DPDP Act for Fintechs, NBFCs and Lending Apps
How India's DPDP Act applies to fintechs, NBFCs and digital lending apps alongside RBI rules: consent, app permissions, data sharing, retention and breaches.
Fintechs, NBFCs, banks and digital lending apps are Data Fiduciaries under the DPDP Act 2023 and must also follow RBI rules on digital lending, which require explicit borrower consent for data collection and limit access to phone resources such as contacts and media. Under the DPDP Act they need itemised notices (Section 5), purpose-specific consent (Section 6(1)), easy withdrawal (Section 6(4)) and proof of consent (Section 6(10)). Section 7 lets them process data without consent where required to comply with law. Large fintechs may be notified as Significant Data Fiduciaries with extra duties under Section 10. Where a sector rule gives more protection, both apply; the DPDP Act prevails over conflicting provisions of other laws (Section 38).
The short answer
If you run a fintech, NBFC, bank or lending app, you follow two sets of rules: the DPDP Act 2023 for personal data in general, and RBI rules for your sector. The DPDP Act’s core duties apply from 13 May 2027, and RBI’s digital lending rules already apply.
How the DPDP Act and RBI rules fit together
Section 38 says the DPDP Act is in addition to other laws, and prevails if a provision conflicts. In practice, follow the stricter of the two on each point.
RBI’s digital lending rules already require lenders and their lending service providers to:
- collect only the data needed, with the borrower’s explicit consent,
- avoid accessing phone resources such as files, media, contact lists and call logs (one-time access to camera, microphone and location may be allowed for onboarding with consent),
- let borrowers deny or withdraw consent and ask for data to be deleted.
That lines up well with the DPDP Act, which adds formal notice, proof and rights duties.
What the DPDP Act adds
Itemised notice
Section 5 requires a notice listing each piece of personal data and its purpose: KYC, credit check, bureau reporting, collections, marketing. Users must have the option to read it in English or any of the 22 Eighth Schedule languages.
Separate consent per purpose
Consent for a loan does not cover marketing or sharing data with cross-sell partners. Under Section 6(1), each purpose needs its own clear choice.
When consent is not needed
Section 7 lets you process data without consent to comply with a law, such as KYC and anti-money laundering obligations. Use this narrowly and record why.
Proof of consent
Section 6(10) puts the burden of proof on you. Lenders face disputes, so keep a record of the exact notice and choice for each user.
Significant Data Fiduciaries
The government may notify large fintechs as Significant Data Fiduciaries under Section 10. That adds a Data Protection Officer based in India, an independent data auditor, periodic Data Protection Impact Assessments and periodic data audits.
Account Aggregator vs DPDP Consent Manager
The RBI Account Aggregator framework already uses consent artefacts to share financial data. A DPDP Consent Manager is different: it is registered with the Data Protection Board under Section 6(9), and the Consent Manager rules come into force on 13 November 2026. Read what changes for Consent Managers.
Penalties
| Breach | Maximum penalty |
|---|---|
| Failing reasonable security safeguards (8(5)) | ₹250 crore |
| Failing to notify a breach (8(6)) | ₹200 crore |
| Significant Data Fiduciary duties (10) | ₹150 crore |
| Other breaches, including consent and notice | ₹50 crore |
Full list: DPDP penalties schedule.
Checklist
- Map every data point your app collects, and remove phone permissions you do not need.
- Write itemised notices per purpose.
- Separate loan consent from marketing and partner sharing.
- Keep signed proof of every consent.
- Give borrowers a portal to access, correct and erase data.
- Review your lending service provider and vendor contracts.
How ConsentPlix helps
ConsentPlix records purpose-level consent as signed receipts, supports Indian language notices and gives users a rights portal. See our pages for fintech and BFSI and digital lending.
DPDP references checked against Act No. 22 of 2023, as of October 2026. Confirm current RBI directions on the RBI website.
Ajay Thanki
Co-Founder & Head of Privacy EngineeringWorks on Merkle audit proofs, tamper-evident data pipelines, and cross-regulation compliance for banking, fintech and enterprise teams.
Continue exploring sovereign compliance engineering.
Ready to deploy provable consent infrastructure?
Deploy in minutes with our sub-12KB SDK or schedule a customized technical consultation with our privacy engineering team.