Key points
- DPDP applies on top of RBI regulation; KYC retention under the PML Rules still applies.
- Lending apps may collect only the data necessary for the stated purpose.
- Recovery agents are Data Processors and need DPDP contract clauses.
- Section 17 exempts some provisions for tracing assets of loan defaulters, subject to other laws.
- One breach plan should meet DPDP, CERT-In and RBI reporting timelines.
DPDP on top of RBI regulation
Regulated entities already follow RBI directions on KYC, IT governance, outsourcing, cyber security and digital lending. DPDP adds rights for borrowers, stricter notice and consent, erasure duties and penalties of up to ₹250 crore. Where another law requires you to keep data, such as KYC records under the PML Rules, that requirement continues to apply.
Where personal data sits in a lender
| Where the data is | Examples | DPDP point to watch |
|---|---|---|
| Onboarding and KYC | PAN, Aadhaar details, photos, address proof | Notice; retention under PML Rules |
| Credit assessment | Bank statements, bureau data, income | Accuracy for decisions (Section 8(3)) |
| Loan management system and core banking | Loan accounts, repayments | Access control and logging (Rule 6) |
| Collections and recovery agents | Contact details, references | Processor contracts (Section 8(2)) |
| Mobile app and SDKs | Device data, location, contacts | Collect only what is necessary (Section 6) |
| Marketing and cross-sell | Leads, call recordings | Separate, withdrawable consent |
| Co-lending and partners | Shared borrower data | Clear purpose and contracts |
Consent and data minimisation in lending apps
Consent must be limited to the data necessary for the stated purpose. Accessing contact lists, photos or files on a borrower's phone without a clear, necessary purpose is a high-risk practice. Keep marketing consent separate from loan servicing, and make withdrawal easy.
Defaulters and recovery
Section 17 exempts some provisions for processing needed to ascertain the financial information and assets of a person who has defaulted on a loan or advance taken from a financial institution, subject to other laws. This does not cover harassment, contacting unrelated people, or sharing data beyond what the law allows. Recovery agents are your Data Processors and need DPDP clauses in their contracts.
Breach reporting: DPDP, CERT-In and RBI
A breach may need to be reported to the Data Protection Board and affected borrowers under DPDP, to CERT-In within 6 hours, and to RBI under its own incident reporting requirements. Build one breach plan that meets all three timelines. See our breach reporting guide.
10 steps for NBFCs and fintechs
- Map personal data across onboarding, LMS, collections, app and partners.
- Review every app permission and SDK; remove what is not necessary.
- Rewrite notices to itemise data and purposes, in English and regional languages.
- Separate marketing consent from loan servicing and record each consent.
- Add DPDP clauses to recovery agency, co-lending, bureau and cloud contracts.
- Set retention periods that respect PML and RBI requirements, then erase.
- Set up a borrower rights and grievance process with a published response time.
- Combine DPDP, CERT-In and RBI breach reporting into one plan and drill it.
- Log and review access to KYC and financial data.
- Train sales, collections and customer service teams.
Want to know where your organisation stands? Take the free 40-question DPDP Readiness Check, or see our full DPDP compliance checklist.
Frequently asked questions
Does DPDP override RBI KYC retention rules?
No. DPDP requires erasure when the purpose is served unless another law requires retention. KYC records must still be kept for the period set by the PML Rules and RBI directions.
Can lending apps access a borrower's contacts under DPDP?
Only if it is necessary for the stated purpose and covered by a clear notice and valid consent. Collecting data that is not needed for the service is a significant compliance risk.
Are loan recovery agents covered by DPDP?
Yes. Agents processing borrower data on your behalf are Data Processors and must work under a contract with DPDP obligations. You remain responsible for their processing.
Is there a DPDP exemption for loan defaulters?
Section 17 exempts some provisions for processing needed to ascertain the financial information and assets of a person who has defaulted on a loan from a financial institution, subject to other laws.
Official sources
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.