Digital Onboarding
Customer acquisition, identity, KYC and device signals create high-control data entry points.
Fintech · India Privacy Readiness
Fintech DPDP Readiness Built Around Real Products, Data Flows and Control Evidence
DataConsultant helps fintech organisations convert the phased Digital Personal Data Protection framework into an actionable readiness programme across customer journeys, personal-data processing, notices and consent, rights, vendors, security, retention, analytics, AI and operational evidence.
Map personal data across onboarding, KYC, payments, lending, support, analytics and partners
Translate approved legal interpretation into control, workflow, architecture and evidence requirements
Prioritise remediation against the notified 2026–2027 commencement window
Connect privacy readiness with applicable fintech, security, vendor and AI governance obligations
Readiness support, not legal advice or certification. Applicability depends on the organisation, processing context, current notifications, exemptions and sector-specific obligations.
DPDP Readiness Control Room
Phased readiness
Fintech control lenses
- Mobile and web acquisition, onboarding and KYC journeys
- Payment, lending, wallet, fraud and customer-service data
- APIs, cloud services, processors, LSPs and partner ecosystems
- Analytics, customer profiling, model features and GenAI use
- Consent, rights, grievance, retention, deletion and breach evidence
Notified timeline
13 Nov 2025Board / administrative provisions commenced
13 Nov 2026Consent Manager-related provisions scheduled
13 May 2027Core duties, rights and most operational Rules scheduled
API Ecosystems
Data moves rapidly among apps, gateways, cloud services, regulated entities and specialised partners.
Transaction & Risk Data
Payment, credit, fraud and servicing records may be reused across operational, analytical and assurance contexts.
Analytics & AI
Scoring, fraud models, personalisation and AI support can create new processing and inference paths.
Layered Obligations
DPDP readiness may sit alongside RBI, payment, lending, security, contractual and other sector requirements.
The Fintech Privacy Problem Is Operational, Not Merely Documentary
Fast product releases, embedded partners, mobile telemetry, outsourced processing, event streams and analytical reuse can make it difficult to answer basic questions consistently: what personal data is processed, why it is needed, where it moves, which control applies, who owns it and what evidence proves the control is working.
Fragmented readinessHigher execution and evidence risk
- Product teams maintain separate data maps or no current map at all
- Notice, consent and permission logic is disconnected from downstream use
- Vendor and API data flows are documented inconsistently
- Retention and deletion rules differ across product databases, lakes and backups
- Rights and grievance requests rely on manual cross-team coordination
- Security and breach evidence is spread across tools and owners
- AI and analytics reuse is not traceable to approved purpose and data sources
Controlled readinessTraceable, testable and implementation-ready
- Defined processing and personal-data inventory tied to fintech processes
- Approved notice, consent and withdrawal requirements translated into product controls
- Processor, partner and cross-border flows recorded with clear responsibility boundaries
- Retention, legal-hold and deletion decisions mapped to systems and evidence
- Rights and grievance workflows have owners, identity checks, routing and audit trail
- Security and breach controls are mapped to evidence, testing and escalation
- Analytics and AI uses are reviewed for purpose, provenance, access and oversight
Use the Notified Commencement Schedule as a Programme Planning Constraint
The DPDP Act and the Digital Personal Data Protection Rules, 2025 are subject to phased commencement. The dates below are taken from official Government notifications and should be monitored for future changes, corrigenda, exemptions and fact-specific applicability.
Board and administrative framework
The notified first phase brought specified Act provisions into force, including provisions associated with the Data Protection Board and administration of the framework.
Consent Manager-related provisions
Act section 6(9), section 27(1)(d) and Rule 4 are scheduled to commence one year after the 13 November 2025 Gazette publication.
Core duties, rights and operational Rules
Most substantive Data Fiduciary duties, Data Principal rights and operational Rules are scheduled to commence eighteen months after the Gazette publication.
Important qualification: final applicability depends on the organisation’s role, processing facts, exemptions, notifications and other applicable law. For example, final Rules include requirements on notices, reasonable security safeguards, breach intimation, rights/grievance handling and additional obligations for a Significant Data Fiduciary; these operational Rules are within the eighteen-month phase. DataConsultant can map approved legal interpretation to operating controls but does not replace legal counsel.
