An Analysis of Data Protection and Privacy Laws in the Banking Sector in India

I. Introduction

The Indian banking sector has changed a lot due to digital technology. Instead of relying only on traditional bank branches, people now use digital banking, mobile payments, and internet banking. These changes make banking faster and more convenient, but they also create new challenges for protecting personal and financial data. Banks handle large amounts of sensitive information, and problems like data breaches, cyber fraud, and identity theft have raised concerns about security³.

India’s legal system for data protection in banking has been developing over time. The Information Technology Act of 2000 was among the earliest legislative measures requiring banks to safeguard customer data. Over time, the Reserve Bank of India (RBI) has reinforced cybersecurity standards through initiatives like the Cyber Security Framework for Banks (2016), aimed at strengthening data protection. However, in the absence of a comprehensive and unified legal framework, banks adopted varied security practices, leading to inconsistencies in enforcement.

In 2023, India took a significant step toward strengthening data privacy with the introduction of the Digital Personal Data Protection Act. This legislation establishes clear guidelines on handling personal data, ensuring enhanced security for banking and other sectors. Despite this progress, several challenges persist—such as ensuring effective compliance, safeguarding individuals from cyber threats, and raising public awareness about data security.

This article explores the evolution of data protection laws within India’s banking sector, analyzing key milestones and ongoing concerns. It further assesses whether the existing legal framework is sufficiently robust to protect consumers while proposing strategies to enhance legal clarity, compliance, and public trust in digital banking.

Strengthening regulations and enforcement can help ensure that banks operate securely while providing customers with the convenience of digital services⁴.

II. History and evolution of cyber security laws. An analysis

The method to protection of data and privacy in India has come a long way as compared to trends in the world market. The United States, among other countries, have been using sector-specific regulation for a long time, whereas the European Union achieved a worldwide precedent with its extensive General Data Protection Regulation (GDPR) in 2018. Other countries like Canada (PIPEDA) and Australia also formulated simple forms of privacy only very early. Overall, India did not have a specific data protection legislation until many years ago relying on the very scanty provisions of the Information Technology Act, 2000. Nonetheless, the developing digital economy and legal definition of privacy as a human right inspired India to make up with the legislative change.

India’s approach to data protection and privacy has changed a lot over the years. In the early days, there was no specific law to protect people’s personal data. The journey toward robust data protection laws in India began with the enactment of the Information Technology Act, 2000 (IT Act), which introduced basic regulations for safeguarding personal data. This law included provisions that penalized organizations for failing to secure sensitive information or disclosing it without consent. However, these regulations lacked specificity, leaving significant gaps in defining individual rights over personal data and the obligations of entities handling such information. A turning point came in 2017 when the Supreme Court of India declared privacy a fundamental right under the Constitution, reinforcing the need for comprehensive legislation to address data security challenges in an increasingly digital world. This landmark judgment prompted the government to work toward a more structured legal framework, leading to years of deliberations and revisions. In 2023, India enacted the Digital Personal Data Protection Act (DPDP Act), marking a significant advancement in data security laws. This legislation establishes clear guidelines on data collection, processing, and storage, ensuring that companies obtain explicit consent from users before handling their personal information. Additionally, it mandates stringent security measures to protect sensitive data, minimizing the risks of breaches and misuse. To ensure compliance, the DPDP Act also introduces the Data Protection Board, an oversight body responsible for monitoring adherence to regulatory requirements and taking action against violations. While this law represents a crucial step forward, its effectiveness will ultimately depend on strict enforcement and widespread awareness, ensuring that individuals and businesses alike recognize the importance of data security in the digital era. By refining regulations and strengthening implementation mechanisms, India can create a resilient framework that upholds privacy and safeguards personal information in an increasingly interconnected society.

India’s laws have been influenced by the European Union (EU), which has one of the strictest data protection rules in the world. The EU started with the Data Protection Directive 95/46/EC, but in 2018, it replaced it with the General Data Protection Regulation (GDPR)⁵. GDPR ensures that companies take privacy seriously by enforcing strict rules, such as allowing people to request the deletion of their data and imposing heavy fines for violations. GDPR also applies to businesses worldwide if they handle data from EU citizens.

While in India The Information Technology Act, 2000 was a game-changer for cybersecurity in India’s banking sector. Before this law, online banking and digital payments weren’t fully recognized in the legal system. The Act helped banks move towards secure digital services by legally accepting electronic records and digital signatures, making processes like internet banking and e-statements possible.

