Yes, bank customer data sharing is legally permitted in India in certain circumstances, but it is not unrestricted. Banks hold sensitive information such as account details, transaction records, contact information, KYC documents and financial history. Because of the confidential relationship between a bank and its customer, banks are expected to protect this information and disclose it only when there is a valid legal, regulatory or customer-authorised basis.
The Reserve Bank of India (RBI) recognises customer confidentiality as an important banking obligation.
What Is Bank Customer Data?
Bank customer data can include:
- Name, address and contact details
- PAN and other KYC information
- Bank account numbers
- Transaction and payment records
- Credit and repayment information
- Nominee and related account details
- Digital banking and authentication information
- Financial information collected during banking relationships
Some of this information is particularly sensitive because unauthorised disclosure could expose customers to financial fraud, identity theft or privacy risks.
Is Bank Customer Information Confidential?
Yes.
Indian banking practice recognises a duty of confidentiality arising from the banker-customer relationship. RBI guidance identifies four commonly recognised circumstances in which disclosure may be permitted: where disclosure is required by law, where there is a public duty to disclose, where the bank’s interests require disclosure, and where the customer has given express or implied consent.
This means a bank cannot generally treat customer information as freely transferable commercial data.
For example, a bank cannot simply disclose a customer’s account information to an unrelated business for marketing without considering its confidentiality obligations and the applicable legal requirements.
Can Banks Share Data With Other Companies?
Banks may share certain customer information with third parties when there is a legitimate and permitted purpose.
For example, banks may use external service providers for technology, payment processing, customer support, document management or other outsourced activities. RBI’s outsourcing framework requires banks to protect customer information and ensure appropriate confidentiality and security arrangements with service providers. Access should be appropriately controlled, including on a need-to-know basis.
The fact that a bank uses a third-party service provider does not remove the bank’s responsibility to protect customer information.
Can Banks Share Data for Marketing?
This area is subject to important restrictions.
RBI has specifically stated that information collected from customers for KYC purposes should be treated as confidential and should not be disclosed for cross-selling or other unrelated purposes. Where banks want to collect information for purposes other than KYC, RBI guidance says it should be collected separately on a voluntary basis after explaining the purpose and obtaining the customer’s approval for the intended use.
Therefore, using KYC information simply to create marketing lists or promote unrelated products can raise confidentiality and data-protection concerns.
Is Customer Consent Enough to Permit Data Sharing?
Customer consent can provide an important legal basis for sharing information, but it should not necessarily be viewed as unlimited permission.
RBI guidance concerning credit cards, for example, requires customer information to be shared with other persons or organisations only with appropriate consent concerning the purposes and organisations involved. It also requires clear explanation of the implications of the disclosure.
A customer should therefore understand what information is being shared, why it is being shared, and with whom it is being shared.
Banks must also comply with other applicable legal and regulatory requirements even where consent exists.
Can Banks Share Information With Government Authorities?
Yes, where disclosure is required or authorised under applicable law.
Banks may be required to provide information to government agencies, courts, regulators, law-enforcement authorities or other legally authorised bodies. Such disclosures can arise from investigations, taxation requirements, anti-money-laundering obligations, court proceedings or other statutory requirements.
The bank’s confidentiality obligation does not prevent disclosures that are legally compelled or otherwise fall within recognised exceptions.
Can Banks Share Credit Information?
Yes, certain credit information can be shared through legally regulated mechanisms.
For example, banks and other regulated entities may report credit information to authorised Credit Information Companies in accordance with the applicable legal and regulatory framework. RBI has separately prescribed requirements concerning credit information reporting.
This is different from casually sharing a customer’s complete financial profile with an unrelated third party.
What About Outsourced Banking Services?
Banks frequently rely on technology companies, payment processors and other service providers. Such arrangements do not mean that customer data becomes freely available to those companies.
RBI’s outsourcing guidance requires contracts to address confidentiality, security, access to records and preservation of data. Service providers should protect customer information, and appropriate controls should be maintained over access and security.
If a service provider mishandles confidential customer information, the bank may face regulatory and contractual consequences depending on the circumstances.
What Laws Protect Bank Customer Data?
Bank customer information is governed by a combination of banking regulations, contractual confidentiality obligations and India’s broader data-protection framework.
The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data in India. The government also notified the Digital Personal Data Protection Rules, 2025 and published an implementation timeline in November 2025.
Banks therefore need to consider both sector-specific RBI requirements and applicable data-protection obligations when handling personal data.
What Can a Customer Do About Unauthorised Data Sharing?
If a customer believes a bank has improperly shared personal or financial information, they should first make a written complaint to the bank and clearly identify the information involved, the suspected recipient and the circumstances of disclosure.
The customer should preserve emails, SMS messages, account statements, consent forms, privacy notices and other relevant records. If the bank’s response is unsatisfactory, the customer can consider the applicable banking grievance-redressal mechanism and, where relevant, other regulatory or legal remedies.
Conclusion
Bank customer data sharing is legally permitted in India, but only within applicable legal, regulatory and confidentiality boundaries. Banks can disclose information when required by law, when recognised public or banking interests apply, when appropriate customer consent has been obtained, or when sharing is necessary for permitted banking functions.
However, customer information collected for KYC or account-opening purposes cannot simply be treated as unrestricted commercial data for marketing or unrelated activities. Banks and their service providers are expected to maintain confidentiality, security and appropriate controls over customer information.
For customers, the key distinction is between authorised and necessary data sharing and disclosure that has no valid legal, regulatory or consent-based purpose.