Use the Enforcement Window to Build Controls Before It Becomes a Release-Blocking Programme
Start with the products, data flows, vendors and control gaps that are hardest to change late.
Follow Personal Data Through the Customer and Product Lifecycle
The correct process map depends on the fintech model. A readiness assessment should trace real collection, decision, sharing and retention points rather than apply one generic privacy checklist to every financial-technology business.
Marketing & App Entry
Campaign, referral, device, web and app interaction data.
Identity & KYC
Contact, identity, verification, document and device information.
Account / Product
Account, wallet, credit, payment or subscription setup depending on model.
Payment / Lending
Transactions, repayment, beneficiary, credit and servicing events.
Risk & Fraud
Authentication, fraud signals, behavioural features and investigations.
Support & Grievance
Queries, complaints, call/chat records, documents and resolutions.
Analytics & AI
Product telemetry, segmentation, model features, evaluation and insights.
Customer & IdentityProfile, contact, KYC/verification, demographic and account identifiers.
Account / Wallet / ProductProduct enrolment, account state, wallet, limits, preferences and lifecycle events.
Payment & TransactionTransaction events, beneficiaries, merchants, repayment and settlement-linked records.
Credit & RiskApplication, eligibility, bureau/partner inputs, score features and decision records where applicable.
Device & TelemetryDevice identifiers, application events, logs, IP/network signals and anti-fraud telemetry.
Consent & CommunicationsNotice version, consent/withdrawal events, channel preferences and customer communications.
Support & GrievanceTickets, call/chat transcripts, complaint evidence and resolution records.
Partner & Vendor DataProcessor, API, cloud, LSP, verification, analytics and other third-party data exchanges.
Do You Know Where Customer Data Leaves the Primary Fintech Platform?
Map API, cloud, processor, analytics, fraud, KYC and partner flows before assigning control ownership.
A Fintech DPDP Readiness Framework That Connects Obligations to Products, Systems, Controls and Evidence
The work is structured to help leaders move from “we have a privacy policy” to a defensible operating view of processing, approved requirements, gaps, control owners, system changes, tests and remediation priorities.
Applicability & obligation map
Structure the relevant facts, roles, processing contexts and phased obligations for review with the client’s legal/privacy specialists.
- Entity and product context
- Data Fiduciary / processor roles
- Exemptions and legal-review flags
Processing & personal-data inventory
Map purposes, categories, sources, systems, recipients, vendors, transfers, retention and accountable owners across fintech journeys.
- Process-to-data map
- System and API inventory
- Data-flow and ownership view
Notice, consent & permission controls
Assess notice placement, data and purpose description, consent capture where applicable, withdrawal, versioning and downstream enforcement.
- Customer journey review
- Consent-event requirements
- Preference/control gaps
Rights & grievance operations
Design authenticated request handling with clear intake, search, correction/erasure action, escalation, evidence and reporting.
- Identity verification
- System ownership and routing
- Exception and escalation model
Security, breach & resilience readiness
Connect privacy obligations to encryption, access control, logging, monitoring, backup, vendor safeguards, incident triage and breach evidence.
- Control-to-evidence mapping
- Breach-response workflow
- Testing and remediation actions
Lifecycle, vendors & cross-border data
Review retention, deletion, processor obligations, cloud and partner data flows, onward sharing and cross-border decision points.
- Retention/deletion requirements
- Processor and subprocessor map
- Transfer and sector-overlay questions
Children & age-related processing where relevant
Identify whether any products or journeys may process children’s personal data and define the technical, organisational and legal-review actions required.
- Age-assurance decision points
- Parental consent dependencies
- Prohibited/high-risk processing review
AI, analytics & Significant Data Fiduciary readiness
Bring model and analytical data uses into the inventory, and identify enhanced governance capabilities that may matter if the organisation is designated a Significant Data Fiduciary.
- Model/use-case data map
- DPIA/audit preparedness
- Algorithmic and evidence considerations
Control testing, evidence & implementation plan
Translate gaps into control objectives, evidence artefacts, acceptance criteria, accountable owners and a sequenced remediation backlog.
- Control catalogue
- Evidence matrix
- Prioritised roadmap
Make Privacy Requirements Enforceable Across the Fintech Data Path
Readiness becomes operational when customer choices, approved purposes, access rules, retention and evidence can be propagated from front-end journeys through operational systems, data platforms, AI environments and third parties.