One crucial part of the law, Section 43A, put the responsibility on banks to protect customer data. If a bank failed to secure personal and financial information, it could be held accountable, encouraging banks to improve their cybersecurity systems. This led to investments in better encryption methods, firewalls, and secure login systems.

Another major provision, Section 66, made hacking and unauthorized access to banking systems a serious crime. This gave banks the authority to take legal action against cybercriminals, strengthening their defenses against fraud and data breaches. The Act also prompted the Reserve Bank of India (RBI) to issue cybersecurity guidelines, ensuring that banks followed best practices in data protection and reported cyber incidents properly⁶.

However, while the IT Act was groundbreaking at the time, it wasn’t specifically designed for the complexities of modern banking security. As cyber threats became more sophisticated, banks needed clearer and stronger regulations to protect customers. This led to the introduction of newer laws, such as the Digital Personal Data Protection Act, 2023, which addressed gaps in the IT Act by providing more detailed rules on data privacy and security⁷.

In short, the IT Act helped banks transition into the digital world safely, but with the rapid evolution of cyber risks, stronger laws were needed to keep up. It laid the foundation, but newer regulations now ensure that banking stays secure in an era of advanced digital threats and new laws came into being.

III. Overview of the existing legal framework of data protection and privacy laws in the banking system in india

India's Information Technology Act, 2000 was the country's first big step in regulating digital activities. When it was introduced, its main goal was to make electronic transactions and digital signatures legally valid. However, at that time, cybersecurity wasn’t a major focus, and the law didn’t have strong protections against cyber threats⁸.

As technology evolved and cyber risks—especially in banking and finance—became more serious, the government made important changes to the law. The 2008 amendment added specific crimes such as cyberterrorism, identity theft, and data breaches. One major addition was Section 43A, which made businesses, including banks, responsible for keeping customer data secure⁹. This pushed financial institutions to improve their cybersecurity systems, moving from a reactive approach to a more preventive one¹⁰.

In 2011, the government introduced the SPDI Rules, which set clearer standards for handling personal data. These rules focused on customer consent, secure data storage, and responsible data sharing, but they mostly applied to private companies and didn’t fully address issues related to government agencies or the fast-changing cyber landscape.

Another major development was the creation of CERT-In, India’s cybersecurity response agency. CERT-In helps monitor and address cyber threats by issuing alerts and requiring organizations to report cybersecurity incidents. While this has improved India's ability to react to cyberattacks, overlapping regulations have sometimes made compliance challenging. The Reserve Bank of India (RBI) also introduced security guidelines for banks, but these were more sector-specific rather than part of a unified national cybersecurity framework¹¹.

Despite the IT Act’s importance, it has some shortcomings. Many of its provisions are outdated, enforcement remains weak, and it does not fully align with global cybersecurity standards. The Digital Personal Data Protection Act, 2023 helps fill some gaps, particularly in protecting personal information, but there is still a need for better coordination between the two laws. India’s cybersecurity laws have developed over time, but instead of one unified system, different laws and rules have been introduced to address specific needs. It all started with the Information Technology Act, 2000, which mainly focused on making electronic transactions and digital signatures legally valid. While it was important for digitization, it wasn’t designed to deal with cybersecurity threats.

To fix this, the government made important updates with the IT (Amendment) Act, 2008. This introduced Section 43A, which made businesses especially banks responsible for protecting customer data. If they failed, they could be held liable. This was a big shift in focus, moving from simply supporting digital transactions to actively securing personal information. However, enforcement remained weak, as there was no dedicated data protection authority.

To make data protection clearer, the SPDI Rules (2011) were introduced. These rules defined what qualifies as sensitive personal data and required businesses to follow security practices. But they mostly applied to private companies and didn’t fully address privacy rights or how the government handles data.

Then came CERT-In, India’s cybersecurity response agency. CERT-In plays a key role in managing cyber incidents by issuing alerts and requiring companies to report breaches. While it improved India’s ability to react to threats, businesses sometimes struggle with overlapping regulations, making compliance complex.

The RBI Cybersecurity Framework (2016) is another important regulation that specifically targets banks. It introduced stricter security measures like risk assessments and cyber audits to protect financial data. However, since it isn’t an official law, enforcement is limited to banks under RBI’s supervision¹².

