Last reviewed: 27 August 2026. Basis: DPDP Act, 2023 and DPDP Rules, 2025 (notified November 2025).
Fintechs and NBFCs already operate under a dense RBI stack: Digital Lending Guidelines, the Master Direction on KYC, the Account Aggregator framework, payment data storage rules and the outsourcing and IT governance directions. The DPDP Act, 2023 sits on top of that stack and pulls in a different direction on retention, consent artefacts, cross-border transfer and what a lending app may collect. Most substantive DPDP obligations become enforceable in May 2027, with penalties of up to Rs 250 crore for security safeguard failures. This page gives you the overlap map, a conflict table, lending app collection limits, NBFC priorities and a 90-day plan.
Why dpdp compliance fintech programmes start from the RBI stack, not the Act
Most compliance teams in regulated lenders read the DPDP Act and conclude that they already do most of it. The gap is not that RBI missed something. RBI rules were written for prudential and conduct purposes, while DPDP is written around the data principal, and the two produce different paperwork, rights and timelines for the same data.
| RBI or sector instrument | What it already requires | Where DPDP adds or conflicts |
|---|---|---|
| Digital Lending Guidelines | Borrower consent, need-based phone access, no access to contacts, call logs or media, right to delete | s.5 notice, s.6 consent standard, s.8 erasure, s.11 to s.14 rights and grievance timelines |
| Master Direction on KYC | Retain records at least five years after the relationship ends | Conflicts with s.8 and s.12 erasure; resolves as retention required by law, if documented |
| Account Aggregator framework | Consent artefacts with purpose, range, frequency, expiry, revocation | Artefact covers a data flow; DPDP consent is a legal act with notice attached |
| Payment data storage requirements | Payment system data stored only in India | s.16 permits transfer unless a country is restricted; the RBI rule continues to govern |
| Outsourcing directions | Policy, due diligence, audit rights, confidentiality, exit plans | Valid processor contract required; fiduciary remains responsible; clauses need DPDP terms |
| IT governance and cyber security framework | Governance, incident reporting, logging | Logs retained one year, breach notice “without delay” with a 72-hour report; CERT-In 6-hour reporting and 180-day logs |
Treat each RBI control as the baseline and ask: does it also satisfy the DPDP obligation, and if not, what is the smallest addition that closes the gap? The answer is usually a notice paragraph, a retention flag or a contract annexure, not a new system. Our Act and Rules Explorer lets you read each section alongside the Rules.
What the nbfc dpdp act overlap means for a regulated lender
An NBFC is a data fiduciary for every borrower, guarantor, co-applicant, declined applicant and employee, and usually for data received from bureaus, AA ecosystems and LSPs, because it decides purpose and means once the data lands. That makes the NBFC, not the app vendor or LSP, the entity the Data Protection Board will look at first.
First, every LSP and DLA arrangement is a fiduciary-processor relationship. DPDP requires a processor to be engaged “only under a valid contract” with the fiduciary responsible regardless, so outsourcing agreements need a DPDP annexure covering purpose limitation, sub-processor approval, breach assistance within hours, deletion on exit and audit rights. Our vendor remediation guide sets out the clause set.
Second, declined applicants. Lenders keep declined application data for fraud analysis and model retraining, but s.8 requires erasure once the purpose is served unless retention is required by law, and KYC rules say little about people who never became customers. In our reading, a written retention rule with a defined period and deletion routine is needed.
Third, Significant Data Fiduciary exposure. In our reading, large NBFCs and payment fintechs are plausible candidates once the Central Government notifies classes. SDF status brings a DPO in India, an independent data auditor and periodic DPIAs, with penalties of up to Rs 150 crore. Run the SDF Classifier now so the board has a view before designation lands.
How the digital lending guidelines dpdp overlap limits what a lending app may collect
The Digital Lending Guidelines were, in effect, India’s first data minimisation rule for apps: need-based collection, one-time access to camera, microphone or location for KYC only, and no access to files, media, contacts, call logs or telephony. DPDP sharpens the same principle through s.4 and s.6: a specified purpose, and consent that is free, specific, informed, unconditional and unambiguous.
| Data or permission | RBI position | DPDP test | Recommended posture |
|---|---|---|---|
| Contacts and call logs | Not permitted | No lawful purpose survives; “alternate credit scoring” is not specific enough | Remove the permission entirely; do not rely on consent |
| Media and file storage | Document upload only | Consent for a single upload is specific; blanket storage access is not | Use the OS file picker; never request broad storage access |
| Location | One-time for onboarding or KYC | Continuous tracking needs a fresh, specific purpose and easy withdrawal | One-time capture at KYC; no background location |
| Device identifiers and SMS | Not addressed directly | Fraud prevention is a purpose only if stated in the notice and proportionate | Narrow device fingerprint; no SMS reading without explicit, separable consent |
| Behavioural and usage data | Not addressed | Needs its own purpose and consent toggle; cannot be bundled with the application | Separate optional consent, defaulted off |
Two DPDP rules bite harder than the RBI text. Consent must be unconditional, so a loan cannot be refused because the borrower declined an optional purpose such as marketing. And withdrawal must be as easy as giving, so a permission granted in three taps must be reversible in three taps. Our consent UX guide covers screens that satisfy both regimes.
The s.5 notice also has to be more than the app store privacy label: what is collected, for what purpose, how to exercise rights and how to complain to the Board, in plain language at first data capture.
Account aggregator consent dpdp questions: are AA consent artefacts enough?
A borrower approves an AA artefact specifying the FIP, data types, date range, fetch frequency, purpose code and expiry, and can revoke it through the AA app. It is tempting to treat that as DPDP consent. In our reading it is close but not identical, and the difference matters for the FIU, the lender using the data.
DPDP consent under s.6 must follow a s.5 notice from the fiduciary and be specific to its purpose. The artefact describes the data flow, not what the lender does afterwards. Once statement data arrives, the lender’s purposes (underwriting, fraud checks, model training, cross-sell, collections analytics) are governed by DPDP, and only the first is plausibly covered by the purpose code.
| Question | AA framework answer | DPDP answer | What to do |
|---|---|---|---|
| Who gives notice? | The AA presents the artefact | The FIU must give s.5 notice for its own processing | Show the FIU notice in the redirect flow before the AA consent screen |
| What is the purpose? | Purpose code on the artefact | Specified purpose in the notice; secondary purposes need separate consent | Map each purpose code to a notice purpose; keep model training and marketing separate |
| How is consent withdrawn? | Revocation stops future fetches | Withdrawal must stop processing of data already held | Wire AA revocation events into your own consent register |
Consent manager provisions take effect 12 months from notification of the Rules, and AAs are obvious candidates to register. Until then, treat AA consent as strong evidence for the flow and keep your own consent record for everything you do next.
Fintech data localisation india: payment data, cloud regions and Section 16
Section 16 permits transfer of personal data outside India except to countries the Central Government restricts by notification. That is permissive on its own, but it does not dilute stricter sectoral rules, and three survive DPDP untouched: the RBI payment data storage requirements, the CERT-In Directions of 28 April 2022 (logs kept 180 days within India) and the RBI outsourcing directions on offshore arrangements.
The conflict is rarely the primary database. It is the periphery: analytics warehouses in a US region, support tooling abroad, a fraud vendor’s model endpoint and crash reporting SDKs that ship device data overseas by default. Each is a s.16 transfer DPDP permits, but if the payload contains payment system data or falls within RBI outsourcing scope, the RBI rule controls.
The defensible position is a single transfer register: every dataset leaving India, the recipient, the country, the DPDP basis, the applicable RBI rule and the contractual safeguard. Our Section 16 cross-border explainer covers the register format.