Customer channels
Mobile app & web
Partner / embedded journeys
Support & grievance channels
Marketing & notifications
Privacy decision layer
Notice & consent requirements
Purpose / permitted-use tags
Rights & grievance orchestration
Retention / deletion triggers
Fintech systems
Customer / account platforms
KYC / verification / fraud
Payment / lending / wallet systems
CRM / ticketing / communications
Data & AI platforms
Warehouse / lakehouse
BI / analytics workspaces
ML feature / model environments
GenAI / retrieval / knowledge flows
External ecosystem
Cloud & SaaS processors
LSP / distribution partners
Payment / verification partners
Analytics / communication vendors
Data classificationCatalogue & lineageIdentity & accessEncryption / maskingLogging & monitoringVendor controlsRetention / deletionIncident responseControl testingEvidence & issue management
Design Readiness So It Can Be Tested and Defended
Policies alone do not show that privacy controls work. A defensible programme identifies the operational risk, control objective, owner, implementation location, test method, exception path and evidence that can be produced when needed.
| Fintech risk | Control objective | Illustrative control | Test / evidence |
|---|---|---|---|
| Excess or unclear collection | Collect personal data for an approved, documented purpose and limit unnecessary fields. | Product-field inventory, purpose review and data-minimisation approval gate. | Approved field list, design decision, release evidence and exception record. |
| Notice / consent drift | Keep customer-facing notice and consent logic aligned with actual processing. | Version-controlled notice requirements, consent event logging and downstream enforcement tests. | Journey screenshots, version history, consent logs, withdrawal test and control sign-off. |
| Untracked partner sharing | Know recipients, processor roles, data categories, purpose and security dependencies. | API/vendor register tied to processing activities and contract/control review. | Data-flow record, contract evidence, due-diligence output and integration configuration. |
| Retention mismatch | Apply approved retention and deletion decisions consistently across operational, analytical and backup environments. | System-level retention rules, deletion jobs, hold logic and reconciliation. | Configuration, deletion report, exception log and sample re-performance. |
| Rights request failure | Locate, authenticate, action and evidence requests across relevant systems. | Case workflow with identity check, system tasks, ownership, escalation and closure evidence. | Ticket trail, test case, response record, exception and management report. |
| Personal-data breach | Detect, assess, contain, document and route notification decisions without avoidable delay. | Incident playbook linked to data classification, contact routes, evidence collection and decision authority. | Exercise results, incident logs, communication templates and remediation tracking. |
| Shadow analytics / AI reuse | Keep new analytical uses traceable to approved purpose, source data and access decisions. | Use-case intake, dataset provenance, access review, model inventory and change gate. | Use-case record, dataset/model documentation, approval and monitoring evidence. |
Need to Turn Privacy Requirements Into Engineering Acceptance Criteria?
Translate approved obligations into controls that product, data, cloud, security and vendor teams can implement and test.
Bring AI and Model Data Into the Same Privacy Control System
Fintech AI can use customer, transaction, device, behavioural and support data in ways that are difficult to see from the primary product journey. Readiness should trace these uses rather than treating the model environment as outside the personal-data lifecycle.
Use-case intake
Document the business objective, intended decision, customer impact and approved processing rationale.
Provenance & access
Trace training, feature, evaluation, prompt, retrieval and feedback data to sources and permissions.
Risk & inference
Assess profiling, sensitive inference, data leakage, vendor exposure and model-output handling.
Human & technical safeguards
Define access, review, escalation, logging, output handling, change controls and evidence.
Change & assurance
Reassess after data, model, vendor, purpose, product or regulatory changes and track issues to closure.
Significant Data Fiduciary context: the final Rules include periodic DPIA and audit requirements and due diligence relating to algorithmic software for organisations designated as Significant Data Fiduciaries. Designation and applicability are not assumed for every fintech and should be confirmed against current notifications and legal advice.
DPDP Readiness Needs Named Owners Across Product, Data, Technology, Privacy and Risk
The target operating model should make it clear who interprets requirements, who owns processing, who implements controls, who tests them, who accepts exceptions and who keeps evidence current as fintech products change.
