, bank details and risk answers. From May 2027 the way you keep them is a legal duty, not a habit.
Short answer: a Research Analyst is a data fiduciary for client data. From 13 May 2027 you owe clients a clear notice, reasonable security, breach reporting and a way to exercise their rights. SEBI record-keeping still wins where the two overlap: you keep what SEBI requires you to keep.
The dates
| Date | What happens |
|---|---|
| 13 Nov 2025 | DPDP Rules, 2025 notified. Data Protection Board set up |
| 13 May 2027 | Core duties apply: notice, security safeguards, breach intimation, data principal rights |
That leaves about six and a half months. Most of the work is finding out where your data is, which takes longer than anyone expects.
What an RA practice actually holds
| Data | Collected for |
|---|---|
| PAN, Aadhaar, address proof | KYC and onboarding |
| Bank and UPI details | Fee collection and refunds |
| Phone, email, WhatsApp and Telegram IDs | Delivery and support |
| Risk profile answers, income, holdings | Onboarding forms and client notes |
| Call recordings and chat history | Regulation 25 records |
| Leads and newsletter sign-ups | Website forms and marketing tools |
Six duties, in practice
Give a clear notice
Before you collect data, tell the person in plain language what you collect, why, and how they can withdraw consent or complain. A link to a ten-page privacy policy in small print is not the spirit of it.
Keep onboarding and marketing consent apart
A client who signs your agreement has not agreed to your festive newsletter. Record each consent separately, with the date and what the person saw, and make withdrawing as easy as giving it.
Secure what you hold
The Rules list the expected safeguards: encryption or masking, access control, monitoring for unauthorised access, backups and logs. Logs and the personal data they relate to are kept for at least a year. KYC copies in a shared Gmail folder do not meet this.
Report a breach
Tell affected clients without delay, and tell the Data Protection Board. A detailed report to the Board follows within 72 hours of becoming aware of the breach.
Answer rights requests
Clients can ask what you hold, ask you to correct it, ask you to erase it where no law requires you to keep it, and complain. Publish how to make each request and who handles it.
Hold your vendors to it
Every tool that touches client data processes it for you. Keep a list, a contract with each, and know where the data sits.
Where DPDP meets SEBI record-keeping
Regulation 25 makes you keep research, communications and client records for years. The DPDP Act asks you to erase data once its purpose is served, unless a law requires you to keep it. The two fit: SEBI records stay for as long as SEBI requires, and everything else (old leads, expired marketing lists, documents from prospects who never signed up) has a shelf life you set and stick to.
When a former client asks for erasure, the honest answer is usually: we have removed you from marketing and deleted what we no longer need, and we keep your agreement, KYC and the research we sent you because SEBI requires it.
Checklist before May 2027
- List every place client and lead data sits: software, spreadsheets, phones, email, cloud drives
- Delete what you do not need, apart from what SEBI requires you to keep
- Move KYC documents out of email and chat into a system with access control
- Write a short notice for onboarding and a separate one for marketing sign-ups
- Record consent per purpose, with date and version
- Write a breach plan: who decides, who tells clients, who reports to the Board
- Collect contracts from each vendor that handles client data
- Publish how clients can request access, correction or erasure
Questions RAs ask
Does the DPDP Act apply to a solo Research Analyst?
Yes. The Act applies to anyone who decides why and how digital personal data is processed. A solo RA who collects client PAN, phone numbers and risk-profile answers is a data fiduciary for that data.
When do the DPDP duties start?
The DPDP Rules, 2025 were notified on 13 November 2025. The Data Protection Board was set up straight away. The duties that matter day to day for an RA practice (notice, security safeguards, breach intimation and data principal rights) apply from 13 May 2027.
A client asks me to delete their data. Do I have to delete my SEBI records?
No. The Act lets you keep personal data that another law requires you to keep. SEBI requires you to keep research and client records for years, so those stay. Delete or stop using what you hold for other purposes, such as marketing lists, and tell the client what you kept and why.
Is my software vendor responsible for DPDP, not me?
You are responsible for the data your vendors process on your behalf. Your CRM, messaging provider and research software are processors. You need a contract with each and reasonable safeguards in place, and you answer to the Board if they fail.
What are the penalties?
The Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify a breach. Smaller practices are not exempt from the duties, though penalties are decided case by case.
General guidance for SEBI-registered Research Analysts in India, not legal advice. Dates checked against published summaries of the DPDP Rules, 2025 on 27 October 2026. Read the notified Rules, or ask a data protection lawyer, before relying on any point here.