The PMLA–DPDP Tension: Reconciling Anti-Money Laundering Obligations with India’s Data Protection Framework

India's anti-money laundering regime and its new data protection regime are converging on the same underlying resource the transaction, identity and behavioural data that banks, financial institutions and other reporting entities collect from every customer while pulling in opposite doctrinal directions. The Prevention of Money Laundering Act, 2002 (“PMLA”) requires reporting entities to identify customers and beneficial owners, retain client and transaction records for five to ten years, and report suspicious transactions using an expansive evidentiary base that regulatory guidance now explicitly extends to IP addresses, device identifiers and behavioural patterns. The Digital Personal Data Protection Act, 2023 (“DPDP Act”), now partially in force following its phased notification between November 2025 and May 2027, is built on the opposite premise: purpose limitation, storage limitation, and a data principal's rights to correction and erasure. This paper maps the resulting tension across five fronts retention versus erasure, purpose limitation versus algorithmic suspicion-generation, consent fiction versus deemed consent, an asymmetric exemption structure that shields enforcement agencies from DPDP obligations while binding the private reporting entities that feed them data, and the friction between the DPDP Act's rights architecture and the Enforcement Directorate's entrenched practice of non-disclosure, upheld by the Supreme Court in Vijay Madanlal Choudhary v. Union of India (2022) and currently, as of a reconstituted bench in August 2026, under review. The paper traces this tension to a deeper constitutional history: the Supreme Court's 2018 ruling in the Aadhaar case that mandatory Aadhaar–bank account linking under the PMLA Rules failed the Puttaswamy proportionality test, a precedent that anticipated, by five years, the very conflict the DPDP Act's law-enforcement exemptions were designed to pre-empt. The paper concludes with a set of proposals scoped retention definitions, siloing of AML analytics from ordinary commercial processing, and proportionality-anchored limits on the state-instrumentality exemption for reconciling the two regimes as DPDP's remaining provisions come into force.