Credit Bureaus and Account Aggregators: A DPDP Impact Study

Executive summary

Credit information companies (CICs, usually called credit bureaus) and account aggregators (AAs) exist to move personal financial data between institutions. That puts them near the centre of the Digital Personal Data Protection Act, 2023 (the DPDP Act), which asks of every flow: on what ground, for what purpose, and who answers to the individual.

Neither starts from zero. Bureaus work under the Credit Information Companies (Regulation) Act, 2005 (CICRA), with privacy principles and a 30-day correction duty, and AAs were built around consent. The gaps sit where these designs meet the Act's closed list of grounds.

Headline impact rating: High. The three biggest changes are:

1. 1.Bureau reporting needs a ground the Act does not hand over. RBI directions call a borrower consent clause "redundant", yet, in our view, no DPDP legitimate use reaches a private CIC, and the loan-defaulter exemption covers only defaulters.
2. 2.Breach and rights duties at population scale. Bureaus hold data on people who never dealt with them, and a breach means telling each of them.
3. 3.Consent managers arrive on 13 November 2026. AAs are the nearest working model, but an AA cannot simply relabel itself.

The study also covers credit-score apps and the Central KYC Records Registry (CKYCR). The main obligations commence on 13 May 2027.

Background

Who is in scope

• CICs. Four companies hold RBI registration: CRIF High Mark, Equifax, Experian and TransUnion CIBIL. Section 14 of CICRA confines them largely to collecting borrower data from members, supplying credit information and scores to "specified users", and research.
• Credit institutions such as banks, NBFCs and housing finance companies, which must join CICs and report to them.
• Specified users. Credit institutions plus categories in regulation 3 of the CIC Regulations, 2006, such as insurers and telecom companies; since 2021, also qualifying entities that process information for credit institutions.
• Credit-score apps. Most are not specified users and receive reports on the individual's consent.
• The AA network. NBFC-AAs route data from financial information providers (FIPs, such as banks, insurers, depositories and the GST Network) to financial information users (FIUs), which must be regulated by a financial-sector regulator.
• The CKYCR, run by the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI) under a Government notification of 26 November 2015.

Data principals and data flows

The DPDP Act calls the individual whose data is processed the data principal and the organisation deciding why and how it is processed the data fiduciary. A data processor acts on a fiduciary's behalf.

Here the data principals are borrowers, co-borrowers and guarantors, proprietors and directors of business borrowers, credit applicants (enquiries are recorded), AA users and everyone with a KYC record. Most never deal directly with a bureau or the registry.

Data moves in four streams:

• lenders to CICs, since 1 July 2026 as on the 9th, 16th, 23rd and last day of each month, with the CKYC number where available (fortnightly from 1 January 2025);
• CICs to specified users and, on consent, other entities;
• FIPs to FIUs through AAs, under a consent artefact;
• reporting entities to the CKYCR, which issues a KYC identifier.

Typical vendors are cloud hosts, SMS gateways, call centres, information-systems auditors and AA certifiers.

Legal framework

The DPDP Act and Rules

• Grounds (sections 4, 6, 7). Consent or a closed list of legitimate uses. Section 7(a) covers data the individual voluntarily provided to the fiduciary; sections 7(c) and 7(d) cover State functions and legal duties to disclose to the State. There is no general compliance-with-law ground. After withdrawal, processing continues only if "required or authorised" by law (section 6(6)).
• Fiduciary duties (section 8; Rules 6 and 7). Accuracy where data drives decisions or goes to another fiduciary (8(3)); safeguards and one-year logs; breach notice to the Board and every affected individual, with a 72-hour report; erasure when the purpose ends "unless retention is necessary for compliance with any law".
• Significant Data Fiduciaries (section 10, Rule 13). An SDF needs an India-based Data Protection Officer (DPO), an independent data auditor and annual assessments. Section 10 commences on 13 May 2027.
• Rights (sections 11 to 14). Access and correction run against a fiduciary "to whom she has previously given consent".
• Exemptions (section 17). Section 17(1)(f) covers processing to ascertain the financial position of a person who defaulted on a loan from a financial institution, subject to other disclosure law; sections 8(1) and 8(5) still apply. Section 17(5) lets the Centre, within five years, disapply provisions for notified fiduciaries.
• Consent managers (sections 6(7) to 6(9), Rule 4). Board-registered consent intermediaries, from 13 November 2026.

