DPDP Act Compliance for Lenders: Consent, Retention, Breach
DPDP Act Compliance for Lenders: Consent, Data Retention and Breach Duties for NBFCs and Fintechs
Last reviewed: November 2026
DPDP Act compliance for lenders means collecting, using, keeping and protecting borrower personal data in line with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. For most obligations, the deadline is 13 May 2027.
This guide is for Chief Compliance Officers, Data Protection Officers and CTOs at NBFCs and fintech lenders. It focuses on the three areas that touch lending systems most: consent, retention and breach response.
Key Takeaways
- The DPDP Rules were notified on 13 November 2025, and most duties apply from 13 May 2027.
- A proposal to shorten the timeline to 12 months had not been notified as of November 2026.
- Lenders must keep processing logs for at least one year, while laws such as anti-money laundering rules can require longer retention.
- Breaches go to affected borrowers and the Board without delay, with a detailed report within 72 hours.
When Do DPDP Duties Start for Lenders?
The Rules commence in three phases. Lenders have about six months left to finish the build.
| Date | What Commences | What It Means for Lenders |
|---|---|---|
| 13 November 2025 | Rules 1, 2 and 17 to 21, including the Data Protection Board | Board structure in place, no borrower-facing duties yet |
| 13 November 2026 | Rule 4, registration of consent managers | Consent manager ecosystem begins |
| 13 May 2027 | Rules 3, 5 to 16, 22 and 23, plus core sections of the Act and penalties | Notice, consent, safeguards, breach reporting, retention and rights all apply |
MeitY floated a 12-month timeline in January 2026, which would have pulled the main date to November 2026. Gazette checks through autumn 2026 show no notified amendment, but compliance teams should watch for one.
Some duties need no system build but are easy to miss. Rule 9 requires every data fiduciary to publish the contact details of a person who can answer questions about its processing, and to mention them in every response to a borrower.
What Must a Lending Consent Look Like?
Consent must be free, specific, informed and backed by a standalone notice. The Rules set the minimum content.
- Itemised data. List each data item collected, such as PAN, bank statements or device data, rather than "your information".
- Specific purpose. Describe the purpose and the service, for example credit assessment for a named product.
- Easy withdrawal. Withdrawal must be as easy as giving consent, through a link or equivalent channel.
- Rights and complaints. Explain how to exercise rights and how to complain to the Data Protection Board.
Each purpose should be a separate record in your systems. Bundling marketing, cross-sell and credit assessment under one tick box will not survive a rights request.
When Is Consent Not the Right Basis?
The Act also lists legitimate uses that do not need consent. These include data a person voluntarily provides for a specified purpose, and processing needed to meet legal obligations or court orders.
Record the basis for each purpose in your data map. A lender that relies on consent where a legal duty applies may face withdrawal requests it cannot honour.
RBI's digital lending rules already require explicit, need-based consent and India-only storage. A consent intelligence agent can track consent status across purposes, products and partners.
How Long Can Lenders Keep Borrower Data?
Keep data only as long as a purpose or a law requires. The table separates the main categories.
| Data Type | Why You May Keep It | When to Erase |
|---|---|---|
| KYC and customer due diligence records | Anti-money laundering law requires records for five years after the relationship ends | After the statutory period, unless another law applies |
| Loan agreements, KFS and repayment records | Legal, tax and RBI record-keeping duties | When the longest applicable period expires |
| Processing logs and traffic data | DPDP Rules require at least one year from processing | After one year, unless another law needs more |
| Rejected applications | Purpose ends once the decision is made | After any legal minimum, including the one-year log rule |
| Marketing data | Valid only while consent stands | On withdrawal of consent |
| Data held by vendors | Same rules flow through processor contracts | On contract end, with deletion evidence |
The Act requires erasure once the purpose is no longer served, unless retention is necessary to comply with law. Map every field to a retention rule, then let the system enforce it rather than relying on periodic clean-ups.
What Should Processor Contracts Say?
Bureaus, KYC vendors, LSPs and cloud providers all process data for you. The Rules require your contracts with them to provide for reasonable security safeguards.
The Rules' own illustration also expects a processor to keep data and logs for at least a year before erasure. Contracts should add prompt breach notice to the lender, support for rights requests and deletion certificates at exit.
Test environments are a common blind spot. Our guide to test data management for PII covers masking production data before it reaches developers.
Could your systems show, for one borrower, every purpose, consent and retention date?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build lending journeys with consent and retention rules built in.
What Are a Lender's Breach Duties?
A breach triggers several clocks at once. The DPDP clock runs alongside existing cyber reporting duties.
Under Rule 7, the lender must tell each affected borrower without delay what happened, the likely consequences, the mitigation steps and what they can do. It must also tell the Board without delay, then file a detailed report within 72 hours.
Illustrative timeline. An NBFC confirms at 10:00 am on a Tuesday that an LSP's server exposed borrower records.
| Clock | Deadline | Recipient |
|---|---|---|
| RBI cyber incident reporting, six hours | 4:00 pm Tuesday | RBI DAKSH platform |
| CERT-In reporting, six hours | 4:00 pm Tuesday | CERT-In |
| DPDP initial intimation | Without delay | Data Protection Board and affected borrowers |
| DPDP detailed report, 72 hours | 10:00 am Friday | Data Protection Board |
The 72 hours run from 10:00 am Tuesday to 10:00 am Friday, three full days. By then the report must cover the facts and causes, mitigation measures, any findings about who caused the breach, steps to prevent recurrence and the notices sent to borrowers.
The LSP's breach is still the NBFC's problem, because processor contracts must require reasonable safeguards.
The lesson for leadership: one incident playbook should drive all four notifications from a single fact base. Separate teams writing separate stories is how inconsistencies reach regulators.
Security safeguards in the Rules include encryption, masking or tokenisation, access controls and monitored logs. Our article on privacy-enhancing technologies in finance explains the options for protecting data in use.
Does DPDP Stop Lenders From Tracing Defaulters?
No, there is a specific carve-out. Section 17(1)(f) exempts processing to find the financial information, assets and liabilities of a person who has defaulted on a loan from a financial institution.
The carve-out is narrower than it looks. Even under it, the lender remains responsible for compliance and must keep reasonable security safeguards, because those two duties in section 8 still apply.
That processing must still follow disclosure rules in other laws. The exemption covers defaulters, not every borrower, so collections systems should flag when it is relied on and why.
Which DPDP Mistakes Do Lenders Make?
These gaps appear in many lending stacks.
- Bundled consent. One checkbox for credit, marketing and partner sharing fails the specific-purpose test.
- Retention by default. Keeping everything forever creates breach exposure without legal need.
- Unprotected logs. Keeping a year of logs without access controls turns a compliance record into a breach risk.
- Unmapped vendors. Bureaus, verification APIs and analytics tools all process personal data on your behalf.
- No rights workflow. Access, correction and erasure requests need a tracked process and a published response period of no more than 90 days.
A consumer data request agent can route and track rights requests within published timelines.
What Is Changing Next?
The 13 May 2027 date is the main milestone, unless MeitY notifies a shorter timeline. Penalties reach up to ₹250 crore for failing to take reasonable safeguards and up to ₹200 crore for failing to notify a breach.
Consent manager registration opens on 13 November 2026. Borrowers may then give, review and withdraw consent through registered consent managers, so consent records should be able to accept that channel.
The government may also notify Significant Data Fiduciaries, which would face annual impact assessments and audits. Architecture choices made now, such as data residency design, will decide how costly those duties become.
Want a DPDP gap assessment of your loan journeys before May 2027?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how we build lending platforms and AI agents with privacy controls designed in.
