Digital Lending Apps: Aligning RBI Rules With the DPDP Act

Digital lenders were regulated on data long before the Digital Personal Data Protection Act, 2023 (the DPDP Act) arrived. The RBI's digital lending rules already restrict what apps can read from a borrower's phone and where data can be stored. The question for lenders now is not whether to start, but how to fit two rulebooks into one data map.

What the RBI already requires

The RBI (Digital Lending) Directions, 2025, issued on 8 May 2025, replaced the 2022 guidelines. Among their data provisions:

• Need-based collection with explicit consent and an audit trail. Lending apps must not access a phone's files and media, contact list or call logs. One-time access to the camera, microphone or location is allowed for onboarding or KYC, with consent (para 12(i)).
• Revocation and deletion. Borrowers can withdraw consent and ask for their data to be deleted (para 12(ii)).
• Consent before sharing with third parties (para 12(iv)).
• Published retention policy and data-destruction protocol (para 13(ii)).
• Storage only in India. Data processed abroad must be brought back within 24 hours (para 13(iv)).

For NBFCs, corresponding provisions now sit in Chapter III of the RBI (NBFC – Credit Facilities) Directions, 2025, issued on 28 November 2025 as part of the RBI's consolidation of its rulebook. Lenders should confirm which instrument applies to their category.

What the DPDP Act adds

Itemised notice. From 13 May 2027, Rule 3 requires each consent request to come with a notice that itemises the data and purposes and explains how to withdraw consent and complain to the Data Protection Board.

Rights. Borrowers who gave consent get a statutory right to a summary of their data and a list of the parties it was shared with (section 11), and to correction and erasure (section 12).

Breach reporting to the Board. Rule 7 requires notice to affected borrowers and the Board without delay, and a full report to the Board within 72 hours. This sits alongside reporting to CERT-In and the RBI.

Penalties. The Schedule sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach.

Recovery: two developments to note

New RBI conduct rules from 1 January 2027. The RBI (NBFC – Responsible Business Conduct) Third Amendment Directions, 2026, dated 6 August 2026, restrict recovery contact to between 8 a.m. and 7 p.m. unless the borrower asks otherwise (para 100Y(4)). They list harassment of a borrower's relatives, referees, friends or co-workers as a harsh practice (para 100Z(6)). They require recordings of recovery calls to be kept for six months (para 100P). They limit what borrower data can go to recovery agents (para 100O). And they bar using a borrower's contacts, messages, call logs, photographs and location history, including by device-locking providers (para 100U).

The defaulter exemption is narrower than it looks. Section 17(1)(f) of the DPDP Act applies where processing is for ascertaining the financial information and assets and liabilities of a person who has defaulted on a loan or advance from a financial institution, and only if the processing follows the disclosure rules in other laws. Where it applies, Chapter II (except sections 8(1) and 8(5)), Chapter III and section 16 fall away. It does not cover contacting the defaulter's family, colleagues or friends, which is processing their personal data. The lender's overall responsibility (s.8(1)) and security safeguards (s.8(5)) apply even within the exemption.

Retention: reconcile, don't choose

Section 8(7) requires erasure once the purpose ends, unless another law requires retention. The RBI (NBFC – KYC) Directions, 2025 require identity records to be kept for at least five years after the relationship ends (para 47(2)). Credit information reported to bureaus follows the Credit Information Companies (Regulation) Act, 2005, which also gives borrowers a right to have inaccurate data corrected (section 21).

The result: keep KYC and loan records for the statutory period, and delete onboarding data from rejected applications, marketing lists and device data once their purpose ends.

Five steps for lenders

• Build one data map showing, for each data element, the RBI paragraph and the DPDP provision that governs it.
• Audit app permissions against para 12(i) and the new para 100U.
• Rewrite recovery-agent contracts before 1 January 2027 to restrict data shared and ban contact with third parties.
• Merge breach playbooks so one incident triggers the RBI, CERT-In and Board timelines together.
• Publish a retention schedule that names the law behind each period.

The RBI's rules make lenders better prepared than most sectors. The work is in joining them up with the DPDP Act before May 2027.

Key takeaways

• The RBI's 2025 Digital Lending Directions already bar access to contacts, call logs and media, and require storage in India.
• The DPDP Act adds itemised notice, statutory rights and a 72-hour breach report to the Data Protection Board.
• New RBI recovery rules effective 1 January 2027 restrict contact hours and ban use of borrowers' contacts, photos and location.
• Section 17(1)(f) helps establish a defaulter's financial position, but does not cover contacting their family or colleagues.
• KYC records must be kept for five years after the relationship ends; other data should be deleted when its purpose ends.