AIF Operations Under India's DPDP Act: What Every Fund Manager Needs to Know (2025 Update)
By Parth Gala & Bhavya Sureka · 2026-03-18
India's Alternative Investment Fund industry manages commitments exceeding ₹13.49 trillion as of FY25 — and projected to reach ₹43.64 lakh crore by 2028. Behind every rupee of that capital lies a trail of sensitive personal data: investor identity documents, bank statements, address proofs, tax declarations, UBO disclosures, and a host of other materials that flow continuously to KYC providers, fund administrators, auditors, RTAs, and cloud storage platforms. Until recently, no comprehensive Indian law specifically governed what happened to that data once it left the fund manager's systems.
That position has now changed. The Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), notified by MeitY on 13 November 2025, have brought India's first full-fledged data protection framework into operational effect. AIF managers sit squarely within its scope — and the obligations it creates are material, enforceable, and carry penalties of up to ₹250 crore per violation.
Why the DPDP Act Is Different: Data as a Fiduciary Liability
The Constitutional Foundation
The DPDP Act draws its legal foundation from the landmark Supreme Court judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), which established the right to privacy as a fundamental right under Article 21 of the Constitution of India. This constitutional grounding means that data protection is not a regulatory technicality — it is a fundamental rights obligation that the law now gives operational form to.
What the DPDP Act Governs
The Act governs how "digital personal data" — any information that can identify a living individual, stored or transmitted in digital form — is collected, processed, stored, shared, and deleted. It applies to:
- Any organisation processing personal data within India
- Organisations outside India that offer goods or services to individuals located in India
For AIFs, this is not an abstract question of applicability. Every investor onboarding, every capital call communication, every distribution statement, and every audit process involves the personal data of real, identifiable individuals. The DPDP Act governs all of it.
Key Definitions: The Roles Every AIF Manager Must Understand
Data Fiduciary
Any person or entity that determines the purpose and means of processing personal data. In the AIF context, the Investment Manager, Fund Manager, Sponsor, and Board of Trustees become the Data Fiduciary the moment they collect investor information. This is the most consequential designation — it carries the primary compliance obligations and enforcement exposure under the Act.
Data Principal
The individual to whom the personal data belongs. For AIFs, this is primarily the investor — whether an individual HNI, Beneficial Owner, family office representative, authorised signatory of a corporate investor, or fund employee.
Data Processor
Any third party that processes personal data on behalf of the Data Fiduciary. This includes KYC verification agencies, fund administrators, RTAs, auditors, legal advisors, and cloud platforms — all of whom handle investor data within an AIF's ecosystem. Critically, the Data Fiduciary remains accountable for how its Data Processors handle investor data, even after that data has left the fund manager's own systems.
Personal Data Breach
Any unauthorised access, disclosure, alteration, or loss of personal data — ranging from a major cyberattack to an investor statement accidentally sent to the wrong email address. The DPDP Act's breach notification obligations apply to both.
Significant Data Fiduciary (SDF)
Entities notified by the Central Government based on data volume, sensitivity, or risk — including large-scale AIF managers and fintech-integrated funds — face enhanced audit requirements, mandatory DPO appointment, and periodic Data Protection Impact Assessments.
Why AIFs Are Directly in the DPDP Act's Crosshairs
The Multi-Layered Investor Data Trail
Unlike sectors where data collection is limited and transactional, AIF operations involve continuous, multi-layered data flows across the entire fund lifecycle. A single investor's data may touch the fund manager's CRM, a KYC agency's platform, the RTA's database, the fund administrator's software, the auditor's secure portal, and a cloud storage service — all within one fund cycle.
At Onboarding:
- Identity documents (passport, Aadhaar, PAN)
- Address proofs and bank account details
- UBO declarations for corporate or trust investors
- Tax residency declarations (FATCA/CRS)
- Risk profiling and suitability assessments
During Fund Operations:
- Capital call notices and payment confirmations
- NAV statements and portfolio updates
- Distribution advices and annual reports
- Tax computation certificates (Form 64C/64D)
- Audit-related data requests
At Exit:
- Redemption requests and payout details
- Capital gains statements
- Final account settlements
The DPDP Act holds the Data Fiduciary (fund manager) accountable for how data is handled at every one of these points. In practical terms, an AIF and its Investment Manager are expected to handle investor personal data with a level of responsibility that is very similar to how they handle investor money.