The biggest step forward was the introduction of the Digital Personal Data Protection Act, 2023. Unlike earlier laws, this Act gives people more control over their data and clearly defines how businesses must handle personal information. But to work effectively, it must be properly integrated with the IT Act and RBI’s rules, which is still a work in progress.

Overall, while each law has a valid purpose, India’s cybersecurity framework is disconnected and sometimes confusing. There are overlapping rules, and enforcement isn’t always consistent. India needs a stronger, unified cybersecurity system that brings together the best parts of these laws to provide better protection in the digital age.

IV. Applicability and impact of the dpdp act, 2023 on the indian banking sector

The Digital Personal Data Protection Act, 2023 (DPDP Act) is a big step towards protecting personal data in India, especially in banking¹³. Since banks deal with a lot of sensitive customer information, this law makes sure they handle it responsibly.

Under the Act, banks are considered Data Fiduciaries, meaning they have a legal duty to protect customer data, use it only for legitimate purposes, and prevent misuse¹⁴. A major change in this law is that it gives individuals more control over their data¹⁵. Customers can now ask banks how their personal information is being used, request corrections if needed, and even demand that their data be deleted in certain cases. Banks also need to explain clearly why they’re collecting personal data and must seek consent where necessary.

Security is another key focus of the DPDP Act. Banks must put strong protection measures in place to prevent data breaches and immediately report serious incidents to the Data Protection Board of India¹⁶. If they fail to do so, they could face penalties. Some banks, classified as Significant Data Fiduciaries, will have extra responsibilities, such as appointing a Data Protection Officer (DPO) and regularly assessing risks associated with handling customer data.

This Act works alongside the existing Reserve Bank of India (RBI) cybersecurity guidelines, which already require banks to maintain strong security practices. But the DPDP Act gives these rules more legal weight and ensures uniform standards across industries.

In short, the DPDP Act helps make banking safer by giving customers stronger data rights and forcing banks to be more accountable. However, banks will have to work hard to ensure they follow all the new rules while also balancing older regulations, which may create some challenges.

V. Judicial interpretation of data protection in indian banking

The Foundation: Privacy as a Fundamental Right

The enforcement of privacy as a constitutional right under Article 21 of the Indian Constitution marked a milestone in data protection case law¹⁷. In the landmark Justice K.S. Puttaswamy v. Union of India (2017) case¹⁸, it was upheld that privacy is an integral aspect of personal liberty¹⁹. This verdict had a great impact on bank regulations since banking institutions deal with enormous amounts of sensitive personal information²⁰.

Prior to this ruling, privacy was not formally acknowledged as an essential right, and therefore, data protection legislation was inadequately enforced²¹. The Supreme Court ruling forced policymakers to enforce stronger legal frameworks, such as the Digital Personal Data Protection Act, 2023, which currently regulates the security of financial data²².

Banking Secrecy and Right to Information

One of the major cases that challenged the balance between confidentiality in banking and public interest was State Bank of India v. Reserve Bank of India (2021)²³. The case involved a situation where the RBI was requested to provide information regarding banks that had been penalized for regulatory breaches²⁴. SBI contended that disclosure of such information would breach customer confidentiality and damage the reputation of financial institutions²⁵.

The Supreme Court held that while banking secrecy is valuable, it cannot prevail over the right of the public to information, particularly when there is financial malfeasance. This ruling strengthened the doctrine that transparency in banking activities is crucial in upholding public confidence.

Intermediary Liability and Financial Data Protection

The Google India Pvt. Ltd. v. Visakha Industries (2020) case dealt with the liability of virtual intermediaries in breaches of financial information. The issue was whether virtual platforms should be held liable for providing space to content that resulted in financial fraud²⁶.

The Supreme Court judged that intermediaries are required to implement due diligence for the avoidance of financial scams and unauthorized disclosure of data. The ruling was immediately applied in the regulations on banking, compelling the Reserve Bank of India (RBI) to release tougher regulations for fintech firms and digital financial services²⁷.

Such judgments demonstrate the prominent position of the Indian judicial system that made the practice of establishing data protection standards in the financial and banking sphere. The judiciary has established the basis of a transparent and accountable digital banking ecosystem by addressing all the three primary concerns of privacy of individuals, confidentiality of the institutions, and the national interest. It is by these interpretations that the courts have been very keen in filling the gap between the laws that are a little bit behind the modern technologies that have made a lot of difference given the consumer protection and the regulatory accountability.

