Data Privacy in Partner Marketing: DPDP and GDPR for Financial Brands

By Yamm Labs · Updated October 2026 · 13 min read

The co-branding agreement between a credit card issuer and a travel app covers the revenue share, the logo lockup and who pays for the launch film. It says nothing about whose name sits on the lead form, or who keeps the record of what the customer agreed to. Under India’s Digital Personal Data Protection Act, those two silences decide who carries the liability when a customer complains or the Data Protection Board asks for proof.

What is partner marketing privacy for a bank, insurer or fintech?

Partner marketing privacy is the set of decisions about personal data that two or more companies make when they market together. For a financial brand that covers co-branded cards, referral partners, affiliates, loan and insurance aggregators, embedded-finance partners inside another company’s app, and the agencies and software vendors that run the campaigns. Every one of these arrangements moves a name, a phone number, sometimes a PAN or an income band, from one company’s system into another’s.

The Digital Personal Data Protection Act, 2023 sorts the companies in that chain by what they do with the data. A data fiduciary is any person who, alone or with others, decides the purpose and means of processing. A data processor is anyone who processes the data on a fiduciary’s behalf. The label in your contract does not settle it. What each party decides in practice does.

That gives a partner programme three possible shapes for any single data flow:

• Fiduciary and processor: You decide the purpose; the partner only executes, as a CRM vendor, a call centre or a performance agency running your form does.
• Two separate fiduciaries: Each company collects for its own purpose and passes data across, as an aggregator does when it collects a loan enquiry on its own page and hands it to an NBFC.
• Fiduciaries acting together: Both companies set the purpose jointly, as in a co-branded card campaign where the bank and the brand partner agree on the list, the message and the follow-up.
• A processor that drifts: A vendor hired to execute starts using your leads for its own pitches. It is now deciding purpose, and the arrangement you signed no longer describes what is happening.

The partner who designs the form usually decides who carries the liability, so decide it before anyone designs the form.

Why partner data privacy matters more for a regulated brand

A regulated brand carries the liability even when a partner touches the data. The DPDP Act makes the fiduciary responsible for processing done on its behalf by a processor, irrespective of any agreement to the contrary. An indemnity clause can move money after the fact. It does not move the duty.

The second reason is proof. Where consent is the basis for processing and a question comes up in a proceeding, the Act puts the burden on the fiduciary to show that a notice was given and consent was obtained. A bank that buys leads from a partner and cannot produce the notice text, the timestamp and the screen the customer saw has nothing to show the Board. “The partner told us they had consent” is a claim, not a record.

The penalties are large enough for a CFO to read the clause. According to the Press Information Bureau’s November 2025 explainer on the DPDP Rules, 2025, failing to keep reasonable security safeguards can attract up to ₹250 crore, failing to notify a breach or breaching obligations on children’s data up to ₹200 crore each, and other violations up to ₹50 crore.

Then there is the sector layer, which sits on top of DPDP and does not replace it. RBI’s digital lending directions keep the regulated lender fully responsible for what its lending service providers do, including how they handle borrower data. IRDAI’s 2024 policyholder-protection regulations require an insurer’s written approval before a distribution channel issues an advertisement. TRAI’s commercial communication rules require promotional messages to go out under registered headers and approved templates. A partner campaign for a financial brand has to clear all of these, in the brand’s name.

Here is how that changes a real design decision. Take a hypothetical insurer running a term-plan offer inside a fintech partner’s app. Because the insurer is the fiduciary for the quote and the partner is a distribution channel, the consent screen names the insurer by its registered name, appears before the first field asks for date of birth or income, and links to the insurer’s own privacy notice. The partner’s logo can sit on the page. The partner’s consent text cannot stand in for the insurer’s.

The clock matters too. Parliament enacted the Act on 11 August 2023, and the government notified the DPDP Rules on 14 November 2025, according to PIB. Under the Rules, the provisions on consent managers start one year after publication, which falls in November 2026. The notice, security, breach and retention rules start eighteen months after publication, around May 2027. As of October 2026, partner contracts signed now will still be running when those duties bite.

SIGNALNewsletter by Yamm Labs

The next piece, straight to your inbox.

New writing on BFSI brands, B2B and influencer marketing, and AI search.

