Microfinance and Co-operative Banks: A DPDP Act Impact Study

Executive summary

Microfinance and co-operative credit run on people more than apps. Loan officers fill in household income sheets on tablets or paper and collect repayments at group meetings. Co-operative banks and credit societies keep member registers they are often only now computerising.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) reaches all of it: s.3(a) covers data collected on paper and "digitised subsequently". Every tablet sync, computerised register and self-help group (SHG) record keyed into a portal is in scope.

Headline impact rating: High. Six of the twelve areas in the Trayambic scorecard are rated High. The three biggest changes are:

1. 1.Household data needs its own lawful basis. RBI rules require an assessment of the whole household's income. In our reading, the Act's legitimate uses do not cover data a borrower gives about her husband, adult children or fellow group members.
2. 2.Notices must work on a doorstep, in English or one of the 22 Eighth Schedule languages, for borrowers who may read neither and may speak a language outside the Schedule.
3. 3.A long tail of small institutions must meet one security standard. Field tablets, newly computerised societies, shared software and small urban co-operative banks face the same security and breach rules, including notice to the Data Protection Board and every affected borrower.

The main obligations commence on 13 May 2027. New RBI recovery rules for NBFCs apply from 1 January 2027; new cyber directions for urban co-operative banks have applied since 31 July 2026.

Background

Who this study covers

The DPDP Act calls the organisation deciding why and how personal data is processed a data fiduciary, the individual concerned a data principal, and a business processing data on a fiduciary's behalf a data processor. This study covers four groups of fiduciaries:

• Microfinance lenders: NBFC-MFIs and other lenders making microfinance loans, which the RBI defines as collateral-free loans to households with annual income up to ₹3,00,000.
• Co-operative banks: urban (primary) co-operative banks (UCBs), and state and district central co-operative banks, which NABARD supervises.
• Credit co-operative societies: primary agricultural credit societies (PACS), urban credit societies and multi-State credit societies, mostly outside the Banking Regulation Act and direct RBI oversight.
• Banks in SHG-bank linkage, mainly under the Deendayal Antyodaya Yojana – National Rural Livelihoods Mission (DAY-NRLM), which organises rural women into SHGs and places "Bank Sakhis" in branches.

Commercial banks appear here only as SHG lenders; Trayambic's banks study covers them.

What data is collected

• Identity: Aadhaar-based e-KYC results, voter ID, photographs, signatures or thumbprints.
• Household profile: earning and non-earning members, occupations, income, remittances, expenses, house type and assets.
• Credit and group data: bureau reports, repayment records, loan cards, and membership and attendance in joint-liability groups (JLGs) or SHGs.
• Member and depositor data: share capital, deposits and nominees (up to four per bank account since 1 November 2025).
• SHG digitisation data: NABARD's e-Shakti platform records members' names, addresses, Aadhaar and voter ID details, disability and BPL status, house type, toilet and electricity access, savings and loans.

Where the data goes

Data moves from the field into the lender's loan system, then to credit information companies (CICs), co-lenders, collection teams and call centres. SHG data goes from branches to e-Shakti, which names credit bureaus as a later-stage stakeholder. PACS records move onto national common software; society-level data feeds the National Cooperative Database.

Data principals include borrowers, household members, co-members, guarantors, nominees, depositors, members and field staff.

Legal framework

The DPDP Act and Rules

• Grounds (ss.4, 6, 7): consent, or a legitimate use from the closed list in s.7. There is no "legitimate interests" or general "legal obligation" ground. Section 7(a) covers data a person voluntarily provides for a specified purpose.
• Notice and language (s.5, s.6(3), Rule 3): an itemised notice with each consent request, accessible in English or any Eighth Schedule language; for earlier consents, notice "as soon as it is reasonably practicable" (s.5(2)).
• Fiduciary duties (s.8, Rules 6 and 7): responsibility for processors, accuracy where data goes to another fiduciary (s.8(3)), security safeguards with logs kept for a year, breach intimation, and erasure once the purpose ends.
• Rights (ss.11 to 14, Rule 14): access, correction, erasure and grievance redressal within 90 days.
• Exemptions: s.17(1)(f) covers establishing a loan defaulter's financial position.

A "person" includes a body of individuals "whether incorporated or not" (s.2(s)). A co-operative society is plainly a fiduciary; an unregistered SHG keeping its own digital records may be one too.

Microfinance instruments

• RBI Master Direction – Regulatory Framework for Microfinance Loans, 2022 (RBI/DOR/2021-22/89, 14 March 2022), applying to commercial banks (except payments banks), co-operative banks and NBFCs: a board-approved household income policy (para 4.1), income reporting to CICs (para 4.3), repayments capped at 50 per cent of monthly household income (para 5.1), a Key Facts Statement (KFS) and Fair Practices Code in a language the borrower understands (paras 6A.2, 7.1.1), recovery at a designated place (para 7.4.2), and no calls before 9 a.m. or after 6 p.m. (para 7.4.3).
• RBI (NBFC – Credit Facilities) Directions, 2025 (RBI/DOR/2025-26/347, 28 November 2025), Chapter V, now holds these rules for NBFCs: income parameters (para 52), CIC reporting after checking any discrepancy with the borrower (para 54) and the 50 per cent cap (paras 55 to 57). Para 53 lets SROs build a common assessment framework.
• RBI (NBFC – Responsible Business Conduct) Third Amendment Directions, 2026 (RBI/2026-27/230, effective 1 January 2027): contact only between 08:00 and 19:00 (para 100Y(4)); microfinance collection at a designated place, with home or work visits only after two missed meetings (para 100Y(7)); recovery agents get only what they need (para 100O). Trayambic's article on digital lending apps covers these rules.
• Self-regulation. The RBI's Omnibus Framework for SROs dates from 21 March 2024.

Co-operative banking instruments

• Banking Regulation Act, 1949. Section 56 applies the Act to co-operative banks with modifications, as amended in 2020. Section 3 excludes PACS and long-term agricultural finance societies that neither use "bank" in their names nor act as drawee of cheques.
• RBI UCB Master Directions of 28 November 2025: 27 consolidated directions, including KYC, Outsourcing and Credit Information Reporting.
• RBI (Urban Co-operative Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/437, 31 July 2026). These replace the 2019 graded framework but keep its four levels (para 4). The UCB, "as owner of customer data", must protect it, including with vendors (para 22), and report cyber incidents on the RBI's DAKSH platform within six hours of detection (para 88).
• DICGC Act, s.18A: a bank under all-inclusive directions must give DICGC a depositor-wise claim list within 45 days; DICGC pays within 90 days.

Co-operative societies and national databases

• Multi-State Co-operative Societies Act, 2002, as amended by Act 11 of 2023: a Co-operative Ombudsman (s.85A); a Co-operative Information Officer answering members' requests within 30 days, within the bye-laws' disclosure norms (s.106); the member list open to inspection free of charge (s.106A); and electronic records (s.120A).
• Computerisation of PACS (approved 29 June 2022): cloud-based common software "with cyber security and data storage", in vernacular languages, including digitisation of existing records.
• National Cooperative Database (launched 8 March 2024): society-level data on location, membership, activity and finances, linked by API to state registrars' portals and the e-PACS portal.

How the layers fit

Section 38 makes the DPDP Act additional to these laws and lets it prevail in a conflict; s.16(2) preserves stricter sector limits on transfers abroad. RBI rules are mostly stricter (language, recovery conduct), which simply adds, or mandatory (income assessment, CIC reporting), which still needs a DPDP ground. Trayambic's banks study sets out the consent-plus-s.6(6) approach; this study applies it to household and group data.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Households and groups: data about people who never signed

The RBI's income test is a household test. Para 52 asks about earning and non-earning members, occupations, income, remittances, pensions and expenses. The applicant supplies most of this, and much of it is about other people: her husband, her sons, her daughters-in-law.

Section 7(a) covers data "the Data Principal has voluntarily provided". The husband did not provide his income; his wife did. No other legitimate use fits. Household data therefore needs the other person's consent or a design that avoids identifying him. Para 52 helps, because it asks for counts and household figures, not a profile of each member:

• Make the main earner a co-applicant where he is one in practice, with his own notice and consent.
• Record household totals for everyone else. "Two earning members, combined monthly income of a stated amount" satisfies the RBI test without a named record for each person.
• Treat CIC reporting as a consented purpose. Para 54 requires discrepancies to be checked with the borrower before reporting, which also meets the accuracy duty in s.8(3).

Groups raise the same issue. Joint liability works because members know who has paid, so meetings and overdue lists show one member's data to others. The notice at group formation should say so plainly, and sharing should stay within the group and the amounts relevant to joint liability. Forwarding overdue lists to WhatsApp groups goes well beyond that.

Shared phones add risk: a loan SMS or breach notice may be read by someone the borrower has not told. Ask each borrower which number to use and record her choice.

Paper, tablets and digitisation

Under s.3(a), a paper loan form typed into the system on Friday is digital personal data from Friday, so its notice and consent must already meet the Act. From 13 May 2027, the paper form is the consent record.

Tablets create a different risk. Field apps often hold KYC images, household sheets and repayment schedules offline until the next sync, and images can end up in the device gallery or on WhatsApp. Rule 6 expects encryption, access control and logs kept for at least a year: in practice, app-level encryption, remote wipe, no image export, and logs of who viewed which record.

Digitisation projects bring legacy data into scope. PACS computerisation includes "digitisation of existing records"; e-Shakti digitises SHG books down to disability and BPL status. Much of that data was never collected on consent, so s.5(2) notices alone do not settle its basis. For a member's own records used for her membership and loans, s.7(a) is the natural ground; anything wider needs fresh consent.

Language is the hardest part. The Act allows English or any of the 22 Eighth Schedule languages. The RBI requires the KFS, Fair Practices Code and loan card in "a language understood by the borrower", with the KFS explained and acknowledged. A borrower may speak Khasi, Mizo, Tulu or Bhili, none of which is in the Schedule, so the RBI standard is the higher one. Deliver the DPDP notice in the same sitting as the KFS explanation, in the borrower's spoken language, with a written copy in the nearest Schedule language and a recorded acknowledgement.

Co-operative institutions: small banks, shared systems, many regulators

The 2026 UCB cyber directions keep four levels based on digital depth. The DPDP Act has no levels. A Level I bank with no internet banking owes the same "reasonable security safeguards" as a large one, with the same ₹250 crore maximum penalty. Under the 2019 framework, data leak prevention began at Level II; under the Act, every bank must be able to detect and report a leak.

Shared systems help small institutions but concentrate risk. State and district central co-operative banks run on common banking software; PACS are moving to national common software; NUCFDC, the umbrella organisation for UCBs, has invited expressions of interest for a shared cloud and core banking system. The bank or society remains the fiduciary (s.8(1)), and provider contracts must meet s.8(2) and Rule 6. Breach plans should assume one provider incident can hit many institutions, and settle in advance who notifies whom.

Co-operative law adds disclosure duties. A multi-State society must open its member list for inspection and answer members' requests within its bye-laws' disclosure norms, which should now protect individual deposits and loans. When a bank fails, DICGC needs a depositor-wise list within 45 days; in Trayambic's view s.7(d) covers that disclosure, but security and breach duties continue.

Credit societies outside the RBI's reach face the biggest step: for many, the DPDP Act is their first binding rulebook on member data.

Worked example: a branch, a tablet and a WhatsApp group

An NBFC-MFI's rural branch has eight loan officers serving about 150 joint-liability groups. Their tablets hold KYC images, household income sheets and repayment schedules offline for up to a week.

To speed up collections, an officer exports one centre's overdue list and sends it to the group leader on WhatsApp: 25 women's names, phone numbers and overdue amounts. The leader forwards it to a village group of about 200 people. From 13 May 2027:

• It is a personal data breach. The definition covers unauthorised sharing that compromises confidentiality; no hacker is needed.
• The NBFC-MFI is responsible, not the officer or group leader (s.8(1)).
• The Board must be told without delay, with a detailed report within 72 hours on facts, cause, mitigation and notices sent.
• Each of the 25 women must be told what happened, the likely consequences and what she can do. A message to the same WhatsApp group would repeat the breach; officers should visit or call each woman on the number she chose.
• Conduct rules may bite too. From 1 January 2027, posting a borrower's personal details on social media is a listed harsh recovery practice (para 100Z).
• The Board will examine safeguards: whether the app allowed exports, officers were trained, or targets encouraged list-sharing.

The fix is design, not just training: overdue lists viewable only in the app, exports and screenshots blocked, and meetings run from each borrower's own loan card.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Appoint a DPO or other responsible person. Map data, starting with field collection. List every app, device, shared system and agency touching borrower data. UCBs should close gaps under the July 2026 cyber directions.

January to March 2027. Rebuild forms and the household income module. Draft notices in the main languages served and train field staff. Harden devices. Run a breach drill on a lost tablet and a leaked overdue list. Align recovery with the January 2027 rules.

April to May 2027. Sign contract amendments. Launch notices to the existing book through branches, meetings and calls. Open a rights channel that works through field staff. Run the first deletion cycle.

Ongoing. Repeat breach drills every six months. Track RBI and NABARD guidance, SRO codes and any Board guidance on notices for speakers of non-Schedule languages.

Recommendations

1. 1.Collect household facts, not household profiles. Use co-applicants for main earners and record totals for everyone else.
2. 2.Make the KFS meeting the consent moment: one sitting, one explanation, one acknowledgement covering both RBI and DPDP requirements.
3. 3.Write group sharing into the group's founding documents, and keep overdue information inside the app.
4. 4.Ask every borrower which phone number to use for loan, recovery and breach messages.
5. 5.Treat field devices as branches: encrypted, logged and remotely wipeable.
6. 6.Agree breach roles with shared system providers before an incident.
7. 7.Update bye-laws so information rights do not expose other members' deposits and loans.

Key takeaways

• Microfinance and co-operative credit rate High on the Trayambic scorecard, with six of twelve areas rated High.
• RBI household income rules require data about people who never applied; the DPDP Act's legitimate uses do not cover it, so use co-applicants and household totals.
• Paper forms that are later digitised fall under the Act, so from May 2027 the paper form is the consent record.
• The RBI requires a language the borrower understands, which can be stricter than the DPDP Act's Eighth Schedule rule; deliver both notices in the KFS meeting.
• Urban co-operative banks follow new July 2026 cyber directions with six-hour DAKSH reporting; the DPDP Act adds Board reports and notice to every affected borrower.