What the DPDP Act requires
Accountability under the DPDP Act starts with knowing the personal data you hold, and Section 8 requires reasonable security safeguards to protect it. For regulated and sensitive sectors — banking, NBFCs, healthcare — handing your raw data to a third party just to “discover” it is itself a risk, and cuts against data minimisation.