Email *

Subscribe

Subscription form is not available at the moment

One click to unsubscribe. Privacy policy

How partner lead-sharing works under DPDP and GDPR, in five parts

Partner lead-sharing under DPDP works in five parts, and each part repeats the same question: who decides, and who can prove it. The order below is the order a lead travels.

1. The role map. For each data flow, write down who is fiduciary and who is processor. A partner can be your processor for one flow and a separate fiduciary for another. The European Data Protection Board’s guidelines on controller and processor make the same point for GDPR: roles are judged per processing operation, from what each party does.
2. The notice at capture. The Rules require a notice that can be understood on its own, an itemised list of the personal data, the specific purpose, and links to withdraw consent, use rights and complain to the Board. The Act also requires the option to read the request in English or any language in the Eighth Schedule to the Constitution. If the lead is meant for you, the notice has to name you and your purpose as well as the partner.
3. The contract. The Act lets a fiduciary use a processor only under a valid contract, and the Rules expect that contract to carry security safeguards. Where both companies are fiduciaries, write a data-sharing agreement that states each party’s purpose, what the receiving party may and may not do, and who answers the customer.
4. The handover and the record. The lead should arrive with its consent artefact attached: notice version, timestamp, channel and the purposes ticked. When personal data goes to another fiduciary, the Act requires the sender to ensure it is complete, accurate and consistent. The Rules also require a fiduciary to keep personal data, traffic data and processing logs, including its processors’ logs, for at least one year for specified purposes.
5. Withdrawal and erasure downstream. Withdrawing consent has to be as easy as giving it. Once a customer withdraws, the fiduciary must stop processing within a reasonable time and make its processors stop. When the purpose is served or consent is withdrawn, it must erase the data and make its processors erase it, unless a law requires retention.

GDPR handles the third shape, two companies deciding together, with a formal label. The EDPB’s guidelines give the example of two companies sharing client and prospect data to plan an event for a co-branded product; it treats them as joint controllers, who must agree in a transparent arrangement who does what and make the essence of it available to customers. The guidelines also describe a direct-marketing vendor, hired as a processor, that starts using its client’s customer database for its own business. For that processing it becomes a controller, and the use breaches GDPR.

The Gulf follows the same split. The UAE’s Personal Data Protection Law, Federal Decree Law No. 45 of 2021, came into force on 2 January 2022 and prohibits processing without consent outside listed exceptions; the DIFC has its own Data Protection Law. Saudi Arabia’s data authority, in its guide to the Personal Data Protection Law, says a controller must ensure the processors it engages fully comply with the law. It lists a company selling a customer database to an advertising agency, without a lawful basis or a notice, as bad practice.

The table below compares the common partner models against the five parts. The role column is our reading of typical set-ups, not a legal opinion on any specific contract.

How to start a partner data privacy review in four weeks

Start with the partners already live, not the contract template. A review of existing flows finds the gaps that a new template only prevents in future deals. The plan below assumes a marketing head, a compliance reviewer and one person from the CRM or data team.

1. Week one, list every partner that touches personal data. Include agencies, call centres, aggregators, affiliates, co-brand partners and the software that sits between them. For each, note which forms and which fields they see.
2. Week two, draw the role map. For each flow, mark fiduciary or processor and write one sentence on why. Where the answer is “it depends”, that flow goes first in the queue.
3. Week three, pull ten leads per partner and trace them. For each lead, find the notice the customer saw, the timestamp and the purposes. Count how many you can prove end to end.
4. Week four, fix the contract gaps and the screens. Add processing terms where a processor has none, data-sharing terms where two fiduciaries share, and a withdrawal route that reaches every system.

Two things speed this up. Your compliance team will want the role map as a single page, because it is the document they defend. Our compliance and creative work starts from that page for the same reason: the consent screen, the disclaimer placement and the approval step all depend on whose name the customer sees first.

How to measure partner marketing privacy

Measure partner marketing privacy with ratios you can pull from your CRM each month, not with a yearly audit opinion. Each metric below has a name, a formula and what it shows.

• Consent-record match rate. Leads received with a complete consent artefact, divided by all leads received from that partner. It shows whether you could defend the partner’s leads in a proceeding.
• Withdrawal propagation time. Time from a customer’s withdrawal to the last system confirming it has stopped processing. It shows whether “within a reasonable time” is something you can evidence.
• Processor contract coverage. Processors with a signed processing contract, divided by all processors on the role map. It shows the gap the Act’s valid-contract requirement leaves open.
• Purpose drift incidents. Cases in a quarter where a partner used data outside the stated purpose. It shows which partner has quietly turned into a separate fiduciary.