Executive Sponsor / Business OwnerPriorities, investment, risk acceptance and cross-functional decisions
Product & Journey OwnersPurpose, customer experience, data need and release decisions
Privacy / LegalApplicability, interpretation, notices and formal legal review
Data Owners / StewardsData definitions, ownership, quality, lifecycle and usage controls
Fintech
DPDP
Readiness
DPDP
Readiness
Engineering / ArchitectureSystem controls, integrations, retention, deletion and implementation
Security / Incident ResponseSafeguards, logging, monitoring, breach triage and evidence
Risk / Compliance / Vendor ManagementSector overlays, third-party controls, exceptions and oversight
Internal Audit / AssuranceIndependent testing or review where required by scope and governance
From Fintech Processing Reality to Tested Readiness and an Owned Remediation Plan
The sequence adapts to assessment, design, implementation or assurance scope. No fixed timeline is assumed until products, entities, systems, vendors, evidence and required decisions are understood.
Frame
Confirm products, entities, processing roles, applicable sector context, legal-review dependencies and decision objectives.
Discover
Review customer journeys, processing activities, data domains, systems, APIs, vendors, policies, incidents and current evidence.
Map
Connect approved obligations to fintech processes, data flows, owners, systems and evidence requirements.
Assess
Evaluate control design and implementation, identify gaps, unresolved legal questions, dependencies and risk concentration.
Prioritise
Rank remediation by commencement dates, customer/risk impact, engineering dependency, sector overlay and evidence weakness.
Design
Define target workflows, control objectives, architecture changes, owners, acceptance criteria and operating decisions.
Mobilise
Convert findings into workstreams, backlog, governance cadence, decision gates, dependencies and implementation ownership.
Implement
Support product, data, security, vendor and platform teams with requirements, traceability, review and issue resolution.
Test & evidence
Validate selected controls, document evidence, record exceptions and establish remediation closure criteria.
Operate & improve
Establish monitoring, change triggers, management reporting, periodic review and knowledge transfer.
Build an Evidence Pack That Supports Decisions, Remediation and Continuing Operation
Final artefacts depend on agreed scope and the evidence available. Missing evidence is recorded as a limitation or gap rather than silently assumed.
Executive readiness assessment
Material findings, decisions, risks, dependencies and recommended priorities.
Processing & data-flow map
Products, purposes, data categories, systems, recipients, vendors and owners.
Personal-data inventory
Prioritised view of fintech personal-data domains and processing context.
Obligation-control matrix
Approved requirements mapped to controls, owners, systems and evidence.
Security & breach readiness
Control findings, incident dependencies, notification decision route and gaps.
Rights & grievance design
Intake, identity, system action, escalation, evidence and reporting workflow.
Vendor / processor action plan
Responsibility, contract, access, security, deletion and evidence issues.
Retention & deletion model
Lifecycle requirements, system mappings, exceptions and proof of operation.
Operating model & RACI
Decision rights, forums, roles, escalation and ongoing ownership.
Prioritised roadmap
Sequenced remediation backlog, dependencies, acceptance criteria and mobilisation actions.
A Useful Readiness Assessment Needs Access to Real Journeys, Systems, Evidence and Decision Owners
We can work with incomplete environments, but gaps in source evidence should remain visible. The strongest assessment combines documents with interviews, walkthroughs and selected control evidence.
Stakeholders
Executive sponsor, product, legal/privacy, data, engineering, architecture, security, risk/compliance, customer operations, procurement/vendor management and audit/assurance where relevant.
Product & processing evidence
Customer journeys, data maps, application/API inventory, vendor list, notices, consent flows, rights/grievance procedures, processing records and retention information.
Controls & assurance evidence
Security policies/configurations, access reviews, incident procedures, audit findings, deletion evidence, contracts, training records, AI/model inventory and known remediation backlog.
Move From Assessment to Controlled Implementation Without Losing Traceability
Implementation is scoped separately when required. The roadmap should preserve the link from legal/privacy decision to process requirement, system change, test, evidence and ongoing owner.
Foundation & decisions
Close critical legal-review questions, confirm scope, establish processing inventory, accountable owners and urgent design principles.
Control build
Implement priority notice/consent, rights, vendor, retention, access, security, breach and evidence requirements across selected products and platforms.
Test & remediate
Run control tests, scenario exercises and evidence checks; resolve design/implementation gaps and document approved exceptions.
Operationalise & monitor
Embed governance cadence, change triggers, metrics, issue management, periodic reviews, training and handover into business-as-usual operations.
