Understanding how my data is secure.
-
UPI's 21 billion monthly transactions raise the question: shouldn't we be more concerned about how banks and the NPCI protect our metadata rather than just our anonymity? Should I be focusing more on understanding our new data protection laws than on chasing impossible anonymity?
-
In the 2026 Indian market, chasing "anonymity" on UPI is like trying to stay dry in a monsoon — it's nearly impossible. With 21 billion monthly transactions, the metadata (who you pay, where, and how often) is indeed the real goldmine.
You’re absolutely right to shift focus: The Digital Personal Data Protection (DPDP) Act, 2023, and the recently notified 2025 Rules are now your primary shields. They mandate that banks and the NPCI (as "Data Fiduciaries") must secure your data and, crucially, delete it once its purpose is served.