A hypothetical worked example shows why the first ratio belongs in the media report. Say an NBFC pays ₹12 lakh a month for 8,000 aggregator leads, which is ₹150 a lead. A trace finds that 5,000 of them carry a full consent record. The cost per lead it can lawfully use is ₹12 lakh divided by 5,000, or ₹240.

Cost per usable lead = monthly partner spend ÷ leads with a complete consent record

The ₹90 gap matters less than what it reverses: the cheapest partner on cost per lead can be the most expensive on cost per usable lead, and the performance team will only see it if the consent field is captured at the first click.

What goes wrong in partner lead-sharing, and the early signs

Most partner privacy failures start as a convenience that nobody wrote down. The early signs are visible in ordinary operations long before a complaint arrives.

That last row comes straight from the Rules. On becoming aware of a breach, the fiduciary must inform each affected customer without delay and give the Board detailed information within seventy-two hours, unless the Board allows longer. If your processor learns of the breach first and tells you a week later, you have already lost most of that window.

When sharing leads with a partner is the wrong choice

Sharing lead data is the wrong choice when you cannot prove consent for the data you would receive. A partner that will not change its form, show you its notice or send a timestamp with each lead is selling you a liability with a phone number attached. In that case, route the customer to your own page and collect the data yourself.

It is also the wrong choice when the partner’s purpose and yours cannot be written in one honest sentence each. If the brand partner wants the data for its own loyalty programme and you want it for a credit decision, two separate consent requests on two separate screens are cleaner than one shared form that tries to cover both. The DPDP Act limits consent to data necessary for the specified purpose, and one form with two purposes usually asks for too much.

Finally, be careful with partners who are hard to bind. A small creator, a regional DSA or an overseas affiliate network may not sign a processing contract or keep logs for a year. If you cannot enforce the terms, pay them for referrals to your page and keep the data in your own systems. The Act lets the central government restrict transfers to notified countries, so overseas partners need a fresh check whenever a notification is issued.

What to tell your compliance team about partner data privacy

You can paste the following into an email. “We have mapped each partner data flow and marked who is fiduciary and who is processor. Every lead we receive from a partner now carries a consent record with notice version, timestamp and purposes, and leads without one are rejected. Processors work under signed contracts with security, breach-notice and erasure terms, and withdrawals reach every system within a set time that we log. The role map and the consent records are kept by the CRM team and reviewed monthly.” Add: this is general guidance, not legal advice; your compliance team decides.

For brands in the Gulf or Europe, the same email works with the local terms swapped in. Under GDPR the roles are controller and processor, joint controllers need a transparent arrangement, and the EDPB’s examples are the place to check your reading. In Saudi Arabia the controller stays accountable for the processors it engages. The role map is the same document under each of these laws. The financial brands we work with are listed on our clients page.

People also ask

Is a marketing agency a data fiduciary or a data processor under the DPDP Act?

An agency that runs your campaign on your instructions and uses the leads only for you is usually your data processor, and you remain the fiduciary. If the agency starts using that data for its own purposes, such as pitching other clients, it is deciding purpose and behaves like a fiduciary for that processing. The contract should forbid it, and your audit should check it.

Can a bank buy leads from an aggregator under India’s data protection law?

It can, but the bank must be able to show that the customer saw a notice naming the bank and consented to that purpose. The Act puts the burden of proving notice and consent on the fiduciary. Ask for the consent record with each lead and reject leads that arrive without one.

When do the DPDP Rules apply to partner marketing?

The government notified the Rules in November 2025. The consent manager provisions start one year after publication, and the notice, security, breach and retention rules start eighteen months after publication, around May 2027. Contracts signed today should already reflect those duties.

How is DPDP different from GDPR for partner data sharing?

Both split the chain into the party that decides and the party that only processes, and both hold the decider responsible for its processors. GDPR gives jointly deciding companies a formal joint-controller label with a required arrangement. The DPDP Act covers joint decisions inside its definition of a data fiduciary and puts more weight on the fiduciary proving consent.