Credit information law

• CICRA. Members furnish data when a CIC asks, and disclosure is restricted, chiefly to specified users (section 17). Sections 19 and 20 require accuracy, security safeguards and privacy principles on purpose, retention and deletion. Section 21 gives a credit applicant a copy of what her lender obtained and a borrower correction within 30 days. Section 22 bars unauthorised access to credit information held by a CIC, credit institution or specified user. Wilful breach of the privacy principles risks a fine of up to ₹1 crore (section 23(2)).
• CIC Rules and Regulations, 2006 (G.S.R. 753(E) and 754(E), 14 December 2006). Lenders forward corrections within 21 days (rule 20) and CICs complete them within 30 (rule 25). Access logs are kept at least two years (rule 28). Regulations 10(d) and 11(4) require credit information and personal data to be kept for "a minimum period of seven years", with RBI-approved destruction procedures.
• RBI directions. After a consolidating Master Direction of 6 January 2025, the RBI issued on 28 November 2025 the Credit Information Companies Directions, 2025 (RBI/DOR/2025-26/378) and entity-wise Credit Information Reporting Directions for lenders (for NBFCs, RBI/DOR/2025-26/349). These call the consent clause "redundant" (reporting directions para 11); require default alerts to borrowers (para 34(1)(i)); award ₹100 per calendar day once a complaint passes 30 days, 21 of them the lender's (para 35; CIC Directions para 41); require CICs to alert customers when a specified user accesses their report (para 37(i)) and give a free full report yearly (para 21(7)); and permit consent-based sharing with other entities (para 24). Amendments of 4 December 2025 (for commercial banks, RBI/DOR/2025-26/110) brought in the July 2026 reporting dates and CKYC numbers.

Account aggregators

Under the RBI (Non-Banking Financial Companies – Account Aggregator) Directions, 2025 (RBI/DoR/2025-26/368, 28 November 2025):

• an AA must be a company with net owned fund of at least ₹2 crore (para 11);
• data moves only on explicit consent recorded in a standardised consent artefact naming data, purpose, recipients and expiry, revocable in full or in part (paras 15, 17 and 20);
• an AA may not carry on other business, store financial information, outsource aggregation or see login credentials (para 14);
• ReBIT, the technology company set up by the RBI, frames the technical specifications (paras 32 to 34);
• grievances are resolved within one month (para 38).

On 5 June 2026 the RBI recognised Sahamati Foundation as the self-regulatory organisation (SRO) for the AA ecosystem. It sets standards for its members; the RBI remains the regulator.

KYC registry

The Prevention of Money-laundering (Maintenance of Records) Rules, 2005 define the CKYCR as a reporting entity "substantially owned and controlled by the Central Government". Reporting entities upload KYC records within ten days (rule 9(1A)), and records drawn from the registry may be used only to verify identity or address (rule 9(1F)).

How the layers fit

Section 38(1) makes the DPDP Act additional to CICRA and the RBI's directions; section 38(2) makes it prevail in a conflict. Section 16(2) preserves stricter transfer rules, such as the India-only condition for consent-based report recipients. Sections 6(6) and 8(7) let CICRA's reporting and retention duties survive a withdrawal.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

A lawful ground for bureau reporting

The lender's report. The RBI's statement that lenders need not insist on a consent clause (reporting directions para 11) is about CICRA, not the DPDP Act. From 13 May 2027 the lender needs a ground. Section 7(a) may help where the loan notice names bureau reporting, but it falls away once the borrower objects, while CICRA still requires the report. Consent at origination is sturdier, because section 6(6) then carries reporting past any withdrawal. Trayambic's banks and NBFC studies cover the lender side.

The bureau's own processing. This is harder. Section 7(a) needs data provided to the fiduciary, and borrowers give data to lenders, not CICs. Sections 7(c) and 7(d) concern the State, and CICs are private companies. Section 7(e) covers a "judgment or decree or order"; in our view, general RBI directions are not an order.

Section 17(1)(f) helps a lender pulling a defaulter's report. It does not cover a bureau scoring borrowers who never defaulted, and a bureau cannot run one database on two legal footings.

The CKYCR shows the contrast. Because it is substantially owned and controlled by the Central Government, an upload is, in our view, a legal duty to disclose to a State instrumentality under section 7(d), and the registry's processing falls under section 7(c). Private CICs have no such route.

In Trayambic's view, the practical answer is:

• lenders' consent should name all RBI-registered CICs and their CICRA processing, so one consent covers both disclosure and bureau use;
• sections 6(6) and 8(7) then keep the record through a withdrawal and for the retention period;
• for data where no consent was ever taken, the industry should seek RBI and MeitY clarity, or a section 17(5) notification, before May 2027.

Accuracy, correction and retention

Section 8(3) applies to bureaus on both limbs: reports drive decisions and go to other fiduciaries. CICRA and the RBI already go further than the Act: 21 days for the lender, 30 overall, ₹100 a day after that, reasons for rejections, and a free annual report.

Access and correction rights under sections 11 and 12 run only against a fiduciary to whom the individual gave consent. Bureaus relying on lender-collected consent should treat those rights as running against them. Section 13 grievance redressal applies regardless.

The gap is recipients. Section 11(1)(b) asks for "the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared". CIC access alerts go out only when an enquiry "reflects" on the report, and consent-based recipients may not show at all. A bureau's access response should list every disclosure.

On retention, regulations 10(d) and 11(4) set a seven-year minimum. In our view section 8(7)'s carve-out covers those seven years, but not longer retention merely because no maximum is written down. Data held longer needs an explainable purpose, and the RBI-approved destruction procedure should become a published schedule. A withdrawal at the lender does not erase the bureau record.

