The Digital Personal Data Protection Act 2023 (DPDP Act) is India’s comprehensive data privacy law. It came into effect in stages from 2024. For NBFCs, it adds a statutory privacy compliance layer privacy-compliance layer on top of the existing RBI data-governance requirements.
DPDP Act for NBFCs in credit operations creates specific obligations around consent collection, data minimisation, purpose limitation, and borrower Data rights. These obligations interact with and, in some cases, strengthen the consent requirements already mandated by the Digital Lending Directions 2025. This guide covers what NBFCs must do differently under the DPDP Act.
What the DPDP Act Requires from NBFCs as Data Fiduciaries
DPDP Act classifies any entity that “determines the purpose and means of processing personal data” as a Data Fiduciary. NBFCs that collect, process, and use borrower financial data for credit assessment and lending decisions are Data Fiduciaries under this definition.
Data Fiduciaries have six core obligations under the DPDP Act:
- Lawful processing: personal data can only be processed with valid consent or under one of the listed legitimate purposes (employment contract, legal obligation, emergency, etc.).
- Purpose limitation: data collected for credit assessment may not be used for marketing, cross-selling, or any purpose other than the stated credit assessment purpose without separate consent.
- Data minimisation: collect only the personal data that is necessary for the stated purpose. Collecting more data than the credit assessment requires is a DPDP Act violation.
- Accuracy: the NBFC must take reasonable steps to ensure that personal data being processed is accurate and complete.
- Storage limitation: personal data should not be retained beyond the period necessary for the stated purpose. The NBFC’s data retention policy must specify the retention period for each data type.
- Accountability: the NBFC must implement appropriate technical and organisational measures to ensure compliance and must be able to demonstrate compliance to the Data Protection Board.
DPDP Consent Requirements for Credit Bureau and Bank Statement Data
DPDP Act consent requirements for NBFCs are more specific than most existing consent practices. The Act requires that consent be:
- Specific: consent must identify exactly what data will be collected, for what specific purpose, and how long it will be retained. A generic “I consent to data processing” checkbox does not meet this standard.
- Informed: the Data Principal (borrower) must understand what they are consenting to. Consent notices must be in plain language, not legal jargon.
- Freely given: consent cannot be conditional on accepting broader data processing than is necessary for the immediate transaction. An NBFC cannot make loan sanction contingent on consent to marketing data use.
- Withdrawable: the borrower must be able to withdraw consent at any time. Withdrawal must be as easy as giving consent: a simple app interface or written request, not a complex bureaucratic process.
For credit bureau data specifically: the DPDP Act consent must specify that a credit bureau enquiry will be made, which bureau will be queried, and the exact purpose (credit assessment for the specific loan application). This aligns with the Digital Lending Directions 2025 consent requirements, effectively making both sets of requirements converge on the same detailed consent standard.
Data Minimisation and Purpose Limitation in NBFC Credit Operations
Data minimisation under the DPDP Act requires NBFCs to collect only what is necessary for credit assessment. This has practical implications for the scope of data collection.
A personal loan application requires income verification and credit history assessment. Collecting the borrower’s complete investment portfolio, insurance policy details, or social media profile for a personal loan credit assessment is not minimal data collection.
Purpose limitation has a direct implication for Account Aggregator data use. If the NBFC collects bank statement data through the AA framework for credit assessment, it cannot use that same data for:
- Marketing new loan products to the borrower based on the transaction pattern.
- Sharing the transaction data with an insurance partner for policy offers.
- Using the data in any AI model training that is not directly related to the stated credit assessment purpose.
Each of these additional uses requires a separate consent obtained specifically for that purpose. The AA consent artefact does not authorise secondary use beyond the stated credit assessment purpose.
Borrower Data Rights Under the DPDP Act
The DPDP Act gives borrowers (Data Principals) specific rights over their personal data. NBFCs must have operational mechanisms to handle these rights requests.
- Right to access: borrowers can request to know what personal data the NBFC holds about them. The NBFC must respond within the time limit specified in the Data Protection Board rules (expected to be 30 days in the implementation rules).
- Right to correction: borrowers can request that inaccurate personal data be corrected. The NBFC must assess and act on correction requests; this parallels the bureau dispute obligation but covers data the NBFC itself holds.
- Right to erasure (right to be forgotten): borrowers can request deletion of their personal data when the purpose for which it was collected has been fulfilled. For credit data, this interacts with the mandatory retention periods under RBI guidelines, which override the erasure request for the required retention period.
