NPCI Announces UPI Privacy Update to Strengthen User Data Protection
Table of Contents
India’s National Payments Corporation of India (NPCI) has introduced a major UPI privacy update, directing all UPI applications and partner banks to strengthen the protection of customer information by September 4. The new guidelines are designed to improve user privacy across the country’s digital payments ecosystem while supporting compliance with the Digital Personal Data Protection (DPDP) law.
With billions of transactions processed every month, UPI has become an essential part of everyday payments in India. The latest measures aim to reduce unnecessary exposure of users’ personal information without affecting the speed or convenience of digital transactions.
What Does the UPI Privacy Update Mean for Users?
As part of the UPI privacy update, payment apps such as PhonePe, Google Pay, and Paytm will display only the last four digits of a user’s mobile number during transactions. For QR code-based payments, mobile numbers will no longer be visible after the payment is completed.
NPCI has also instructed payment providers to make username-based Virtual Payment Addresses (VPAs) the default identifier for new users instead of automatically generating UPI IDs using mobile numbers. This change is expected to reduce the sharing of personal contact information during digital payments while improving user privacy.
Why NPCI Introduced These New Privacy Rules
The UPI privacy update follows growing concerns about the visibility of personal information during digital transactions. Reports indicate that many users, particularly women, have raised complaints about harassment, identity exposure, and personal safety risks after their mobile numbers became accessible during payments.
To address these concerns, NPCI has instructed banks and UPI apps to mask sensitive information across customer-facing interfaces. Along with mobile numbers, the directive also covers UPI IDs and account numbers, wherever applicable.
The changes also align with the broader implementation of India’s Digital Personal Data Protection (DPDP) law, which requires organisations handling personal information to minimise unnecessary exposure of customer data.
How Banks and UPI Apps Will Be Affected
Banks and payment service providers have been given approximately five weeks to implement the required technical updates before the September 4 deadline.
The changes include updating payment interfaces, modifying how customer information is displayed during transactions, and introducing username-based VPAs for new users. These improvements are intended to enhance privacy while ensuring that the UPI payment experience remains smooth and efficient.
The UPI privacy update represents one of the most significant privacy-focused changes introduced to India’s digital payments infrastructure in recent years.
Key Highlights of the Directive
| Update | Details |
| Mobile number display | Only the last four digits will be visible during transactions |
| QR code payments | Mobile numbers will not appear after payment completion |
| Default UPI identifier | Username-based VPAs for new users |
| Additional privacy protection | UPI IDs and account numbers to be masked where applicable |
| Implementation deadline | September 4 |
| Purpose | Enhance user privacy and support DPDP compliance |
Why This Matters
India’s UPI platform is one of the world’s largest real-time payment networks, processing billions of transactions every month. As digital payments continue to expand, protecting personal information has become increasingly important for users, banks, and payment providers alike.
The UPI privacy update is expected to improve trust in digital payments by reducing the exposure of sensitive customer information during transactions. By introducing stronger privacy measures and aligning with India’s evolving data protection framework, NPCI aims to create a safer payment environment without compromising the convenience that has made UPI widely adopted.
Conclusion
The latest UPI privacy update marks an important step towards improving privacy across India’s digital payments ecosystem. By requiring UPI apps and partner banks to mask sensitive information, limit the visibility of mobile numbers, and introduce username-based VPAs for new users, NPCI is reinforcing its commitment to protecting customer data. As the September 4 implementation deadline approaches, these measures are expected to strengthen user confidence while supporting the continued growth of secure and privacy-focused digital payments in India.