Account aggregators and DPDP consent managers

The two designs are close. Both are data-blind: para 14(7) of the AA Directions forbids financial information residing with the AA, and Part B, item 2 of the First Schedule requires a consent manager to share data without being able to read it. An illustration in the Rules even has a consent manager route account details between two banks.

Can an AA register as a DPDP consent manager? In our view, not without more:

• No other business. Para 14(6) bars an AA from other business, so managing consent for non-financial data needs RBI permission or a separate company.
• Two capital tests. The AA's ₹2 crore net owned fund and the First Schedule's ₹2 crore net worth are separate requirements.
• Records. Consent managers keep consent records for at least seven years; the AA Directions set no period.
• Conflicts. Part B, items 9 and 10 forbid conflicts with data fiduciaries, down to directors' interests; the AA Directions have no equivalent.
• The reverse route. A consent manager routing bank data is, in our view, likely to be carrying on AA business, which needs RBI registration.

Registration cannot happen yet: Rule 4 takes effect on 13 November 2026, but no Board members had been appointed as of October 2026. Trayambic's article on the consent manager milestone covers Rule 4 itself.

For FIUs, in our view, the consent artefact instructs the FIP; it is not automatically the FIU's DPDP consent. The FIU needs its own Rule 3 notice in the journey and should treat the artefact's purpose and expiry as hard limits. Trayambic's fintech study covers wealth-tech FIUs.

Credit-score apps: outside CICRA, inside the DPDP Act

Para 24 of the CIC Directions allows sharing with an entity that is not a specified user, on the individual's documented consent, if the recipient uses the report only for the agreed end use, keeps it for no more than six months without fresh consent (less if consent is withdrawn or the purpose is served), processes it only in India and undergoes an annual information-systems audit.

In our view the RBI reaches these apps only through the CIC's contract, and section 22 of CICRA protects credit information held by CICs, credit institutions and specified users, not by them. From May 2027 the DPDP Act binds them directly. The app is a fiduciary in its own right and needs specific, withdrawable consent for each use: seeing a score is one purpose, matching to loan offers another.

Worked example: a credit-score app that kept too much

A credit-score and loan-comparison app receives reports from two CICs under para 24 agreements and is a lending service provider for two NBFCs. To refresh "pre-approved" offers, it keeps full reports for 18 months and copies them to its group's cloud region abroad.

In July 2027 a misconfigured storage bucket exposes about three lakh reports (figures illustrative). How the rules apply:

• Retention. Eighteen months without fresh consent breaches para 24's six-month limit and section 8(7); the user's purpose, seeing her score, was long served.
• Location. The offshore copy breaches the India-only condition, which section 16(2) keeps alive.
• Purpose. Using reports for loan offers needed separate consent and an itemised notice.
• Breach. The app is the fiduciary. It must tell the Board and each affected user without delay, file the 72-hour report and report to CERT-In within six hours.
• The bureaus. Each CIC must enforce its agreement, up to termination, and its board reviews the app's audit reports. Ignored adverse findings would undercut the bureau's gatekeeping.
• The NBFCs. Data the app handled as their service provider is their responsibility under section 8(1).

The fix was cheap: delete at six months, keep everything in India, and ask separately before using reports for offers.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Confirm a DPO, complete the ground map and raise the bureau-ground question with regulators. AAs settle their consent manager stance.

January to March 2027. Lenders roll out revised consent wording. Bureaus build full-recipient access responses and rehearse a breach at a consent-based app.

April to May 2027. Publish retention schedules, run the first deletion cycle beyond the legal floor and switch on rights workflows.

Ongoing. Track section 17(5) notifications, SDF designations and Board appointments.

Recommendations

1. 1.Settle the bureau ground now. Document, flow by flow, which ground applies, and raise the gap with regulators.
2. 2.Make lender consent do double duty. One consent naming all registered CICs covers disclosure and bureau processing; section 6(6) handles withdrawal.
3. 3.Treat seven years as a floor, not a licence.
4. 4.Show people everyone who saw their report, including consent-based recipients.
5. 5.Keep AA and consent manager businesses apart unless the RBI permits otherwise.
6. 6.Police consent-based recipients closely. The RBI has made the bureau the gatekeeper.
7. 7.Prepare for SDF designation before section 10 commences.

Key takeaways

• The sector's DPDP impact is High: bureaus, AAs, credit-score apps and the KYC registry all exist to move personal financial data between institutions.
• RBI directions call a borrower consent clause for bureau reporting 'redundant', but no DPDP legitimate use clearly covers a private CIC; consent at loan origination plus section 6(6) is the workable fix.
• The seven-year minimum in the CIC Regulations is a floor that section 8(7) respects, not permission to keep data indefinitely.
• AAs are the closest model for DPDP consent managers, but the RBI's no-other-business rule and the First Schedule's conditions mean an AA cannot simply re-register.
• Credit-score apps sit outside CICRA's direct reach; from May 2027 the DPDP Act binds them directly, on top of RBI's six-month, India-only conditions.