Digital Trust · DPDP for NBFC

DPDP for NBFCs: the regulator already asks for the consent record.

For compliance heads, CROs, CISOs and CTOs at NBFCs and HFCs. You already answer to RBI on KYC, outsourcing, fair practices and cyber security. DPDP adds a second set of obligations over the same customer data — and RBI inspections increasingly ask for the consent and rights-request evidence that DPDP demands.

RBI + DPDP dual obligationsCo-lending flowsCollections outsourcingRetention vs erasureBoard-level evidence

Request a NBFC DPDP Assessment Run the Free Gap Assessment

Where this starts

What NBFC teams usually discover in week one.

The privacy policy exists. The gaps are operational: what was collected under which consent, who it went to, and whether anyone can prove it. If three or more of these apply, a scoped gap assessment is the right first step.

Regulators & rule-sets in play

RBICredit bureaus (CICs)Co-lending bank partnersCERT-InData Protection Board

Sound familiar?

Loan origination collects income proofs and bank statements for every applicant — including the majority who are rejected — and keeps them indefinitely.
Co-lending and DSA arrangements move full application files between entities with no register of what each party holds.
Collections is outsourced to agencies that receive spreadsheets by email.
Guarantors and co-applicants never see a notice; they are “in the file”.
Your data retention schedule is one line: “as per RBI”.
The board asks about DPDP and the answer is a slide about the privacy policy.

Personal data in scope

The data a NBFC organisation actually holds.

A DPDP programme starts with an honest inventory. These are the categories we typically find across NBFC systems — each needs a purpose, a basis, an owner and a retention period.

KYC and CKYC records
Income, employment and bank statements
Bureau reports and internal scores
Loan, EMI and default history
Collateral and property documents
Guarantor and co-applicant data

Financial district towers representing RBI-regulated non-banking financial companies

How the Act applies

DPDP obligations, translated for NBFC.

The Act is sector-neutral. Its impact is not. These are the obligations that carry the most weight for your workflows.

Notice and consent for every data principal in the file

Applicants, co-applicants, guarantors and references are all data principals. Each needs notice; consent-based processing needs their consent, not the borrower’s.

Purpose limitation across the loan lifecycle

Data collected to assess a loan cannot silently become cross-sell, partner referral or collections intelligence without a basis the data principal was told about.

Rejected applicants are not free data

Files of rejected or withdrawn applications need a defined retention period tied to a legitimate purpose, then deletion — not indefinite storage.

Processor accountability for DSAs, agencies and vendors

RBI’s outsourcing directions and DPDP both make you accountable. Contracts must cover purpose, security, sub-processing, deletion and breach duties.

Evidence the Board and RBI can read

Consent logs, rights-request records, retention decisions and breach drills need to exist as records, not reconstructions.

We keep legal specifics general on this page. Section-level analysis, penalty exposure and interpretation are worked through with your counsel during the engagement.

The hard part

Where RBI directions and DPDP pull in different directions — and how to document the resolution.

KYC retention, AML record-keeping and fair-practice audit trails require you to keep data. DPDP requires erasure once the purpose ends or consent is withdrawn, unless another law requires retention. A defensible programme names, per data category, which rule wins and why.

How we resolve it

A data inventory that tags every category with legal basis (statutory / contract / consent) and retention period.
A retention-vs-erasure matrix approved by compliance and legal, applied automatically at account closure and on withdrawal.
Erasure responses that state what was retained under which direction — the answer an RBI inspector or the Board expects.
Propagation of withdrawal to co-lenders, DSAs and agencies under your contracts.

In your workflows

Where consent, notice and rights actually show up.

Origination

Layered notices for all parties in the file, purpose-specific consents, versioned consent records, deletion schedule for rejected applications.

Co-lending & DSA

Per-partner data-sharing register with fields, purpose, contract clause and deletion terms; audit trail of every transfer.

Collections

Agency onboarding with processor terms; preference and withdrawal signals enforced in dialer and messaging tools; access logging for exported data.

Closure & rights requests

Access, correction and erasure workflows with tracked SLAs; retention decisions evidenced per request.

Want to know which of these is your biggest gap? The free assessment takes about ten minutes and scores seven compliance areas.

Run the Gap Assessment

Typical starting points

Three ways NBFC clients begin.

Scoped, time-boxed and designed to produce evidence early — so the board and the regulator see progress inside the first month.

First engagements

Two-week DPDP gap assessment across origination, co-lending and collections
Retention-vs-erasure matrix reconciled with RBI KYC and outsourcing directions, approved by compliance
Vendor and agency contract remediation with a processor register in Avisha Trust

How the programme runs

From gap assessment to continuous readiness.

Week 1–2 · Gap assessment

Data inventory, consent and notice review, vendor and rights-process review, breach readiness. Prioritised findings.

Week 3–6 · Remediation sprint

Notice and consent redesign, retention-vs-erasure matrix, vendor contract terms, breach playbook — highest-risk gaps first.

Week 7–12 · Operations

Rights-request workflow, consent logging and evidence store live in Avisha Trust; teams trained; first evidence pack produced.

Ongoing · Monitoring

Quarterly reviews, vendor re-assessment, AI-usage tracking and readiness reporting to the board.

Built for the Indian regulatory stack

We reconcile DPDP with the sector rules that already bind you, instead of importing a foreign template.

Security and compliance from one team

“Reasonable security safeguards” are tested by the people who run VAPT and incident response, not only described in policy.

Evidence, continuously

Avisha Trust captures consent, rights requests and attestations so the answer to “show me” is an export, not a project.

FAQ

DPDP for NBFC: questions we hear most

Yes. RBI directions govern prudential, KYC, outsourcing and cyber matters. DPDP governs personal data as a right of the individual: consent, notice, rights requests, breach notification and processor accountability. The same customer record is subject to both, and the evidence for each overlaps only partly.

They are data principals in their own right. Where processing relies on consent, it must be theirs; in all cases they need notice. We design origination so this is captured at the point of collection rather than reconstructed later.

Define a purpose and a retention period for it (fraud prevention, regulatory audit, re-application), then delete or anonymise on schedule. Indefinite retention of income documents for people who never became customers is one of the most common gaps we find.

Typically: the consent record for a named customer, the notice version they saw, the register of who their data was shared with, the rights-request log, the retention decision at closure, and proof of breach-response readiness. Avisha Trust is built to answer those from a single export.

Related sectors

Start with your sector’s pressure point.

Request a scoped NBFC DPDP assessment, or run the free gap assessment first.

Request a NBFC Assessment Free Gap Assessment