Challenges to Implementing Data Protection Laws in Indian Banking

One of the largest challenges in providing strong data protection in banking is the patchwork legal regime²⁸. In contrast to jurisdictions like the European Union, which boasts a unified General Data Protection Regulation (GDPR), India's data protection laws have developed in an ad-hoc fashion. The Information Technology Act, 2000, and RBI directives offer some protection, but they are not as detailed as necessary to tackle contemporary cybersecurity threats²⁹.

Moreover, the Digital Personal Data Protection Act, 2023, as a large step in the right direction, is in the initial stages of enforcement. Banks are grappling with compliance obligations, especially in terms of data localization and cross-border data flow³⁰. Most financial institutions are dependent on international cloud service providers, and limiting data storage in India is operationally challenging and expensive³¹.

Another major issue is cybersecurity vulnerabilities. Indian banks have faced millions of cyberattacks annually, ranging from phishing scams to ransomware attacks³². Despite RBI’s cybersecurity directives, many banks lack the infrastructure to detect and mitigate threats effectively³³. Smaller banks and regional financial institutions often do not have the resources to invest in advanced security measures, making them prime targets for cybercriminals.

In addition, third-party risks are increasingly on the rise. Banks more and more work with fintech firms, digital payment companies, and outsourcing organizations. Although these collaborations increase financial innovation, they also bring data security threats. Most third-party providers fail to follow strict cybersecurity guidelines, resulting in data breaches and unauthorized intrusions³⁴. The absence of universally standardized security controls among financial service providers complicates matters in providing equal levels of protection for customer data.

Consumer awareness and trust is another challenge. While customers are becoming increasingly aware of data privacy, most are not aware of their rights under new legislation³⁵. Banks find it difficult to inform customers about data protection policies, which results in miscommunication and compliance problems. Data breaches also chip away at public trust, which makes customers reluctant to embrace digital banking services.

VI. Implementation of data protection laws in banking

Despite such issues, banks are proactively implementing measures to improve data security. One such strategy is boosting cybersecurity infrastructure. Top banks are investing in artificial intelligence-based fraud detection systems, multi-factor authentication, and end-to-end encryption to protect financial transactions. Reserve Bank of India (RBI) has compelled banks to have regular cybersecurity audits to ensure that they comply with changing security norms.

Data localization compliance is another essential implementation strategy. The banking industry is being steadily transitioned to Indian-based server infrastructure, being compliant with the Digital Personal Data Protection Act, 2023. Though the shift is expensive, it provides more regulatory control and reduces the risks involved with foreign data breaches.

Additionally, banks are focusing on third-party risk management. Financial institutions are now conducting rigorous security assessments before partnering with fintech firms. Many banks require third-party vendors to comply with RBI’s cybersecurity guidelines, ensuring uniform security standards across financial services.

Consumer awareness programs are also picking up steam. Banks are introducing educational programs to make their customers aware of data protection rights, secure online banking procedures, and methods to prevent fraud. All these initiatives are focused on establishing trust and getting customers to embrace secure digital banking platforms.

Regulatory authorities are also increasing enforcement. The Data Protection Authority of India (DPAI), when operational, will enforce compliance audits, examine data breaches, and sanction banks that do not comply. This will make for a stronger enforcement mechanism that ensures financial institutions are compliant with strong data protection laws.

The implementation of strong data protection laws in the Indian banking sector is both a necessity and a challenge, given the evolving digital landscape. Banks are actively working to enhance their cybersecurity infrastructure by adopting artificial intelligence-driven fraud detection systems, multi-factor authentication, and end-to-end encryption to safeguard financial transactions. The Reserve Bank of India (RBI) has mandated regular cybersecurity audits to ensure that banks remain compliant with evolving security norms. One of the most critical aspects of implementation is data localization, as financial institutions transition to Indian-based server infrastructure to comply with the Digital Personal Data Protection Act, 2023. While this shift is costly, it strengthens regulatory oversight and minimizes the risks associated with foreign data breaches. Another crucial area of focus is third-party risk management. Banks frequently collaborate with fintech firms and digital payment companies, making stringent security assessments necessary before entering partnerships. Many banks now require third-party vendors to adhere to RBI’s cybersecurity guidelines, ensuring uniform protection across financial services. Additionally, consumer awareness initiatives are gaining momentum. Banks are launching educational programs to inform customers about their data protection rights, secure digital banking practices, and fraud prevention strategies. By fostering greater awareness, financial institutions aim to build trust and encourage customers to confidently embrace digital banking platforms. Regulatory enforcement is also set to strengthen with the establishment of the Data Protection Authority of India (DPAI). Once operational, this entity will conduct compliance audits, investigate data breaches, and impose penalties on banks that fail to meet security standards. The effectiveness of these efforts will ultimately determine the success of India’s financial data protection framework. With a combination of technological advancements, regulatory oversight, and consumer education, India can establish a resilient banking security system that ensures trust, compliance, and robust protection of sensitive financial information.

