DPDP by sector
Draft. Awaiting approval.
DPDP for lenders
A lender that keeps personal data in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). Typical work: Loan applications, identity checks, credit decisions, repayments and collections.
Where personal data sits
- Branch or field officer forms
- Loan app or website
- Loan management system
What Fohrkast maps
- Borrower name
- Mobile number
- Email address
- Address
- Date of birth
- KYC ID numbers
- Income and loan details
- Bank details for repayments
- Staff names, phone numbers and salary records
Each use of the data is recorded as a purpose:
- Loan application and account. Check identity, decide on the loan, run the loan account and collect repayments.
- Loan offers. Send offers for new loans.
Which duties weigh most
- Decisions and sharing. Data used to make a decision about a person, or shared with another Data Fiduciary, must be complete, accurate and consistent (s.8(3)).
- Security safeguards. Encryption or masking, control over who opens the systems that hold personal data, access logs, backups, and logs kept for one year (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
- Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay, and the detailed report to the Board within 72 hours (Rule 7). Penalty up to ₹200 crore (s.33, Schedule item 2).
- Requests. A person can ask to see a summary of the data held (s.11), have it corrected or erased (s.12), raise a grievance (s.13) or name a nominee (s.14).
- Vendors. A vendor that handles personal data for the business needs a valid contract with reasonable security safeguards; the business stays responsible (s.8(1), s.8(2)).
Sector rules
The sector regulator's rules for a lender: not set.
A short case
Case: not set. Figures: not set. Customers: not set.
When do the duties start?
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.
Next
- Privacy Check: a look at the website's notices, trackers and forms.
- Plans and prices in INR.
- Book a demo.
Not legal advice.