.svg){kind=small}
Is your digital lending journey DPDP compliant?
Find out in this Practical Guide to DPDP Compliance for Digital Lenders.
We are helping India’s biggest lenders implement DPDP flows. We have consolidated the learnings into this comprehensive DPDP guide for digital lenders.
With this guide, you can answer questions like:
Do I need consent for KYC?
What should I do if the customer doesn’t give consent?
Am I a Data Fiduciary or a Data Processor for this flow?
RBI wants me to retain for 10 years, my customer wants deletion, what do I do?
A peek inside the handbook
How to build a consent notice
Breach response timeline
FAQs
Do I need to collect consent for KYC if RBI mandates it anyway?
Yes, a purpose being mandatory doesn't remove the consent requirement under DPDP or RBI's own rules. Only the consequence of refusal changes, if the borrower declines, you can end the journey there and not provide them the service.
RBI wants me to retain data but the borrower is asking me to delete it. What do I do?
You can retain it. Section 8(7) of the DPDP Act allows retention where another law requires it. However, you have to tell the borrower why you are retaining it, use it for nothing else and delete when the retention period ends.
Do I need a registered Consent Manager? Is there one yet?
No, and no. Zero registered consent managers exist today and the registration window only opens on 13 Nov 2026. You do not need a Consent Manager, the borrower chooses the Consent Manager, not you.
Is my fintech / LSP a data fiduciary or a data processor?
It is almost always a data fiduciary. If you decide what data is collected and how it's used, you're a fiduciary, independently accountable alongside the RE. A KYC vendor acting only on your instructions is a processor.
Can my LSP collect consent on behalf of the RE, and is that legal under DPDP?
Yes. While RBI's Credit Facilities Directions require explicit consent before data transfer to a third party, the DPDP doesn't specify which party must collect it. In practice, this can be done by the first Data Fiduciary by collecting consent for its own processing, transfer of data and the receiving RE's purposes.
What counts as a data breach, and when does the 72-hour clock start?
Any unauthorised processing or accidental disclosure/loss/alteration is a data breach including emailing a sanction letter to the wrong borrower or a lost field-agent phone. The 72-hour clock starts when you become aware of the breach.
Can I use the research exemption for borrower analytics and marketing?
No. The research and statistics exemption bars individual-level decisions, so using it to profile borrowers or target products isn't permitted.