VII. Conclusion

The Indian banking sector is undergoing a transformative shift in response to rapid digitalization, necessitating stronger data protection measures. As financial transactions increasingly migrate to digital platforms, the volume of sensitive customer information being generated, processed, and stored has grown exponentially. This surge has heightened risks of data breaches, cyberattacks, and financial fraud, making stringent legal and institutional safeguards essential. The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) marks a significant step toward strengthening India’s regulatory framework for data security. However, legislative advancements alone are insufficient; the true test lies in their effective enforcement across all banking institutions. Regulatory compliance remains a pressing concern, as inconsistencies in implementation continue to pose challenges. The Reserve Bank of India (RBI) has issued cybersecurity guidelines to mitigate risks, yet smaller cooperative banks often lack the financial and technical resources required to establish robust protection mechanisms. Strengthening enforcement through scheduled audits, surprise inspections, and mandatory incident reporting can help bridge these gaps. Additionally, penalties must be consistently applied to deter non-compliance and ensure accountability. Technological preparedness is another critical aspect of banking cybersecurity. While private and multinational banks have adopted advanced security infrastructures, several public sector and rural banks continue to rely on outdated legacy IT systems, making them vulnerable to cyber threats such as malware, phishing attacks, and ransomware. To create a unified financial security environment, targeted investments in AI-driven threat detection systems, biometric authentication tools, end-to-end encryption, and multi-factor authentication are crucial. These measures can be facilitated through government funding, public-private collaborations, and capacity-building programs designed to modernize banking infrastructure. Moreover, data protection is not solely a technological challenge—it necessitates comprehensive awareness and training initiatives. Banking personnel must receive regular cybersecurity training and remain updated on compliance protocols under the DPDP Act. Concurrently, customer education initiatives should promote safe digital banking practices, including recognizing phishing attempts, safeguarding passwords, and securely navigating online transactions. Establishing a culture of privacy and digital hygiene within India’s financial ecosystem requires a combination of institutional reforms and widespread public awareness efforts. India can also draw inspiration from international best practices, particularly the European Union’s General Data Protection Regulation (GDPR), which has set a global benchmark for data privacy. GDPR’s emphasis on user consent, data minimization, the right to data erasure, and accountability in data processing offers valuable insights that could be integrated into India's banking regulations. Implementing privacy-by-design principles—where data protection is embedded within digital banking services from inception—can further enhance security standards. Additionally, as Indian banks expand globally, ensuring compliance with international data protection laws is imperative. Cross-border data transfer arrangements should align with established global standards, fostering collaboration between Indian regulators, foreign cybersecurity agencies, international fintech firms, and multilateral data protection bodies. Cyber threats transcend national boundaries, requiring India’s regulatory approach to be proactive, adaptive, and globally integrated. Another essential component of India’s data protection strategy is the creation of an independent Data Protection Authority, as envisioned in the DPDP Act. This body must be well-funded and autonomous, equipped with investigative powers, authority to impose penalties, and coordination capabilities with the RBI and other sectoral regulators. Addressing jurisdictional overlaps will enable a cohesive enforcement mechanism across industries, ensuring that banking institutions adhere to uniform data protection standards. In conclusion, while India has made commendable legislative progress with the DPDP Act and RBI’s cybersecurity guidelines, the success of these reforms will ultimately be determined by their implementation. Building a resilient digital banking framework requires a multifaceted approach, encompassing regulatory enforcement, technological advancement, compliance monitoring, global collaboration, and consumer education. If these elements are pursued with unwavering commitment, India has the potential to establish itself as a global leader in financial data protection—ensuring trust, security, and confidence among digital banking users.

*****

Footnotes

1. Author is a Student at School of Legal Studies, India.

2. Author is an Associate Professor at School of Legal Studies, India.

3. Arisha Khan, 'Regulatory Framework of Data Breaches in the Indian Banking Sector' (Amity Law School, Noida) ↩

4. Nishith Desai Associates, India – Data Protection in the Financial Sector (Nishith Desai Associates,) https://www.nishithdesai.com ↩

5. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1. ↩

6. InstaSafe, ‘RBI Guidelines for Cyber Security Framework’ (InstaSafe,) https://www.instasafe.com ↩

7. Ministry of Electronics and Information Technology, Digital Personal Data Protection Act 2023 https://www.meity.gov.in ↩

8. Information Technology Act 2000, No 21 of 2000. ↩

9. Ibid ↩

10. Ministry of Electronics and Information Technology, Digital Personal Data Protection Act 2023 https://www.meity.gov.in accessed 16 June 2023. ↩

11. CERT-In, Cyber Security & the CERT-In: A Report on the Indian Computer Emergency Response Team’s Proactive Mandate in the Indian Cyber Security Ecosystem (Ministry of Electronics and Information Technology. ↩

12. Reserve Bank of India, Annex to Circular on Cyber Security Framework in Banks (RBI, 2 June 2016) https://rbidocs.rbi.org.in/rdocs/content/pdfs/CYBER060216_A.pdf accessed 16 June 2025. ↩

13. The Digital Personal Data Protection Act 2023, Act No 22 of 2023 (India). ↩

14. Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act 2023 (MeitY, 2023) https://www.meity.gov.in/digital-personal-data-protection-act-2023 ↩

15. DLA Piper, Data Protection Laws of the World (DLA Piper, 2024) https://www.dlapiperdataprotection.com ↩

16. Latham & Watkins, ‘India's Digital Personal Data Protection Act, 2023 – A Comparative Overview’ (2023) https://www.lw.com ↩

17. V Bhandari, V Bhandari and A Padhi, ‘An Analysis of Puttaswamy: The Foundation of India's Data Protection Framework’ (2017) IndraStra Global https://www.indrastra.com ↩

18. Harman Preet Singh, Data Protection and Privacy Legal-Policy Framework in India: A Comparative Study vis-à-vis China and Australia ↩

19. S Saxena, ‘Justice K.S. Puttaswamy: A New Era for Privacy in India’ (2017) Centre for Internet & Society https://cis-india.org ↩

20. S Katiyar, ‘Impact of the Puttaswamy Judgment on Indian Banking Data Privacy’ (2018) LinkedIn Article https://www.linkedin.com ↩

21. A Chandrachud, ‘A Critique of the Indian Supreme Court's Privacy Decision’ (2017) 52(39) Economic and Political Weekly 10. ↩

22. T Bhardwaj, ‘India’s New Data Law: A Product of Puttaswamy?’ (2023) Law School Policy Review https://lawschoolpolicyreview.com ↩

23. State Bank of India v Reserve Bank of India (2021) SCC OnLine SC 456. ↩

24. P Raj, ‘RBI and the RTI: Between Transparency and Secrecy’ (2021) iPleaders https://blog.ipleaders.in ↩

25. Moneylife Digital Team, ‘Supreme Court Rejects Banks’ Appeal to Restrict RBI from Disclosing Defaulters’ List’ (2021) Moneylife https://www.moneylife.in ↩

26. Jayanta Ghosh and Uday Shankar, Privacy and Data Protection Laws in India: A Right-Based Analysis (2023) ↩

27. S Bansal, ‘Transparency vs. Privacy in Banking Regulation Post-Mistry Judgment’ (2021) Lawctopus Law Review https://www.lawctopuslawschool.com/law-review ↩

28. NITI Aayog, Data Protection Framework for India (2018) https://www.niti.gov.in ↩

29. S Panda, ‘The Need for an Overhaul of India’s Data Protection Regime’ (2021) Vidhi Centre for Legal Policy https://www.vidhilegalpolicy.in ↩

30. Dvara Research, Understanding Data Localization in the Context of Indian Banking (2023) https://www.dvara.com ↩

31. PwC India, Cloud Computing in Indian Financial Services (2022) https://www.pwc.in ↩

32. CERT-In, Annual Report on Cybersecurity Incidents (2023) https://www.cert-in.org.in ↩

33. Reserve Bank of India, Cyber Security Framework in Banks (2016) https://www.rbi.org.in ↩

34. EY India, Third-Party Risk Management in Indian Banking (2021) https://www.ey.com/en_in ↩

35. Centre for Internet and Society (CIS) India, Digital Literacy and Privacy Awareness Among Indian Banking Users (2022) https://cis-india.org ↩