Lok Sabha Question No. 502 (STARRED), answered on 2026-03-30
Subject: Unauthorized Access to Bank Account Details of Customers
Ministry: FINANCE
Asked by: Shri Manoj Kumar

## GOVERNMENT OF INDIA MINISTRY OF FINANCE DEPARTMENT OF FINANCIAL SERVICES

## LOK SABHA STARRED QUESTION NO. *502

ANSWERED ON MONDAY, MARCH 30, 2026/CHAITRA 09, 1948 (SAKA)

## Unauthorized Access to Bank Account Details of Customers

*502.  SHRI MANOJ KUMAR:

Will the Minister of FINANCE be pleased to state:

(a) whether the Government is aware that officials within banks and financial institutions are able to access detailed customer bank account information such as balances, transaction history, KYC details and other financial data without the explicit knowledge of the account holder, if so, the details thereof; (b) whether  the  Government  has  received  any  complaints  regarding  unauthorized  or unexplained access to peoples bank account details by bank officials or third-party service providers, if so, the details thereof; (c) whether  the  Government  proposes  to  introduce  a  regulatory  framework  requiring  that every instance of access to an individual's bank account data by any bank official and third-party  service  providers  be  mandatorily  logged  with  details  such  as  timestamp, employee identity and purpose of access, if so, the details thereof; and (d) whether the Government proposes to direct the RBI to establish a 'Customer Data Access Log' system and real-time notification mechanism so that account holders are informed through SMS and email whenever their financial data is accessed and if so, the details

- thereof?

THE MINISTER OF FINANCE (SMT. NIRMALA SITHARAMAN)

- (a) to (d): A statement is laid on the Table of the House.

*****

## ANSWER

## STATEMENT FOR LOK SABHA STARRED QUESTION NO. *502 FOR MARCH 30, 2026, REGARDING 'UNAUTHORIZED ACCESS TO BANK ACCOUNT DETAILS OF CUSTOMERS' BY SHRI MANOJ KUMAR, HON'BLE MEMBER OF PARLIAMENT.

(a) to (d): Privacy and confidentiality in financial services, offered by Regulated Entities (REs) of  the  Reserve  Bank  of  India  (RBI)  and  governed  under  various  Statutes, warrant  the observance of secrecy by the REs on the customer related information. REs are required to observe statutory compliance with regard to their obligation as to fidelity and secrecy under various laws, including, inter alia , -

- (i)  State Bank of India Act, 1955 (section 44)
- (ii)  Banking Companies (Acquisition and Transfer of Undertakings) Act, 1970/1980 (section 13)
- (iii)  Regional Rural Banks Act, 1976 (section 25)
- (iv)  Credit Information Companies Act, 2005 (Section 29)
- (v)  The  Public  Financial  Institutions  (Obligation  as  to  Fidelity  and  Secrecy)  Act,  1983 (Section 3)

These statutes require banks to observe secrecy and not divulge any information relating to or to  the affairs of its constituents except  when there is a compulsion of law or there are circumstances  which,  in  accordance  with  law  or  practices  and  usages  customary  among bankers, necessary or appropriate for it to divulge such information.

Public Sector Banks (PSBs) have informed that access to customer's account information is role-based, need-based and permitted only to authorized officials of the concerned bank for legitimate  business  purposes,  and  customer  data  access  logs  are  maintained  as  part  of system audit trails. As per RBI's Directions on Managing Risks in Outsourcing for various REs, access to customer information by a service provider or its staff is to be on a 'need to know' basis, and banks are required to ensure that a service provider is able to isolate and clearly identify the bank's customer information, documents, records, and assets to protect the confidentiality of the information. RBI has informed that no information is available with it on unauthorized or unexplained access to customers' bank account details by bank officials or third-party service providers.

Further, in terms of Reserve Bank of India (Credit Information Companies) Directions, 2005, Credit Information Companies (CICs) have to notify customers via SMS or email when their Credit Information Report is accessed by the specified users viz., credit institution and CICs.

RBI issues guidelines related to consumer data protection from time-to-time, and as part of its  supervisory  review  process,  it  regularly  monitors  and  ensures  compliance  of  data protection guidelines issued by it and other bodies. The Government has passed Digital Personal Data Protection (DPDP) Act, 2023 which is an overarching law to protect personal data of individuals. Further, the DPDP Rules, 2025 have been notified on 14.11.2025. The DPDP Act, 2023 and DPDP Rules, 2025 form a clear and citizen-centred framework for responsible use of digital personal data. As per information provided by PSBs, compliance to data protection guidelines as issued by the concerned regulatory and oversight bodies, including, inter alia, RBI, Unique Identification Authority  of  India,  Indian  Computer  Emergency  Response  Team  and  other  Government bodies, is being adhered to by PSBs. Banks have aligned their Information Security Policy and Cybersecurity Policy with the best practices and regulatory guidelines.

*****