Core DPDP Obligations for AIF Operations
Consent: The Cornerstone of Data Processing
Under the DPDP Act, personal data can only be processed for a lawful purpose — and in most cases, this requires the free, specific, informed, and revocable consent of the investor. Consent must not be:
- Buried within a PPM as a general catch-all clause
- Presented alongside non-negotiable terms with no real investor choice
- Obtained through pre-ticked boxes or confusing language — referred to as "dark patterns" under the DPDP Rules
The prohibition of "bundled consent" is the most significant operational hurdle for AIFs. A fund cannot make the provision of investment services conditional upon the investor's consent to use their data for secondary purposes — such as marketing other fund schemes or sharing data with group entities for cross-selling. Each secondary purpose requires a distinct, clear affirmative action from the investor.
What a valid consent notice must include:
- What personal data is being collected
- The specific purpose for which it is collected
- Who it will be shared with (categories of vendors, KYC agencies, RTAs, auditors)
- How long it will be retained
- How the investor can withdraw consent or raise a grievance
- A visible contact point for data-related queries
The DPDP Rules, 2025 require this notice to be in plain language, separate from other documents, and accessible in a manner that allows investors to make a genuine, informed choice.
Purpose Limitation and Data Minimisation
Once data is collected for a stated purpose, it can only be used for that purpose. An AIF cannot collect extensive KYC information and then use it for unrelated marketing, investor profiling beyond what was disclosed, or sharing with group entities without separate authorisation.
Data minimisation requires that AIFs collect only what is genuinely necessary for the stated purpose — nothing more. For fund operations teams, this means periodically auditing data collection forms and processes to eliminate unnecessary fields and reduce the volume of personal data in circulation across the ecosystem.
Data Accuracy and Storage Limitation
Fund managers must ensure that investor master data — contact information, bank account details, authorised signatories — is kept accurate and up to date. An investor statement going to the wrong address or a capital call notice sent to an outdated email is not merely an operational error under this law; it is a potential DPDP violation.
Personal data must be deleted once the purpose for which it was collected is served, unless retention is required by law or regulation. AIFs must develop formal data retention schedules that map each category of investor data to:
- The applicable statutory retention period under SEBI regulations, PMLA, Income Tax Act, and other applicable laws
- The date from which the retention period begins
- The process and evidence trail for deletion once the period expires
Investor Rights: Enforceable Statutory Entitlements
The DPDP Act grants investors a set of enforceable statutory rights. AIF managers must build internal processes to honour these rights within prescribed timelines. Data Fiduciaries must respond to rights requests within a maximum of 90 days.
| Right | What It Means for AIF Investors |
|---|---|
| Right to Access | Investor can request a summary of their personal data being processed and how it is being used |
| Right to Correction | Investor can request correction of inaccurate or outdated personal data |
| Right to Erasure | In certain situations, investor can request deletion of personal data |
| Right to Grievance Redressal | Investor can raise a complaint and receive a response from the fund manager |
| Right to Withdraw Consent | Investor can withdraw consent at any time, with effect going forward |
| Right to Nominate | Investor can nominate another person to exercise their data rights on their behalf |
Fund managers should establish a clear intake, verification, and response workflow — including for requests submitted through authorised signatories or nominees.
Breach Notification: Speed Is a Legal Requirement
Under the DPDP Act, every personal data breach must be reported — there is no minimum severity threshold or de minimis exception. Common AIF breach scenarios include:
- An investor statement sent to the wrong email address
- A KYC document shared with an unauthorised internal team member
- A vendor cyberattack exposing investor records
- An unsecured shared folder with investor data made accessible
The dual notification requirement:
- Notify affected investors without delay, in plain language, covering what happened, the possible impact on their data, steps taken by the fund, and a contact point for assistance
- Notify the Data Protection Board of India without delay, with detailed information required within 72 hours (or a longer period if expressly permitted by the Board)
Fund managers should run periodic breach drills so that the 72-hour Board reporting window is operationally achievable — not a target discovered only when an incident actually occurs.
