Cooperative banks and credit societies under the DPDP Rules: core banking, KYC and security duties

Urban cooperative banks, district central cooperative banks, primary credit societies and regional banking networks handle personal data across deposit accounts, gold and agricultural loans, mobile banking apps, Aadhaar-linked payment bridges and cheque clearing. As regulators tighten cybersecurity expectations for cooperative lenders, the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 add a second layer of statutory duties that will take effect on 13 May 2027.

Why cooperative banks face distinct compliance pressure

Unlike large private commercial banks that run dedicated security operations centres and in-house privacy desks, most cooperative banks operate on shared core banking platforms hosted by state federations, external technology service providers or application service vendors. A single branch clerk often handles account opening, passbook printing, know-your-customer document scanning and loan recovery follow-ups on the same desktop terminal.

Under the data protection law, size and legal form do not create an exemption. A cooperative society or bank registered in India is a Data Fiduciary whenever it decides why and how member, depositor or borrower personal data is processed. Whether a cooperative bank holds ten thousand depositor records or ten lakh accounts across multiple districts, it carries full statutory responsibility for consent notices, reasonable security safeguards, vendor contracts, one-year audit logs and 72-hour breach reporting.

Where personal data flows across a cooperative banking branch

Mapping how personal data moves through a cooperative bank reveals why paper forms and shared vendor terminals need immediate attention before 13 May 2027. Even when a member fills out a paper account-opening form or a physical loan application at a rural or semi-urban counter, the law applies the moment those details are typed into a core banking system or scanned into a document folder.

Shared core banking vendors and NABARD or federation hosts

Many urban and rural cooperative banks rely on a hosted core banking solution, an ATM switch operator, a card personalisation bureau or a state federation data centre. Under the Act, each of these external technology providers acts as a Data Processor because it processes depositor and borrower data on the bank's instructions.

The statute places two non-negotiable duties on the cooperative bank as the Data Fiduciary:

• The bank remains legally responsible for complying with the Act and the Rules regardless of any clause to the contrary in its agreement with the core banking vendor or hosting provider.
• The bank may engage a Data Processor to process customer personal data only under a valid contract that obliges the processor to maintain reasonable security safeguards, restrict employee access, keep one-year visibility logs and report any personal data breach without delay.
• If a breach occurs at an outsourced ATM switch, SMS gateway or core banking data centre, the cooperative bank itself must notify the Data Protection Board of India without delay, file the detailed report within 72 hours and notify every affected depositor or borrower.

Notice, regional languages and closed-account retention

Cooperative banks serve depositors and borrowers who often read regional languages rather than English. The law requires every consent notice to be presented in clear and plain language, and gives the individual the option to access the notice in English or in any of the twenty-two languages listed in the Eighth Schedule to the Constitution. For a cooperative bank operating in Maharashtra, Gujarat, Karnataka, Kerala or Tamil Nadu, offering the standalone notice in English and the local state language is a straightforward way to meet the statutory standard.

When a member closes a savings account or repays a loan in full, banking regulations still require the cooperative bank to retain the account ledger and know-your-customer records for a fixed multi-year period. The Act explicitly recognises this requirement: personal data must be erased when the specified purpose is no longer served, unless retention is necessary for compliance with any law for the time being in force. Branch staff should be trained to explain that statutory banking records remain locked under legal hold while optional promotional contact lists are erased upon request.

Our view: a seven-step readiness plan for cooperative bank boards

In our view, directors, chief executives and IT heads of cooperative banks and credit societies should complete seven practical steps ahead of 13 May 2027: