DPDP Act for fintech, banks and lenders: KYC, loan apps and recovery vendors

A bank, non-banking financial company, digital lending app, payment aggregator or wealth platform handles personal data at every step of the customer journey. From mobile number onboarding and identity verification to credit bureau pulls, account aggregation, repayment servicing and overdue collections, the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to every digital personal data flow.

Where the Act lands across the lending and fintech workflow

In financial services, one entity rarely holds the entire customer journey alone. A regulated lender may own the loan book while a lending service provider runs the mobile interface, a verification vendor handles video or identity checks, a bureau supplies credit history, and a field or call-centre agency handles collections. Under the Act, the entity that decides why and how borrower or customer data is processed is the Data Fiduciary, and every vendor that processes data on its behalf is a Data Processor.

Why a loan agreement or key fact statement is not a consent notice

Financial products already carry regulatory disclosures such as key fact statements, sanction letters and terms of service. Under the data protection law, however, a consent notice must be presented and understandable independently of any other document you ask the customer to sign. Burying data sharing permissions inside a thirty-page loan agreement or bundling cross-sell marketing with credit underwriting puts the validity of consent at risk.

The notice must give an itemised list of the personal data you collect, the clear purpose for each item, and the direct link and description for withdrawing consent, exercising rights and filing a grievance. When a customer applies for a credit line, the request for core underwriting data must stay separate from any optional permission to pitch insurance, mutual funds or partner credit cards.

Lending service providers, verification vendors and collection agencies

Outsourced lending apps, KYC verification providers, cloud hosting platforms and debt recovery agencies process borrower data on the lender's instructions. The Act makes two rules crystal clear for every Data Fiduciary:

• You remain legally responsible for compliance even when a Data Processor carries out the processing on your behalf, regardless of what your vendor contract says.
• You may engage a Data Processor to handle customer data only under a valid contract that requires the processor to maintain reasonable security safeguards, restrict access, keep processing logs and delete data when instructed.
• When a customer withdraws consent for an optional flow, you must stop processing that data and cause your downstream processors to stop as well.
• If a breach occurs at a verification vendor or collection agency, the obligation to notify the Data Protection Board of India without delay, file the 72-hour detailed report and alert every affected customer still rests on you.

When a borrower asks you to delete their data

Borrowers and account holders have the right to ask for erasure of their personal data once the specified purpose is no longer served. In banking and lending, however, sector regulations and tax laws require keeping closed loan records, repayment ledgers and know-your-customer files for fixed multi-year periods.

The Act explicitly accommodates this overlap. Its own statutory illustration notes that when a customer closes a bank account, the bank must retain the customer's personal data if another law requires keeping the record for ten years. In practice, your loan management and archival systems should separate the statutory core record—which stays locked under legal hold until the banking retention clock expires—from optional marketing profiles, app telemetry and unaccepted lead records, which must be erased on request or when their purpose ends.

Our view: an eight-point control checklist for fintech and BFSI teams

In our view, fintech, banking and lending teams preparing for the 13 May 2027 enforcement date should put eight practical controls in place across product, engineering and compliance: