NBFCs and Digital Lending Under the DPDP Act: An Impact Study

Executive summary

Non-banking financial companies (NBFCs) already run on RBI data rules. Lending apps may not read a borrower's contacts or files, borrower data stays on servers in India, lending service providers keep only minimal data, customer information is secret, and cyber incidents go to the RBI within six hours.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) adds less in new prohibitions than in two questions the RBI rules leave open: who answers to the borrower when different firms source, fund, service and recover a loan, and how the RBI's consent and deletion rules map onto the Act's own.

Headline impact rating: Medium-High. Four obligation areas rate High. Children's data and cross-border transfers rate Low, because lenders rarely deal with minors and RBI rules already keep borrower data in India. The three biggest changes are:

1. 1.The lending chain becomes a statutory chain. Lending service providers, direct selling agents, co-lenders, recovery agencies, valuers and device-control vendors all touch borrower data. Section 8(1) makes the NBFC answer for its processors whatever the contract says.
2. 2.Two consent vocabularies must become one journey. The RBI's "need-based" collection with "prior and explicit consent" must now sit inside the Act's itemised notice, specific purposes and easy withdrawal, including for the existing loan book.
3. 3.More audiences for every breach. Six-hour reporting to the RBI (or, for housing finance companies, the National Housing Bank) continues. From 13 May 2027 the Data Protection Board and every affected borrower must also be told, whether the breach is a cyber attack or a lost file.

This study takes an industry view across investment and credit companies (NBFC-ICCs), housing finance companies (HFCs), gold loan companies, lending service providers and co-lending. Trayambic's article on digital lending apps covers app permissions, the January 2027 recovery rules and the loan-defaulter exemption in more detail.

Background

Who the data principals are

The DPDP Act calls the individual whose data is processed the data principal. The organisation that decides why and how data is processed, alone or with others, is the data fiduciary; one that processes data on its behalf is a data processor.

For NBFCs the data principals include applicants, including those turned down; borrowers, co-borrowers and guarantors; references named on applications; sole proprietors borrowing for business; legal heirs claiming pledged gold; people named in property title documents; and individual employees, agents and recovery staff.

What data flows where

Lenders collect KYC documents and video-KYC recordings, credit reports, bank statements (including through account aggregators), income and GST records, property documents, certificates and images of pledged gold, one-time camera and location access at onboarding, repayment histories, call recordings and collection notes. For phones financed on credit they also hold device identifiers and lock status.

Data leaves by law to credit information companies (CICs), the Central KYC Records Registry within ten days of onboarding, and FIU-IND. It leaves by business arrangement to lending service providers (LSPs) that source and service loans, co-lending partners, direct selling agents, recovery agencies, gold valuers and auctioneers, lawyers and valuers for property loans, cloud and messaging providers, and device-control software vendors.

Legal framework

The DPDP Act and Rules

• Grounds (sections 4, 6, 7). Consent, or a legitimate use from a closed list. Section 7(a) covers data voluntarily provided for a specified purpose. There is no "legitimate interests" ground.
• Notice (section 5, Rule 3). An itemised notice with every consent request, and notice to earlier consenters "as soon as it is reasonably practicable" (section 5(2)).
• Fiduciary duties (section 8, Rules 6 and 7). Responsibility for processors "irrespective of any agreement to the contrary"; complete and accurate data where it drives a decision about the borrower or goes to another fiduciary (section 8(3)); security safeguards with logs kept a year; breach intimation; erasure when the purpose ends unless law requires retention.
• Rights (sections 11 to 14, Rule 14). Access, including everyone the data was shared with; correction; erasure unless retention is necessary "for compliance with any law" (section 12(3)); grievances answered within 90 days; nomination.
• Significant Data Fiduciaries (section 10, Rule 13). A fiduciary the Centre designates for the volume, sensitivity or risk of its processing (an SDF) needs an India-based Data Protection Officer (DPO), an independent data auditor and an annual impact assessment.
• Defaulters (section 17(1)(f)). Processing to ascertain a defaulter's financial information, assets and liabilities is largely exempt, subject to disclosure rules in other laws; sections 8(1) and 8(5) still apply.

Sector instruments

On 28 November 2025 the RBI consolidated its rulebook into entity-wise Master Directions. For NBFCs the data-relevant instruments are:

• RBI (NBFC – Credit Facilities) Directions, 2025 (RBI/DOR/2025-26/347, updated 15 July 2026), applying to NBFC-ICCs and HFCs among others (para 3(1)). Chapter III carries the digital lending rules: need-based collection with prior explicit consent and an audit trail, and no access to files, contacts or call logs (para 13(1)); revocation and deletion (para 13(2)); explicit consent before sharing unless law requires it (para 13(4)); only basic minimal data with LSPs (para 14(1)); a published policy on retention, destruction and breach handling (para 14(2)); servers in India, with data processed abroad returned within 24 hours (para 14(4)); and listing of every lending app on the RBI's CIMS portal (para 18). Chapter IV covers gold and silver loans.
• RBI (Lending Against Gold and Silver Collateral) Directions, 2025 (RBI/2025-26/47, 6 June 2025; compliance by 1 April 2026), now carried for NBFCs into the consolidated directions. The borrower attends assaying (para 23); the certificate records purity, weight and an image (para 27); communication is in the regional language or one the borrower chooses (para 28); collateral is released within seven working days (para 35) or the lender pays ₹5,000 a day (para 46); auctions need notice to the borrower and advertisements in two newspapers (paras 37 and 38).
• RBI (NBFC – Responsible Business Conduct) Directions, 2025, as amended on 6 August 2026 (RBI/2026-27/230) with new recovery rules from 1 January 2027. These limit borrower information given to recovery staff (para 100O), allow device restrictions only on a financed device, in stages and where the loan agreement expressly permits (paras 100S and 100T), and bar device-control providers from using borrowers' personal data (para 100U).
• Co-lending, now Part B of the RBI (NBFC – Transfer and Distribution of Credit Risk) Directions, 2025 (RBI/DOR/2025-26/352), effective 1 January 2026: a named single point of interface (para 105); reliance on a partner's customer identification (para 120); each lender reports its own share to CICs (para 122); near-real-time sharing of asset classification (para 124).
• RBI (NBFC – Know Your Customer) Directions, 2025 (RBI/DOR/2025-26/361): video-KYC data in India (para 27(3)(i)); five-year records (para 47); secrecy, with no cross-selling on account-opening data without express permission (para 61); CKYCR upload within ten days (para 63(1)).
• RBI (NBFC – Managing Risks in Outsourcing) Directions, 2025 (RBI/DOR/2025-26/363): the NBFC answers for providers, including selling and recovery agents (para 17); need-to-know access (para 24); providers disclose breaches (para 25) and report cyber incidents without undue delay, with the NBFC reporting to the RBI within six hours of the provider's detection (para 61); data in India where applicable (para 74(vi)).
• RBI (NBFC – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/461, 31 July 2026): controls tiered by layer; cyber incidents reported on DAKSH within six hours, with CERT-In notified; HFCs report to the National Housing Bank (para 141).
• Scale Based Regulation (RBI/DOR/2025-26/339): the Upper Layer now comprises NBFCs with assets of ₹1,00,000 crore or more (para 24); HFCs sit in the Middle Layer by default.
• Credit Information Companies (Regulation) Act, 2005 (CICRA): accuracy and security (section 19), privacy principles (section 20), correction within 30 days (section 21). The RBI's framework of 26 October 2023 entitles a complainant to ₹100 a day once a complaint passes 30 days, allows the lender 21 of them, and requires reasons for rejection.
• Other. PMLA section 12; the RBI (NBFC – Internal Ombudsman) Directions, 2026 (14 January 2026); CERT-In's six-hour reporting.

How the layers fit

Section 38(1) makes the DPDP Act additional to these directions; section 38(2) makes it prevail in a conflict; section 16(2) keeps the RBI's India-storage rules alive. The RBI rules are stricter on collection and thinner on the borrower's direct rights, which the Act fills in: a list of recipients, 90-day grievance handling and nomination. Records the RBI or the PMLA requires may be kept under sections 8(7) and 12(3).

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

Who answers to the borrower in a partnered loan

The RBI has not mapped DPDP roles for lending partnerships. In Trayambic's view:

• The NBFC is the fiduciary for the application, underwriting, servicing and recovery of its loans.
• An LSP is, in the RBI's words, the NBFC's agent for digital lending functions, and for those functions a processor. An LSP that runs a marketplace showing several lenders' offers, or uses applicant data for its own marketing, is a fiduciary for that activity and needs its own notice and ground. Where the LSP gives a default loss guarantee, its stake in loan performance is a reason to define tightly what performance data it receives.
• Co-lenders are each fiduciaries for their share: each does or relies on KYC and reports its share to CICs. The Act's definition covers firms that decide purposes "in conjunction with" others. The single point of interface named in the loan agreement is the natural place to give one notice for both lenders and to receive rights requests, and the agreement should say who notifies the Board after a breach.
• Selling agents, recovery agencies, valuers and device-control vendors are processors, for whom the NBFC answers under both the outsourcing directions and section 8(1).
• CICs are separate fiduciaries with their own CICRA duties.

The map should drive each party's notice, the section 8(2) contracts and the recipient list a borrower receives under section 11.

Consent and deletion: two rulebooks, one journey

The RBI and the Act use similar words for different things.

Collection. Para 13(1) requires need-based collection with prior explicit consent and an audit trail. The Act adds an itemised notice of each data item and purpose, how to withdraw and how to complain to the Board, in English or any Eighth Schedule language. The RBI audit trail can then double as the DPDP consent record.

Sharing. Para 13(4) requires explicit consent before sharing with any third party unless law requires it, and the KYC Directions bar cross-selling on account-opening data without express permission. Under the Act, a processor acting for the NBFC needs no separate consent, but an insurer or another lender receiving data for its own purposes does.

Withdrawal and deletion. Para 13(2) lets a borrower revoke consent and ask for deletion. The Act adds that withdrawal must be as easy as giving consent, and that erasure gives way where the KYC Directions or the PMLA require records. A borrower with a live loan can stop marketing, but cannot erase her KYC file or repayment history.

Accuracy. Section 8(3) applies twice in lending: to underwriting decisions and to data reported to CICs, which are other fiduciaries. An internal correction turnaround well inside the 21 days the RBI allows the lender meets both the Act and CICRA.

Gold loans and home loans: data on paper and in newspapers

Gold. The collateral certificate with its image, the ownership declaration and the auction file are personal data held at branch level. Auctions require advertisements in two newspapers, but the RBI does not prescribe their contents. In Trayambic's view a notice should carry only what the auction needs, such as a loan reference and branch, not borrowers' names and addresses, unless another law requires more. Release and auction rules also bring in legal heirs, whose documents should be used only to settle the claim. Collateral still unclaimed two years after repayment must be reported half-yearly to the board or its customer service committee, so its records cannot follow the normal deletion cycle; section 8(7) permits that.

Housing. Title chains and sale deeds name sellers, earlier owners and family members who never dealt with the HFC, and the Act offers no tidy ground for their data. The answer is minimisation: keep what the security interest needs, restrict access to legal and credit staff, and hold it only as long as the mortgage and the law require. HFC cyber incidents go to the National Housing Bank, not the RBI.

Worked example: smartphone loans with device controls

In June 2027 a Middle Layer NBFC finances smartphones at retail counters. An LSP runs the point-of-sale app, and a software vendor supplies the device-control app on each financed phone. Part of the book is co-lent with a bank, with the NBFC as single point of interface.

Attackers compromise the vendor's administrator console, see borrowers' names, phone numbers and device identifiers, and restrict phones whose loans are current.

How the rules apply:

• RBI. The vendor must tell the NBFC without undue delay; the NBFC reports to the RBI on DAKSH within six hours of the vendor's detection and notifies CERT-In.
• Compensation. Restrictions on current loans fall outside para 100S, and borrowers can be expected to claim para 100T's ₹250 an hour for wrongful restriction, capped at the loan amount.
• DPDP Act. This is a personal data breach. The NBFC informs the Board without delay, files a detailed report within 72 hours and tells each affected borrower, including those on co-lent loans. The co-lending agreement should already say whether the bank also reports for its share.
• The processor contract. Para 100U bars the vendor from using borrowers' personal data. The section 8(2) contract should mirror that, require multi-factor access to the console, and set reporting within hours.
• The notice. The onboarding notice should have itemised device identifiers and lock status and explained the staged restrictions; section 11 answers must name the vendor.
• The LSP. If counter tablets kept copies of KYC documents, the LSP held more than para 14(1) permits.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Appoint a DPO. Build the partner role map. Re-paper recovery and device-control arrangements before the Third Amendment takes effect on 1 January 2027. Track consent manager registrations from 13 November 2026.

January to March 2027. Rebuild app, counter and branch onboarding. Settle co-lending allocations. Merge incident playbooks and rehearse a vendor breach and a lost branch file.

April to May 2027. Sign remaining contracts, publish the retention schedule, notify existing borrowers and switch on rights workflows.

Ongoing. Upper Layer NBFCs should prepare for SDF designation. Re-test breach plans every six months and update the role map with each new partner.

Recommendations

1. 1.Start with the partner map. Every notice, contract and access answer depends on who is fiduciary and who is processor.
2. 2.Build DPDP consent records on the RBI consent trail, adding the notice content the Act requires.
3. 3.Write co-lending privacy terms now. Decide which lender notifies, answers rights requests and reports breaches.
4. 4.Hold vendors to hours, not days. The RBI's six-hour clock starts at the provider's detection.
5. 5.Bring branches into scope. Gold certificates, auction notices and property files need the same discipline as app data.
6. 6.Correct credit data fast, well inside the RBI's 21 days.

Key takeaways

• The DPDP Act's impact on NBFCs rates Medium-High: four areas are High, but RBI rules already keep borrower data in India and lenders rarely handle children's data.
• In partnered lending, the NBFC answers under section 8(1) for LSPs, selling and recovery agents, valuers and device-control vendors acting as its processors.
• The RBI's explicit-consent audit trail can anchor DPDP consent records once the Act's itemised notice content is added.
• Breaches go to the Data Protection Board and every affected borrower on top of six-hour RBI or NHB reporting, and the RBI clock starts at the vendor's detection.
• Gold auction notices and HFC property files hold personal data outside digital controls; publish and keep only what each purpose needs.