How DataConsultant can support implementation
Programme mobilisation, requirement traceability, privacy/data architecture, governance mobilisation, data inventory/catalogue enablement, workflow design, retention-control implementation, vendor remediation tracking, control testing, evidence management, training and implementation assurance can be scoped according to the client’s delivery model.
How the capability can be sustained
Ongoing models can include senior advisory support, privacy-governance operations, control/evidence monitoring, issue and remediation management, catalogue/data-map maintenance, vendor-control reviews, AI/data-use governance, role-based training and periodic readiness reassessment.
Already Have a DPDP Gap Assessment but No Implementation Ownership?
Convert findings into product, engineering, security, vendor and governance workstreams with acceptance criteria and evidence.
Scope the Engagement Around the Readiness Decision You Need to Make
No fixed DataConsultant price or duration is published for this fintech-specific DPDP readiness service. Commercial scope is confirmed after discovery so the proposal reflects the number of products, systems, vendors, control areas and implementation responsibilities actually involved.
Focused Readiness Assessment
Evidence-led review of selected products, processing areas or high-priority control domains with findings and a remediation plan.
Enterprise Fintech Readiness Programme
Cross-product processing inventory, control framework, target operating model, evidence requirements and prioritised roadmap.
Implementation & Assurance Support
Joint delivery with internal teams and vendors to implement requirements, review designs, test controls and track remediation evidence.
Ongoing Governance Support
Advisory, monitoring, issue management, evidence maintenance, change review, training and periodic reassessment as scoped.
Use This Service When the Problem Spans Fintech Processing, Controls and Implementation
A narrower privacy, security, legal or technical service may be more appropriate when the issue is isolated to one decision or one specialist activity.
Good fit for fintech DPDP readiness
- Multiple products, systems, partners or data flows need one readiness view.
- Leadership needs a prioritised programme tied to notified commencement dates.
- Product and engineering teams need implementable privacy requirements.
- Existing policies are not connected to controls and evidence.
- RBI/sector obligations, vendor dependencies, analytics or AI complicate the privacy landscape.
- An assessment must lead into implementation and ongoing operating ownership.
May require a different or additional specialist service
- A formal legal opinion, representation before a regulator or statutory interpretation is the only requirement.
- An active security incident requires immediate incident-response specialists.
- Independent statutory audit, certification or penetration testing is required.
- The issue is limited to a single product control or configuration with no broader readiness need.
- The organisation needs only a software product rather than consulting, governance or implementation support.
- A current legal dispute or enforcement matter requires authorised legal representation.
Fintech DPDP Readiness FAQs
These answers describe DataConsultant’s operational-readiness approach. Final legal applicability and statutory interpretation should be confirmed using current official sources and qualified legal advice.
What is fintech DPDP readiness?
Fintech DPDP readiness is the practical work of identifying which Digital Personal Data Protection Act and Rules requirements may apply to a financial-technology business, mapping personal-data processing across products and partners, assessing current controls and evidence, and creating an owned remediation and implementation plan. It should be aligned with the organisation’s actual business model and any separate sector requirements that apply.
Why should fintech organisations act before the main DPDP provisions commence?
Product journeys, consent and notice design, data inventories, vendor contracts, rights workflows, retention logic, security controls, breach procedures and evidence often span many systems and teams. The notified commencement schedule creates a preparation window, but the work may require product, engineering, data, security, legal, risk, procurement and operations changes rather than a policy-only update.
What is included in a DataConsultant fintech DPDP readiness engagement?
Scope can include applicability and obligation mapping with client legal input, fintech process and personal-data inventory, notice and consent review, rights and grievance workflow assessment, processor and vendor controls, security and breach-readiness review, retention and deletion controls, cross-border and sector-overlay analysis, governance and decision rights, control testing, evidence requirements and a prioritised implementation roadmap. Final scope is agreed during discovery.
Does DataConsultant provide legal advice or guarantee DPDP compliance?
No. DataConsultant supports operational readiness by structuring facts, processes, data, controls, evidence, architecture and implementation work. Legal applicability, statutory interpretation and formal legal conclusions should be confirmed by appropriately qualified legal counsel. No consulting engagement can guarantee regulatory acceptance or eliminate all privacy and security risk.
Which fintech processes are commonly relevant to DPDP readiness?
