Axis Bank, HDFC Bank and Kotak Mahindra Bank each describe work under the Act in their annual reports for 2025-26. This entry records what each report says, in the bank’s own terms, without assessing it.
Listed banks publish a Business Responsibility and Sustainability Report with their annual report, and its format asks about data privacy and data breaches. In their reports for the year ended 31 March 2026, the three banks below also described work under the Digital Personal Data Protection Act, 2023 directly. The Forum records what each said. It does not assess whether what is described is adequate, and it does not compare the banks. They appear in alphabetical order.
These are the reports the Forum has read so far. Other banks will be added as their reports are read. A bank’s absence from this entry says nothing about it.
In its governance section, Axis Bank’s Integrated Annual Report 2025-26 says that data protection is strengthened through encryption, data minimisation, tokenisation and better consent management, supported by data classification, retention governance and lineage. It states that compliance with data protection laws “is ensured through controlled access, API security, and privacy assessments”, including the Digital Personal Data Protection framework.
The report also records the bank’s policy work through FICCI during the year: draft recommendations on the notified rules under the Act from a banking, financial services and insurance perspective, and ongoing work under the FICCI DPDP Act Sub-Committee, including common frameworks for personally identifiable information and privacy impact.
HDFC Bank’s Business Responsibility and Sustainability Report for 2025-26, published within its Integrated Annual Report, lists Digital Personal Data Protection among the subjects of training and familiarisation programmes for its Board of Directors and Key Managerial Personnel.
Under the heading Data Privacy Framework, the report describes a privacy governance framework that includes a designated data privacy officer, cross-functional privacy teams and a clear chain of responsibility for privacy matters. It states that the bank performs a data protection or privacy impact assessment to identify privacy risk in new and existing offerings, and that individuals are given privacy notices and the opportunity to give informed consent.
Kotak Mahindra Bank’s Integrated Annual Report 2025-26 describes a Digital Personal Data Protection framework grounded in seven principles of data privacy: consent, purpose, accuracy, retention, security, transparency and accountability. It states that data rights such as access, correction, erasure, grievance redressal and consent withdrawal are enabled through a dedicated Data Protection Officer and a governance structure led by a DPDP Implementation Committee, chaired by the Group Chief Risk Officer with the Chief Technology Officer as co-chair.
Its Business Responsibility and Sustainability Report says the bank is progressively strengthening its alignment with the DPDP framework, and continues to enhance its data governance frameworks, consent management processes and privacy controls.
The HDFC Bank and Kotak Mahindra Bank reports each answer the format’s question on the number of data breaches in the year and their impact. The Forum does not set those figures side by side. They are self-reported, measured by each bank on its own basis, and a table of them would invite a comparison the figures cannot support. They can be read in the reports themselves.
They establish what each bank chose to say in its annual report, on the date it said it. They do not establish that the arrangements described meet the Act, and the Forum does not suggest they do or do not. The provisions they relate to come into force in May 2027, as the timeline entry sets out.
Compiled 25 September 2026. This entry records published documents. It is not an assessment of any organisation and carries no regulatory force. To report an error or ask for a reply to be recorded, see how the Casebook is compiled.
Back to the Casebook, or read the notes on the Act in the Bulletin.