Conflict table: where RBI rules and DPDP pull apart
| Conflict | RBI position | DPDP position | Resolution in our reading |
|---|---|---|---|
| KYC retention vs erasure | Retain KYC and transaction records at least five years after the relationship ends | s.8 erasure when purpose served; s.12 right to erasure | Document the legal basis per record class, restrict retained records to a compliance-only zone, and delete everything not covered |
| AA consent vs DPDP consent | Artefact governs the data fetch | s.5 notice plus s.6 consent govern the fiduciary’s processing | Treat the artefact as consent for the flow; layer your own notice and consent record for downstream purposes |
| LSP and DLA access limits vs need-based collection | Enumerated prohibited permissions; one-time access | Specified purpose and specific consent for every element | Adopt the stricter rule per element; where RBI is silent, apply the DPDP purpose test |
| Payment data localisation vs s.16 | Store in India; delete abroad after processing | Transfer permitted unless country restricted | RBI governs payment data; s.16 governs the rest. One register shows which rule applies to each flow |
A fifth conflict is timelines: CERT-In wants incident reports within six hours, the DPDP Rules want notice without delay with a 72-hour report, and RBI has its own reporting. One runbook with three notification tracks is the only workable answer; our 72-hour breach response guide sets out the sequencing.
NBFC-specific priorities before May 2027
Security safeguards with evidence. Up to Rs 250 crore. The Rules name encryption, access control, one-year log retention, backups and processor contracts. Most NBFCs have the controls; fewer have the evidence packaged by system.
Breach notification readiness. Up to Rs 200 crore. The obligation covers every breach and the clock runs from awareness. Test the runbook with LSPs and cloud providers in the room.
Consent and notice re-papering. Every live journey (app onboarding, AA flow, web, DSA-assisted, collections) needs a s.5 notice and a consent record producible per customer. This has the longest lead time.
Rights handling. Requests need a published response period (maximum 90 days under the Rules) and a workflow that knows which records are KYC-retained. See Your DPDP Rights.
Vendor re-papering. Prioritise LSPs, DLAs, collection agencies, cloud and SaaS by whether they hold payment or KYC data. Starter clauses are in our DPDP Starter Templates.
Indicative effort for a mid-sized NBFC is 4 to 8 months and Rs 40 lakh to Rs 1.5 crore of combined cost, depending on the number of apps and LSP relationships.
A 90-day plan for fintech and NBFC teams
Days 1 to 30: map and decide. Build the data inventory by product and system, including every LSP, DLA and AA integration. Produce the overlap map and conflict table with written positions. Run the SDF Classifier and table the results with the board. Share DPDP 101 with product and engineering leads so the vocabulary is common.
Days 31 to 60: re-paper and re-engineer. Redraft notices and consent screens per journey with optional purposes defaulted off. Strip app permissions to the table above. Issue DPDP annexures to the top 20 vendors by data risk. Define retention classes with deletion routines.
Days 61 to 90: prove it. Run the breach tabletop with three notification tracks. Test a rights request that touches KYC-retained data. Build the transfer register and check every overseas SDK and SaaS flow against it. Package security evidence per system.
Frequently Asked Questions
Does complying with the RBI Digital Lending Guidelines make a lending app DPDP compliant?
Not on its own. The guidelines cover collection limits and borrower consent, but DPDP adds a formal s.5 notice, a consent standard that includes unconditionality and easy withdrawal, rights with published timelines, breach notification to the Board and processor contracts. In our reading a guideline-compliant app is roughly two-thirds of the way there.
How can an NBFC honour an erasure request when RBI KYC rules require five-year retention?
Retention required by law is recognised under the DPDP Act, so KYC and transaction records within the mandated period can be retained and the borrower told why. The request must still be honoured for everything outside that requirement, such as marketing profiles and behavioural data. Document the record classes and their legal basis so the response is consistent.
Is Account Aggregator consent the same as DPDP consent?
They overlap but are not identical. The AA artefact authorises a specific data fetch, while DPDP consent must follow the lender’s own notice and cover every purpose pursued after the data arrives. Treat the artefact as strong evidence for the flow and keep your own consent record for underwriting, fraud, analytics and any secondary use.
Does Section 16 of the DPDP Act relax RBI data localisation for payment data?
No. Section 16 permits transfers except to restricted countries, but stricter protections under other laws continue to apply, including the RBI payment data storage requirements and outsourcing directions. Payment system data stays in India; other personal data may move under s.16 with a documented basis and processor contract.
Related explainers
Next step
If you run an NBFC, a lending app or a payment platform and want the RBI-to-DPDP overlap map, conflict positions and 90-day plan built for your own products, our sector Readiness Sprint does exactly that in a fixed scope. Book a scoping conversation through our services page.