Vendor Management: The Non-Delegable Accountability
This is one of the most operationally significant aspects of the DPDP Act for AIFs. The fund manager, as Data Fiduciary, remains accountable for how its vendors (Data Processors) handle investor data — even when data has left the fund manager's own systems.
A KYC agency data breach, a fund administrator's unsecured upload portal, or a cloud storage misconfiguration is not a vendor's problem alone. It is the fund manager's regulatory exposure.
DPDP-aligned vendor contracts must include:
- Scope and purpose of personal data being shared
- Reasonable security safeguards the vendor must maintain
- Incident escalation timelines and evidence-sharing obligations
- Data retention and disposal procedures at the end of the engagement
- Audit rights allowing the fund manager to verify compliance
Legacy vendor agreements designed purely for commercial convenience will need to be reviewed and upgraded to meet this standard. Section 8(1) of the DPDP Act establishes absolute, vicarious liability — an AIF Manager cannot contractually limit its liability for a data breach caused by a fund administrator. The Data Protection Board will hold the AIF Manager accountable for failing to ensure "reasonable security safeguards" regardless of any agreement to the contrary.
The SEBI–DPDP Dual Compliance Stack: Navigating the Retention Paradox
The Conflict Between Erasure Rights and SEBI Record Retention
AIFs operate under SEBI and RBI regulations that mandate retention of records for extended periods — typically 5 to 8 years — to facilitate audits and prevent money laundering. The DPDP Act simultaneously introduces the Right to Erasure under Section 12, allowing an investor to request deletion of their personal data once the purpose for which it was collected is fulfilled or consent is withdrawn.
The Act resolves this directly: data must be erased unless its retention is necessary for compliance with any law for the time being in force. An AIF Manager can lawfully refuse an erasure request where SEBI regulations or PMLA mandate retention — but this refusal must be carefully documented. Once the statutory retention period expires, the obligation to erase arises automatically.
| Regulation | Retention Mandate | DPDP Act Interaction |
|---|---|---|
| SEBI (AIF) Regulations, 2012 | Audit trails and investor records for the life of the fund plus prescribed years | Retention is "necessary for compliance with law"; overrides erasure request |
| PMLA / KYC Guidelines | Identity and transaction records for 5 years after end of business relationship | Retention is mandatory; investor cannot demand immediate deletion upon exit |
| DPDP Act Section 8(8) | Deemed "cessation of purpose" after 3 years of inactivity for certain sectors | Triggers proactive erasure if no other legal mandate applies |
CSCRF and DPDP: A Combined Compliance Obligation
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), notified in August 2024, sets baseline cybersecurity standards for SEBI-regulated entities. The DPDP Act adds a privacy, accountability, and breach notification layer on top of the cybersecurity baseline. These are not alternatives — they are a combined compliance obligation that fund managers must satisfy simultaneously.
SEBI's February 2026 circular mandating NAV reporting of AIF units to depositories through RTAs creates a repeatable, multi-entity data flow. Every such repeatable workflow is a point where access controls, audit trails, and secure data transfer protocols must be formally embedded, not left to informal practice.
Significant Data Fiduciaries: Higher Obligations for Larger Managers
The SDF Designation and What It Triggers
The DPDP Act creates a special designation — Significant Data Fiduciary ("SDF") — for entities identified by the Central Government based on volume of personal data processed, sensitivity of the data, potential risk to data principals, and national security considerations.
SDFs face additional obligations beyond the baseline framework:
- Appointment of a Data Protection Officer (DPO) based in India
- Engagement of an independent data auditor
- Periodic Data Protection Impact Assessments (DPIAs)
- Additional accountability and governance requirements
Designation criteria are yet to be fully notified — but larger AIF managers, those with numerous investors across multiple schemes and a wide vendor ecosystem, should begin preparing for possible SDF classification. The compliance burden upon designation can be substantial, and early preparation is far less disruptive than reactive restructuring.
Penalty Framework: The Cost of Non-Compliance
The Data Protection Board of India, established as a statutory body under Section 18 of the DPDP Act, is the enforcement authority with powers to investigate violations, adjudicate complaints, and impose substantial penalties.
| Violation | Maximum Penalty |
|---|---|
| Failure to implement reasonable security safeguards | ₹250 crore |
| Failure to notify Data Protection Board and affected individuals of a breach | ₹200 crore |
| Violations related to processing of children's data | ₹200 crore |
| Breach of other obligations under the Act or Rules | ₹50 crore |
These penalties operate independently of and in addition to any enforcement action SEBI may take under its own framework for the same underlying incident. A single data breach involving investor KYC data could simultaneously attract DPBI penalties and SEBI enforcement — a compounding exposure that fund managers cannot afford to treat as a theoretical risk.
What AIF Managers Must Do Now: A Practical Compliance Roadmap
Immediate Actions
Consent architecture review: Audit all existing investor documentation — PPMs, subscription agreements, KYC forms, and onboarding materials — to identify where consent is currently buried or bundled, and redesign consent flows to meet the DPDP Act's specificity and separation requirements.
Data mapping exercise: Document every category of investor personal data collected, every system it passes through, every vendor it is shared with, and every applicable retention period. This data map is the foundation of all subsequent DPDP compliance work.
Vendor contract review: Review all existing agreements with KYC agencies, fund administrators, RTAs, auditors, and cloud providers against the DPDP Act's vendor management requirements. Upgrade contracts to incorporate data processing scope, security safeguards, incident escalation, disposal procedures, and audit rights.
Structural Buildouts
Grievance and rights response workflow: Establish an intake, verification, and response process for investor data rights requests — with documented procedures for the 90-day response window and clear escalation paths for complex requests.
Breach response playbook: Develop and test a breach response protocol that is calibrated to the 72-hour DPBI notification requirement — including roles, responsibilities, communication templates, and evidence documentation procedures.
Data retention schedule: Map all categories of investor data to their applicable statutory retention periods under SEBI regulations, PMLA, and income tax law — and establish automated or documented processes for deletion once those periods expire.
Nodal officer or DPO designation: Appoint an internal officer with operational accountability for DPDP compliance. For managers that may qualify as Significant Data Fiduciaries, begin evaluating the DPO appointment requirement proactively.
Conclusion: Privacy Is Now a Governance Standard for AIFs
The DPDP Act fundamentally changes the compliance landscape for Alternative Investment Funds. Investor personal data is no longer just a KYC requirement or an operational input — it is a regulated asset that must be collected with consent, used only for disclosed purposes, protected with documented safeguards, shared only with contractually bound processors, and deleted when its purpose is served.
The compliance obligations this creates are not peripheral. They touch every part of an AIF's operations — onboarding, capital calls, portfolio reporting, vendor management, audit processes, and investor communications. And the penalties for non-compliance — up to ₹250 crore from the DPBI, plus potential concurrent SEBI enforcement — make the cost of inaction clear.
For AIF managers, the path forward requires:
- Consent architecture that meets the DPDP Act's specificity, separation, and plain language requirements
- Data mapping across the full investor data lifecycle and vendor ecosystem
- Vendor contracts upgraded to reflect Data Processor accountability obligations
- Rights response and breach notification workflows calibrated to statutory timelines
- Retention schedules that navigate the SEBI-DPDP compliance stack coherently
- SDF readiness for larger managers with high investor volumes across multiple schemes
The funds that treat data privacy as a core governance function — rather than a compliance afterthought — will be better positioned to raise capital, retain investor confidence, and navigate the evolving regulatory landscape with the credibility that sophisticated investors increasingly demand.
This analysis is based on the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 notified by MeitY on 13 November 2025. It is intended for informational purposes only and should not be construed as legal or compliance advice. AIF managers should consult their legal and compliance advisors to assess the implications of the DPDP Act for their specific fund structures, data flows, and investor documentation.
Building DPDP Act compliance into your AIF's operations? Contact Navigate AIF to learn how our platform supports fund managers with consent management, data mapping, vendor contract review, and investor rights response workflows — designed specifically for the AIF regulatory environment.
Tags: #DPDPActAIF #DigitalPersonalDataProtection #AIFDataPrivacy #DPDPRules2025 #InvestorDataProtection #DataFiduciaryAIF #AIFKYCCompliance #DataBreachAIF #NavigateAIF
