Edition 1 | Lender's DPDP Digest

Hi there,

The first edition of the Lender’s DPDP Digest is here! 

Most businesses are focusing on May 2027 as the deadline for DPDP implementations. 

But for lenders  there’s an even earlier deadline for one key aspect of DPDP Act that is just 8 weeks away!

The RBI’s RBC (Second Amendment) Directions kick in on January 1, 2027.

While these directions are not framed as DPDP regulations, they have 2 critical requirements that overlap squarely with the DPDP Act.

1. The RBC Amendments require separate consents for each purpose

In most lending journeys, lenders take one bundled “omnibus” consent for use of personal data. This is to enable targeted cross-selling and upselling to customers.

Upselling and cross-selling is at the heart of most lending and wider BFSI business models today:

• Bajaj Finance disclosed that 79.2 million customers out of 124.4 million are part of its “cross-sell franchise” 
• In 2026, HDFC Bank's chairman stated that "over 95% of new-to-bank home loan customers now open Savings Accounts with the Bank"
• 52.97% of private life insurer's policies are sold via corporate agents - mainly banks.

Under the RBC amendments, this is no longer possible.

Para 85L states that REs can no longer bundle consent for different purposes. 

Instead, REs must collect consent for product and marketing  separately - as individual line items. Going a step further, borrowers must now be given the option of opting out of marketing consent when availing loans.

To comply with this, you will need to collect separate, individualized consent for each purpose that you use customer data for. This is a direct overlap with the DPDP Act’s consent requirements - which also mandate separate, individual consent for different purposes.

Therefore, in effect, you will need to go-live with a DPDP-like consent journey by January 1, 2027 itself.  

2. Customers must be able to easily withdraw consent or unsubscribe from services and promotional communication

Today, opting in to any service or promotional communication takes one tap (or sometimes zero) but if a customer wants to opt out, they have to search for a portal, call a helpline or write to the customer support team. In some flows there is no way to withdraw consent at all.

Under Para 85M, this is no longer acceptable. 

Exiting a service or unsubscribing from promotional communication has to be simple, and there may be significant penalties for making cancellation difficult.

In practice, that means giving the customer a place where they can see everything they have consented to and update it whenever they want. 

When a customer withdraws consent, the withdrawal should also reach every system that holds or uses the data - so your marketing platform stops including them in campaigns, and your product teams stop processing data they no longer have permission for.

This also has a direct overlap with the DPDP Act, which requires that withdrawing consent be as easy as giving it was, and requires you to provide a preference centre/consent dashboard for customers. 

So for RBC compliance, by January 1st,  you need to build some type of easy to use Preference Centre where customers can easily view, withdraw and modify their consents. This is identical to what you need to build for DPDP. 

In effect, the RBC Amendments are bringing forward the deadline for 2 key DPDP requirements (separate consents and consent withdrawal) for lenders. 

See you next Thursday!