How a PSU Banking Giant is Rewiring Finacle Core Banking for DPDPA

1. Bank of Baroda (BOB)

Key technical and operational specifications specified in the Bank of Baroda tender include:

• The 5-Minute Hard Rule: When a customer revokes consent, BOB requires the privacy platform to invalidate that consent and update downstream systems—including Finacle CBS, enterprise CRM, and marketing analytics—within a strict 5-minute SLA.
• Enterprise Data Discovery: Automated deep-scanning of both structured databases (Oracle, DB2) and unstructured file stores to locate and catalog Indian identifiers including Aadhaar numbers, PAN, and Driving Licences.
• 24-Week Phased Rollout: Phase 1 delivers digital consent management and onboarding for new customers, while Phase 2 extends consent tracking to legacy customer accounts and across the bank's network of 8,400+ branches.

2. Central Bank of India

Central Bank of India's technical mandates emphasize deep legacy interoperability and automated governance:

• AI-Powered Assessments: Utilizes embedded artificial intelligence to auto-populate Data Protection Impact Assessments (DPIA) and Records of Processing Activities (ROPA), significantly reducing manual compliance overhead.
• Mainframe Integration: Explicitly requires compliance verification and consent enforcement across legacy mainframe transaction processing systems alongside modern iOS and Android banking apps.
• Automated Data Scrubbing: Instant programmatic suppression of telemarketing dialers, promotional SMS lists, and analytical profiling pipelines the moment a customer opts out of secondary processing.

3. Jammu & Kashmir Bank (J&K Bank)

The J&K Bank specifications focus on multilingual accessibility and deep endpoint visibility:

• 22 Constitutional Scheduled Languages: Implementation of a public Data Principal Rights portal and consent banners with dynamic, verifiable translations across all 22 official languages recognized in the Eighth Schedule to the Constitution of India.
• Desktop & Laptop Endpoint Discovery: Deployment of lightweight discovery agents on bank-owned employee workstations, desktops, and branch laptops to unearth unencrypted spreadsheets, PDFs, and stray customer records.
• 3 Years of Post-Go-Live Advisory: Contractually mandates that the selected SI partner provide dedicated legal and technical regulatory advisory for a full 36 months following deployment to manage evolving Data Protection Board of India (DPBI) rules.

4. SBI Payment Services (SBI Payments)

SBI Payments' mandate is centered on merchant contract redesign and fast-track governance execution:

• Pure Governance & Contractual Alignment: Enterprise gap assessments, multi-tier data lifecycle mapping across 5 distinct phases, and comprehensive restructuring of Data Processor Agreements (DPAs) across all merchant and third-party vendor relationships.
• Compressed 6-Month Execution: Under a 12-month contract tenure, the entire core compliance framework, gap remediations, and legal SOPs must be finalized within the first 24 weeks.
• Multi-Channel Consent Withdrawal: Architecting synchronous consent revocation workflows across web portals, mobile apps, SMS triggers, email links, and customer support telephone channels.

5. Life Insurance Corporation of India (LIC)

LIC represents the largest single operational scope disclosed in the public financial sector:

• Full Hardware & Appliance Provisioning: Unlike banking tenders that deploy on existing virtualized clusters, LIC mandates that the vendor supply dedicated physical server racks, appliances, and infrastructure for both Primary DC and DR sites alongside software licensing.
• 24 Full-Time Onsite Specialists: Stationing 24 dedicated resources—including Project Managers, Privacy Lead Analysts, and Infrastructure Engineers—physically inside LIC's Central Office in Mumbai.
• 12 Specialized Privacy Modules: End-to-end software suite covering automated ROPA, DPIA workflows, Vendor Risk Management, Data Principal Rights intake, consent lifecycle management, and Breach Incident Response pipelines.

6. Key Architectural Takeaways for Technology Leaders

Examining these tenders exposes the emerging baseline for enterprise DPDPA technical readiness across India: