India’s digital banking revolution has transformed the financial ecosystem. Mobile banking apps, instant loans, and digital KYC have made banking more convenient than ever. But beneath the convenience lies a growing concern: are banks quietly leveraging customer data for commercial gain while consumers remain largely unaware?
India’s three largest lenders State Bank of India (SBI), HDFC Bank, and ICICI Bank are considered systemically important institutions because their operations are critical to the country’s financial stability.
As digital banking expands, these institutions now hold unprecedented amounts of sensitive customer data from Aadhaar and PAN details to transaction histories and behavioral spending patterns.
The question being increasingly asked by privacy advocates is whether the digital banking boom has also created an ecosystem where customer data itself becomes a monetizable asset.
The Expanding Data Economy in Banking
With digital onboarding, centralized data lakes, and AI-driven financial services, banks are collecting and processing far more customer information than in the past.
Experts say that traditional banking records once stored in physical branches are now digitized and analyzed to generate insights for credit scoring, cross-selling financial products, and risk analytics.
However, investigations into banking privacy policies have revealed troubling gaps. A report analyzing major banks found that eight out of ten banks do not clearly specify what personal information they collect, even though they gather sensitive identifiers such as PAN and Aadhaar numbers.
In some cases, banks were found collecting additional information unrelated to basic banking services, including employment details or demographic data during account opening.
This raises a key concern: how much of this data collection is necessary, and how much is designed to fuel analytics-driven revenue models?
Fraud and Data Breach Incidents Raise Red Flags
The risks of massive digital data pools became clear during the 2016 Indian banking data breach, when malware compromised around 3.2 million debit cards across several banks including SBI, HDFC Bank, and ICICI Bank.
Years later, another controversy emerged when a server associated with SBI’s SMS banking system reportedly exposed customer information such as mobile numbers, balances, and transaction details due to a misconfigured database.
Similarly, a major data exposure linked to HDB Financial Services a subsidiary of HDFC Bank reportedly affected over 70 million customer records, including personal identification details and loan information.
These incidents highlight the inherent risk of centralized digital banking systems: the more data banks accumulate, the more valuable and vulnerable that data becomes.
Consent Mechanisms Under Scrutiny
Another controversial area is how customer consent for data sharing is obtained.
Under India’s Account Aggregator framework, financial institutions can share financial data across lenders and fintech platforms with customer approval. However, banking executives themselves have acknowledged potential issues.
An SBI managing director warned that customers often grant “single consent” for multiple financial services without fully understanding the implications, because many people do not read the fine print before authorizing data sharing.
If consent mechanisms are poorly understood by users, critics argue that data-driven monetization could occur without meaningful awareness from the customer.
u
Regulatory Safeguards and the Counter-Argument
Despite these concerns, regulators emphasize that banks are legally bound to protect customer information.
Under India’s Digital Personal Data Protection (DPDP) Act, banks are classified as “data fiduciaries,” meaning they must collect only necessary data, obtain valid consent, and implement strong safeguards against breaches.
Banks also argue that data analytics primarily serves legitimate purposes such as fraud prevention, credit evaluation, and personalized financial services not unauthorized commercialization.
The Real Question for the Digital Era
India’s banking system is undergoing a historic digital transformation. But with vast data ecosystems emerging inside financial institutions, the line between customer service and data monetization is becoming increasingly blurred.
The challenge for regulators, banks, and consumers alike will be ensuring that innovation does not outpace accountability.
In the era of digital banking, the real currency may no longer be money alone it may be data.
