DPDP compliance for NBFCs and microfinance institutions
NBFCs and MFIs process sensitive financial and identity data for millions of borrowers. Here is what the DPDP Act requires and how it sits alongside RBI directions.
What personal data do NBFCs and MFIs process under DPDP?
NBFCs and MFIs collect a comprehensive data profile of every borrower: identity documents (PAN, Aadhaar, passport), income and employment details, bank statements, credit bureau reports, mobile number and email, residential address, and repayment history. Co-applicants and guarantors are separately in scope — their data must be covered by your privacy notice and consent framework. This breadth of sensitive financial data makes NBFCs one of the higher-risk categories under the DPDP Act.
Does processing KYC data require consent under DPDP?
KYC data collected under RBI's Know Your Customer directions is processed on a statutory compliance basis, not on consent. You do not need separate DPDP consent to collect PAN, Aadhaar, or address verification data that is legally mandated. However, any use of KYC data beyond the statutory purpose — for cross-sell marketing, data analytics sold to third parties, or credit-model training — requires its own consent. Maintain a clear mapping of which processing activities are statutory and which are consent-based.
How must NBFCs handle borrower data rights under DPDP?
Borrowers have the right to access the personal data the NBFC holds, to correct inaccurate data (with direct implications for credit decisions if income or employment data is wrong), and to erase data when it is no longer needed after the statutory retention period. Build a customer portal or helpdesk mechanism to action these requests within the prescribed SLA. Incorrect credit data in your system is both a DPDP rights issue and a potential regulatory complaint risk — design the correction workflow to be fast and auditable.
How do RBI and DPDP obligations overlap for MFIs?
RBI's Fair Practices Code for NBFCs and MFIs includes disclosure obligations around data use that overlap with DPDP's privacy notice requirements. RBI's data localisation direction for payment data applies to MFIs operating mobile payment or wallet products. CERT-In's 6-hour incident reporting requirement applies alongside the DPDP breach notification obligation to the Data Protection Board. Design controls that satisfy the most stringent standard across all three regulators and document the overlap so compliance teams are not duplicating effort.
What vendor risks do NBFCs face under DPDP?
NBFCs increasingly use fintech partners — loan origination systems, credit bureau APIs, collection agencies, co-lending platforms, and cloud CRMs — each of which processes borrower personal data. Every such partner is a Data Processor requiring a Data Processing Agreement. Collection agencies that contact borrowers on your behalf handle personal data under your direction — their call practices and data handling are your responsibility as Fiduciary. Conduct annual vendor assessments, particularly for partners with access to Aadhaar or financial data.
Which NBFCs are most likely to be Significant Data Fiduciaries?
Large NBFCs and MFIs processing personal financial data for millions of Indians are candidates for SDF designation — which would require an India-resident DPO, periodic DPIAs, and independent audits. Microfinance institutions serving rural segments, where borrowers may have limited digital literacy and high vulnerability, are likely to attract close regulatory scrutiny. Even if not designated as SDFs, these institutions should build SDF-ready governance as a baseline.
Frequently asked questions
Can an MFI share borrower data with a credit bureau without consent?
Sharing data with credit bureaus is generally covered by a statutory basis — the Credit Information Companies (Regulation) Act requires NBFC members to submit credit data to licensed bureaus. This statutory obligation provides the lawful basis, so separate DPDP consent is not needed for this specific sharing. However, sharing borrower data with non-regulated third parties for marketing or analytics requires explicit consent.
How long can an NBFC retain loan account data after closure?
Retain loan account records for the statutory period required by RBI and tax regulations — typically 8 years from account closure for regulatory compliance. After the statutory period, personal data should be deleted or anonymised unless there is an active dispute or legal proceeding. Do not retain data indefinitely on a general 'might need it' basis — document the specific statutory period for each data category.
Does DPDP apply to borrower data collected through a DSA or business correspondent?
Yes. If a Direct Selling Agent or Business Correspondent collects personal data on your behalf, they are Data Processors and the NBFC remains the Data Fiduciary. Include data protection clauses in your DSA and BC agreements — they must collect only the data you instruct, not repurpose it, and notify you of any incidents involving borrower data.
Assess your NBFC DPDP readiness
Niti Bharat's DPDP Readiness Assessment covers NBFCs and MFIs — consent frameworks for borrower data, RBI overlap, vendor DPAs, and rights workflows in one structured engagement.
Start NBFC DPDP Assessment