Digital Trust · DPDP for Fintech

DPDP for fintech: consent that survives the onboarding funnel.

For founders, CTOs, CISOs and compliance heads at payments, lending, wallet and BNPL companies. Fintechs collect more personal data per user than almost any other sector, share it with more partners, and run under RBI, NPCI and lending-partner rules at the same time as the DPDP Act.

Onboarding consentBureau & partner sharingDigital lendingRBI retention vs erasureBreach playbook

Request a Fintech DPDP Assessment Run the Free Gap Assessment

Where this starts

What fintech teams usually discover in week one.

The privacy policy exists. The gaps are operational: what was collected under which consent, who it went to, and whether anyone can prove it. If three or more of these apply, a scoped gap assessment is the right first step.

Regulators & rule-sets in play

RBINPCILending partners (banks/NBFCs)CERT-InData Protection Board

Sound familiar?

Onboarding has one “I agree” checkbox that covers KYC, bureau pull, marketing, partner sharing and device permissions at once.
Your app requests contacts, SMS or location permissions and nobody can articulate the specific purpose for each.
Data flows to co-lending partners, collection agencies and analytics vendors without a per-partner record of what is shared and why.
A user who closes their account still gets promotional messages months later.
Retention policy is “forever”, justified by “RBI might ask”, with no distinction between KYC records and everything else.
Your breach response plan covers the payment switch and cloud, but not the collections vendor with a full export of your customer base.

Personal data in scope

The data a Fintech organisation actually holds.

A DPDP programme starts with an honest inventory. These are the categories we typically find across fintech systems — each needs a purpose, a basis, an owner and a retention period.

Identity and KYC documents
PAN, bank account and UPI identifiers
Device, location and SMS-derived signals
Credit bureau reports and scores
Transaction history and repayment behaviour
Contact lists and references (where collected)

Customer entering card details on a laptop — the point at which a fintech collects consent and personal data

How the Act applies

DPDP obligations, translated for Fintech.

The Act is sector-neutral. Its impact is not. These are the obligations that carry the most weight for your workflows.

Specific consent, not bundled consent

Bureau pulls, partner sharing, marketing and device permissions each need a clear, separate purpose the user can understand and decline. A single onboarding checkbox does not survive scrutiny.

Notice in the language of the user

Your notice must say what you collect, why, who receives it and how to complain — readable on a phone, in the languages your customers use.

Withdrawal as easy as consent

If consent was one tap, withdrawal cannot be an email to support. Withdrawal must stop downstream processing — marketing, partner sharing, analytics — not just the notification.

Accountability for partners and processors

Collection agencies, KYC vendors, analytics SDKs and cloud providers act on your behalf. Their contracts, deletion terms and breach duties are your responsibility.

Breach notification

Personal data breaches must be reported to the Data Protection Board and affected users. CERT-In reporting timelines run in parallel. Both need a rehearsed playbook, not a policy document.

We keep legal specifics general on this page. Section-level analysis, penalty exposure and interpretation are worked through with your counsel during the engagement.

The hard part

RBI says keep the KYC record. DPDP says erase on withdrawal. Both are right.

RBI’s KYC directions require customer identification records to be retained for years after the relationship ends. The DPDP Act requires erasure when consent is withdrawn or the purpose is served — unless another law requires retention. The resolution is not choosing a regulator; it is classifying data correctly.

How we resolve it

Data held under a statutory mandate (KYC, transaction records for AML) is tagged with its legal basis and retention period, and excluded from erasure with a documented reason.
Everything else — marketing preferences, behavioural signals, analytics profiles, contact lists — is erased or anonymised on withdrawal.
The erasure response to the user states what was deleted, what was retained, and under which law — this is the evidence a regulator or the Board will ask for.
Partners receive the withdrawal signal so their copies follow the same rule.

In your workflows

Where consent, notice and rights actually show up.

Onboarding & KYC

Layered notice at collection, purpose-specific toggles, consent record versioned against the notice the user actually saw.

Credit decisioning & partner sharing

A register of every bureau, lender and scoring vendor with purpose, data fields and contract clause — so “who has my data?” has an answer.

Collections & communications

Preference and withdrawal signals enforced in the dialer, SMS and WhatsApp tooling; agencies bound by processor terms and deletion SLAs.

Account closure

A retention-vs-erasure decision applied automatically per data category, with a closure statement to the user.

Want to know which of these is your biggest gap? The free assessment takes about ten minutes and scores seven compliance areas.

Run the Gap Assessment

Typical starting points

Three ways Fintech clients begin.

Scoped, time-boxed and designed to produce evidence early — so the board and the regulator see progress inside the first month.

First engagements

DPDP gap assessment across one product line (e.g. personal loans or wallet) in two weeks
Consent and notice redesign for the onboarding journey, with a versioned consent log
Retention-vs-erasure policy and account-closure workflow, reconciled with RBI KYC directions

How the programme runs

From gap assessment to continuous readiness.

Week 1–2 · Gap assessment

Data inventory, consent and notice review, vendor and rights-process review, breach readiness. Prioritised findings.

Week 3–6 · Remediation sprint

Notice and consent redesign, retention-vs-erasure matrix, vendor contract terms, breach playbook — highest-risk gaps first.

Week 7–12 · Operations

Rights-request workflow, consent logging and evidence store live in Avisha Trust; teams trained; first evidence pack produced.

Ongoing · Monitoring

Quarterly reviews, vendor re-assessment, AI-usage tracking and readiness reporting to the board.

Built for the Indian regulatory stack

We reconcile DPDP with the sector rules that already bind you, instead of importing a foreign template.

Security and compliance from one team

“Reasonable security safeguards” are tested by the people who run VAPT and incident response, not only described in policy.

Evidence, continuously

Avisha Trust captures consent, rights requests and attestations so the answer to “show me” is an export, not a project.

FAQ

DPDP for Fintech: questions we hear most

It overlaps but does not cover it. RBI’s guidelines constrain what data a lending app may collect and how it may be shared; DPDP adds consent, notice, data principal rights, breach notification and processor accountability across all your processing — including marketing and analytics that RBI does not address.

Only where there is a specific, explained purpose the user can decline without losing the core service, and subject to sector rules that may prohibit certain collection outright. We map each permission to a purpose and remove the ones that cannot be justified.

Records you are required to keep by law stay, with a documented basis. Data you hold only under consent is erased or anonymised, and the withdrawal is propagated to partners under your contracts. The user receives a statement of what was retained and why.

A gap assessment on one product line typically takes two weeks. Consent, rights and retention remediation for that product usually lands in six to ten weeks, followed by monitoring through Avisha Trust. Multi-product groups run in waves.

Related sectors

Start with your sector’s pressure point.

Request a scoped Fintech DPDP assessment, or run the free gap assessment first.

Request a Fintech Assessment Free Gap Assessment