Parliament Question: Unauthorized Access to Bank Account Details of Customers

GOVERNMENT OF INDIA MINISTRY OF FINANCE DEPARTMENT OF FINANCIAL SERVICES LOK SABHA STARRED QUESTION NO. *502 ANSWERED ON MONDAY, MARCH 30, 2026/CHAITRA 09, 1948 (SAKA) Unauthorized Access to Bank Account Details of Customers *502. SHRI MANOJ KUMAR: Will the Minister of FINANCE be pleased to state: (a) whether the Government is aware that officials within banks and financial institutions are able to access detailed customer bank account information such as balances, transaction history, KYC details and other financial data without the explicit knowledge of the account holder, if so, the details thereof; (b) whether the Government has received any complaints regarding unauthorized or unexplained access to peoples bank account details by bank officials or third-party service providers, if so, the details thereof; (c) whether the Government proposes to introduce a regulatory framework requiring that every instance of access to an individual’s bank account data by any bank official and third-party service providers be mandatorily logged with details such as timestamp, employee identity and purpose of access, if so, the details thereof; and (d) whether the Government proposes to direct the RBI to establish a “Customer Data Access Log” system and real-time notification mechanism so that account holders are informed through SMS and email whenever their financial data is accessed and if so, the details thereof? ANSWER THE MINISTER OF FINANCE (SMT. NIRMALA SITHARAMAN) (a) to (d): A statement is laid on the Table of the House. *****STATEMENT FOR LOK SABHA STARRED QUESTION NO. *502 FOR MARCH 30, 2026, REGARDING “UNAUTHORIZED ACCESS TO BANK ACCOUNT DETAILS OF CUSTOMERS” BY SHRI MANOJ KUMAR, HON’BLE MEMBER OF PARLIAMENT. (a) to (d): Privacy and confidentiality in financial services, offered by Regulated Entities (REs) of the Reserve Bank of India (RBI) and governed under various Statutes, warrant the observance of secrecy by the REs on the customer related information. REs are required to observe statutory compliance with regard to their obligation as to fidelity and secrecy under various laws, including, inter alia, - (i) State Bank of India Act, 1955 (section 44) (ii) Banking Companies (Acquisition and Transfer of Undertakings) Act, 1970/1980 (section 13) (iii) Regional Rural Banks Act, 1976 (section 25) (iv) Credit Information Companies Act, 2005 (Section 29) (v) The Public Financial Institutions (Obligation as to Fidelity and Secrecy) Act, 1983 (Section 3) These statutes require banks to observe secrecy and not divulge any information relating to or to the affairs of its constituents except when there is a compulsion of law or there are circumstances which, in accordance with law or practices and usages customary among bankers, necessary or appropriate for it to divulge such information. Public Sector Banks (PSBs) have informed that access to customer’s account information is role-based, need-based and permitted only to authorized officials of the concerned bank for legitimate business purposes, and customer data access logs are maintained as part of system audit trails. As per RBI’s Directions on Managing Risks in Outsourcing for various REs, access to customer information by a service provider or its staff is to be on a ‘need to know’ basis, and banks are required to ensure that a service provider is able to isolate and clearly identify the bank’s customer information, documents, records, and assets to protect the confidentiality of the information. RBI has informed that no information is available with it on unauthorized or unexplained access to customers’ bank account details by bank officials or third-party service providers. Further, in terms of Reserve Bank of India (Credit Information Companies) Directions, 2005, Credit Information Companies (CICs) have to notify customers via SMS or email when their Credit Information Report is accessed by the specified users viz., credit institution and CICs.RBI issues guidelines related to consumer data protection from time-to-time, and as part of its supervisory review process, it regularly monitors and ensures compliance of data protection guidelines issued by it and other bodies. The Government has passed Digital Personal Data Protection (DPDP) Act, 2023 which is an overarching law to protect personal data of individuals. Further, the DPDP Rules, 2025 have been notified on 14.11.2025. The DPDP Act, 2023 and DPDP Rules, 2025 form a clear and citizen-centred framework for responsible use of digital personal data. As per information provided by PSBs, compliance to data protection guidelines as issued by the concerned regulatory and oversight bodies, including, inter alia, RBI, Unique Identification Authority of India, Indian Computer Emergency Response Team and other Government bodies, is being adhered to by PSBs. Banks have aligned their Information Security Policy and Cybersecurity Policy with the best practices and regulatory guidelines. *****