- Right to grievance redressal: borrowers must be able to file complaints about DPDP Act violations with the NBFC first and then with the Data Protection Board if the NBFC’s response is unsatisfactory.
Significant Data Fiduciary Obligations for Large NBFCs
The DPDP Act allows the Government to notify specific entities as “Significant Data Fiduciaries” based on data volume, sensitivity, or risk to national security. Significant Data Fiduciaries face additional obligations:
- Appointment of a Data Protection Officer (DPO), a senior officer responsible for DPDP Act compliance.
- Regular Data Protection Impact Assessments for high-risk processing activities.
- Annual compliance audits by an independent data auditor.
While the criteria for Significant Data Fiduciary notification have not yet been fully defined by the government, large NBFCs, particularly those processing credit data for millions of borrowers, should prepare for potential notification and plan DPO appointments and audit frameworks accordingly.
Key Takeaways
- DPDP Act for NBFCs classifies NBFCs as Data Fiduciaries with six core obligations: lawful processing, purpose limitation, data minimisation, accuracy, storage limitation, and accountability.
- DPDP consent requirements specific, informed, freely given, and withdrawable align with and strengthen the existing Digital Lending Directions 2025 consent standards.
- Purpose limitation prohibits using credit assessment data (bank statements, bureau reports) for marketing, cross-selling, or model training beyond the stated credit purpose without separate consent.
- Borrowers have rights to access, correction, and erasure of their personal data. NBFCs need operational workflows to handle these requests within the required timelines.
- Large NBFCs may be notified as Significant Data Fiduciaries, triggering DPO appointment, Data Protection Impact Assessment, and annual audit obligations.
Frequently Asked Questions
What is the DPDP Act and how does it apply to NBFCs? The Digital Personal Data Protection Act 2023 is India’s comprehensive data privacy law. It applies to any entity that collects, stores, or processes personal data of individuals in India. NBFCs, which collect extensive borrower financial data for credit assessment, are Data Fiduciaries under the Act, subject to six core obligations: lawful processing, purpose limitation, data minimisation, accuracy, storage limitation, and accountability.
Does the DPDP Act replace the RBI’s Digital Lending Directions consent requirements? No. The DPDP Act adds a statutory privacy layer on top of the existing RBI consent requirements. Both sets of requirements apply simultaneously. In practice, the DPDP consent standard (specific, informed, freely given, withdrawable) aligns with and in some areas strengthens the Digital Lending Directions 2025 consent specificity requirements. NBFCs must meet both.
Can an NBFC use bank statement data collected for credit assessment for marketing purposes? No. The DPDP Act’s purpose limitation principle prohibits using personal data for any purpose other than the specific purpose for which consent was obtained. If bank statement data was collected for credit assessment, it cannot be used for marketing loan products based on the transaction pattern, sharing with third parties for any commercial purpose, or model training beyond the stated credit assessment use case.
What is a Data Protection Officer and do NBFCs need one? A Data Protection Officer (DPO) is a senior officer responsible for DPDP Act compliance, appointed for entities notified as Significant Data Fiduciaries. Not all NBFCs require a DPO; only those specifically notified as Significant Data Fiduciaries by the government do. However, all NBFCs would benefit from designating an internal DPDP Act compliance owner, even if not legally required to appoint a formal DPO.
What are the penalties for DPDP Act violations for NBFCs? The DPDP Act provides for financial penalties up to Rs 250 crore for certain violations, particularly those involving significant harm to Data Principals (borrowers). For failure to implement reasonable security safeguards: up to Rs 250 crore. For failure to respond to Data Principal rights requests: up to Rs 10,000 per instance. The Data Protection Board has enforcement and adjudication powers.
Conclusion
DPDP Act for NBFCs is not a future obligation to be planned for. It is a current obligation with defined penalties. The data practices that NBFCs have built for RBI Digital Lending Directions compliance are the right starting point, but they need to be extended to cover the DPDP Act’s additional requirements: purpose limitation, data minimisation, and borrower data rights.
The NBFCs that will navigate this regulatory environment most efficiently are those that build a unified data governance framework meeting both the RBI’s credit operations requirements and the DPDP Act’s privacy requirements from a single, consistent set of policies and workflows.
Two regulators, one consent. Build the consent architecture to satisfy both.
July 18, 2026
8 min read
