What they may do · DPDP §6(4)
What HDFC Bank does with your data
A bank that collects biometrics alongside your KYC documents, uses your data to cross-sell and to assess your credit worthiness, shares it with an open-ended class it calls Processing Entities, and keeps records even beyond the end of your relationship with it.
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
HDFC Bank’s own policy says “With subsidiaries and/or affiliates in an effort to bring you improved services across our family of Products, when permissible under relevant laws and regulations or with consent.”
Our summary Policy, 'Who we share your Data with?': subsidiaries and affiliates across its family of products.
-
Builds an advertising profile of you
They watch what you view, tap and buy, and use it to decide which ads you see.
What this costs you. Your attention gets priced. What you hesitate over becomes a bid — and a profile built to predict you is a profile built to persuade you.
Show me where they say that
HDFC Bank’s own policy says “Subject to your specific consent in this regard, to sell, cross-sell, distribute or refer to you any Products (by us or through any of the Processing Entities) and for such purpose we may assess your credit worthiness or your eligibility through such means as feasible and for such activity we may also share the Data with/ receive from third parties.”
Our summary Policy, 'how we use Data': sells, cross-sells and refers products and assesses your credit worthiness, sharing data with third parties.
-
Keeps your records long-term
Held on after you stop using the service.
What this costs you. Years after you delete the app, the record is still sitting there — and every year it sits there is another year it can leak.
Show me where they say that
HDFC Bank’s own policy says “We will keep the Data we collect on our systems or with third parties for as long as required for the purposes set out above or even beyond the expiry of transactional or account based relationship with you”
Our summary Policy, 'Period of storage of the Data': kept even beyond the expiry of the transactional or account-based relationship.
-
Processes your face or other biometrics
Face matching, liveness checks or similar.
What this costs you. You can change a leaked password in a minute. You cannot change your face. A biometric breach is permanent in a way nothing else is.
Show me where they say that
HDFC Bank’s own policy says “Information such as your fingerprint, etc. that you choose to provide to us. We will not collect your biometric information without your explicit consent.”
Our summary Policy, data-collected list: collects fingerprint information, with explicit consent.
What the policy does not mention
These are uses HDFC Bank’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Follows you onto other websites and apps
- Trains AI models on your content
HDFC Bank is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · no account needed · built in India for the DPDP Act
Questions
What does HDFC Bank do with my personal data?
According to HDFC Bank's own privacy policy, read on 2026-08-12, it discloses 4 of the six uses we track: shares your data with partners, builds an advertising profile of you, keeps your records long-term, processes your face or other biometrics.
Can I withdraw my consent from HDFC Bank?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Does HDFC Bank track me for advertising?
Yes — HDFC Bank's published policy discloses this. The exact sentence it is based on is quoted on this page, with the date we read it and a link to the source.
Every use above is one HDFC Bank declared in its own published privacy policy, which we
read on 2026-08-12. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy