Case studies · Banking, India

A bank in India runs its DPDP duties on its own infrastructure

Consent, rights requests and breach timelines tracked against the DPDP Act and Rules, and AI use governed, with everything running in India on the bank's own infrastructure.

WheelhouseDutiesDPDP Act and Rules
Open duties3 open
  • Breach report to the Data Protection BoardDetailed report within 72 hoursBreach
  • Grievance: access to personal dataData principal request #1,204Rights
  • Grievance: correction of addressData principal request #1,207Rights
Each clock starts when the duty is logged · record #3,377
Illustrative product view. Sample data, not client data.

The problem

The bank must show DPDP compliance work for millions of customers while keeping customer data in India under RBI's data localisation rules. It also wants staff to use AI without personal data leaving the bank.

  • 72 hoursbreach report timeline tracked from awareness
  • In Indiadata and records on the bank's infrastructure
  • Each dutylinked to its section of the Act and Rules

Before Raidu

  • Consent kept in spreadsheets
  • Rights requests tracked by email
  • No view of personal data across systems

With Raidu

  • Consent you can prove, per customer
  • Requests answered within their deadlines
  • Personal data found in each connected source

The challenge

The DPDP Act and Rules give data principals rights to access, correct and erase their data, require consent that can be shown, and set a 72-hour window for a detailed breach report to the Data Protection Board. A bank also has to keep customer data in India. The bank needs one place to run these duties and prove them.

How they set it up

Wheelhouse runs on the bank’s own infrastructure in India. It connects to the bank’s data sources, finds personal data, and tracks consent, rights requests and breach timelines against the section of the Act or Rules each comes from. Tower sits in front of the AI tools staff use, redacting personal data before any model call and recording each decision.

Deployment note

Isolated or air-gapped deployment is something to discuss with us for your environment. Talk to us about what your infrastructure team requires.

Rollout

  1. Step 1Wheelhouse installed on the bank's infrastructure in India
  2. Step 2Sources connected; personal data discovered
  3. Step 3Consent, rights and breach workflows live; Tower in front of AI tools

What they deployed

  • Wheelhouse: consent records, rights requests and breach timelines mapped to the DPDP Act and Rules
  • Data discovery: personal data found in the bank's connected sources
  • Tower: redaction before any model call, and a record of each decision

Talk to us about your data and AI.

Tell us what you need to prove and to whom. We will show you the record it produces.

Talk to us