Depending on the business model, relevant processes can include digital acquisition, account creation, KYC and verification, lending or underwriting journeys, payments or wallet activity, fraud and risk controls, customer support, collections, marketing, product analytics, AI-enabled decisions, partner integrations, vendor processing and data retention or deletion.
How are RBI requirements handled alongside DPDP requirements?
Where an organisation is an RBI-regulated entity, a lending service provider, payment participant or otherwise subject to sector instructions, DPDP readiness should be mapped alongside those applicable obligations rather than treated as a standalone privacy exercise. DataConsultant can structure the control and evidence mapping, while regulatory applicability and legal interpretation remain the client’s responsibility with appropriate specialist support.
Can the service assess consent and privacy notices in mobile-app journeys?
Yes. Scope can examine where notices appear, what personal data is described, the purpose presented to the user, consent capture and withdrawal where applicable, version and event evidence, downstream enforcement, partner sharing and how the journey behaves when a user declines or withdraws permission. Legal wording should be approved by authorised legal or privacy counsel.
Can DataConsultant help with data-principal rights and grievance workflows?
Yes. The engagement can design or assess intake, identity checks, routing, system lookup, correction or erasure actions, grievance escalation, evidence capture, ownership, exception handling and management reporting. The workflow should be aligned with the final legal interpretation and the organisation’s customer-service and security model.
How does the service address processors, cloud platforms and fintech partners?
The service can map processors and material third parties, identify personal-data flows and access patterns, review responsibility boundaries, define security and incident dependencies, document deletion and retention expectations, identify sub-processing or onward-sharing questions, and establish evidence needed from vendors. Contractual conclusions should be confirmed by legal and procurement teams.
How is AI handled in a fintech DPDP readiness programme?
AI use cases can be included in the processing inventory and assessed for data provenance, purpose, access, training or grounding data, retention, sensitive inference, third-party model exposure, human oversight, monitoring and evidence. If the organisation is later designated a Significant Data Fiduciary, additional statutory obligations may also become relevant and should be assessed with legal counsel.
What deliverables can we expect?
Typical deliverables can include an executive readiness view, obligation-to-process map, fintech personal-data inventory, system and data-flow map, control catalogue, evidence matrix, gap and risk register, notice and consent findings, rights and grievance workflow design, vendor-control actions, retention and deletion requirements, breach-readiness actions, operating-model and RACI design, prioritised remediation backlog and implementation roadmap.
How long does a fintech DPDP readiness engagement take?
Timeline is confirmed after scoping. It depends on product count, business entities, data domains, systems, vendors, jurisdictions, stakeholder availability, evidence quality, regulatory overlays, assessment depth, workshops, control testing and whether design or implementation support is included.
How is fintech DPDP readiness pricing calculated?
DataConsultant does not publish a fixed fee for this industry-specific service on this page. Pricing is scope-led and confirmed through a Request a Quote process after the number of products, processes, entities, systems, data flows, vendors, stakeholder groups, control areas, evidence requirements and implementation responsibilities are understood.
Can DataConsultant support implementation after the readiness assessment?
Yes. Implementation support can be scoped separately for programme mobilisation, data inventory and catalogue enablement, notice and consent requirements, rights workflows, retention controls, vendor remediation, security and breach evidence, governance forums, control testing, reporting, training and implementation assurance. Production ownership and legal approvals remain with the client unless expressly agreed otherwise.
What should we prepare before a DPDP readiness assessment?
Useful inputs include product and customer-journey maps, privacy notices, consent screens, application and API inventories, data-flow diagrams, cloud and vendor lists, processing and retention records, security policies, incident procedures, access models, customer-support and grievance procedures, audit findings, relevant contracts, AI use-case inventories and access to accountable business, legal, privacy, security, product, engineering, data and risk stakeholders.
Fintech DPDP Readiness Enquiry
Request a DPDP Readiness Scope Review
Share your contact details and requirement. DataConsultant can review the likely scope, evidence needed, stakeholder involvement and appropriate next step.
Service boundary: DataConsultant supports operational DPDP readiness, data governance, control design, architecture, evidence, implementation and ongoing capability. The service is not a substitute for legal advice, statutory audit, certification, regulator representation, penetration testing or specialist incident response unless those activities are separately commissioned through appropriately qualified parties.