The NPCI Bharat BillPay Ltd. (NBBL) on June 09, 2026, issued a notification regarding reiteration of guidelines on usage of BBPS Customer Data.
The following has been stated:-
•Reiteration of Guidelines on Usage of BBPS Customer Data: The Bharat Bill Payment System (“BBPS”) remains committed to maintaining a safe, secure, and trusted ecosystem, with continued emphasis on safeguarding customer data.
•With reference to the Circular NPCI/2024-25/BBPS/005 dt. August 15, 2024, on “Data Security and Privacy Standard Framework for CCBP, existing BBPS Procedural Guidelines, and applicable regulatory requirements, it is hereby reiterated that all ecosystem participants, including Operating Units (OUs), Agent Institutions (AIs), Agents, and Service Providers, ensure strict adherence to data security, confidentiality, and usage guidelines, as outlined below:
a. Customer data collected during bill payment transactions or through registration shall be used only for transaction processing and customer service within the BBPS framework. Such data shall not be used, directly or indirectly, for any marketing, cross-selling, or promotional activities.
b. Participants shall ensure confidentiality and privacy standards are adhered to with diligence. Customer data shall not be used outside the BBPS framework or for any purposes other than those specified, in line with applicable guidelines. Where customer consent is required, customers shall be provided with a suitable opt-out option.
c. Customer data shall be stored, processed, and accessed only within authorized systems, supported by adequate security controls, and in compliance with applicable laws, including the Digital Personal Data Protection Act, 2023.
d. Participants shall undertake periodic internal reviews and audits to ensure end-to-end compliance with the prescribed guidelines.
•The responsibility for ensuring compliance with the above-mentioned requirements shall rest with the respective OUs, including their downstream participants (AIs, Agents, Service Providers). All members are advised to take note of the above and ensure immediate compliance across their systems and partner ecosystem.
The detailed notification is given in the document below.
[Notification No.: NPCI/2026-27/BBPS/006]
