Readiness assessment
The Act
The DPDP Act, explainedNotice · Section 5Consent · Section 6Security · Section 8The DPDP Rules 2025Glossary
Industries
Fintech & BankingHealthcare & PharmaE-commerce & RetailSaaS & TechnologyEdTechGCC & Global CentresBrowse all sectors
Implementation
DPDP implementationFintech & digital lendingDPDP services & partnersVirtual DPOGet certified
Resources
Readiness assessmentGuidesBy roleGlossaryNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Fintech & Banking · Digital Lending · BNPL

The DPDP Act for BNPL

Buy-now-pay-later blends lending and payments, often with younger users, under the RBI Digital Lending Directions and PPI rules.

In short

BNPL is digital lending: the RBI (Digital Lending) Directions, 2025 apply, and where a PPI is involved so do the PPI rules. Consent must be granular and the lender stays liable for the app. With younger user bases, watch the under-18 line. Penalties reach ₹250 crore.

Core impacts

What changes for this niche, and the specific rule it turns on.

Lending rules apply

BNPL is treated as digital lending; the RBI Directions and lender liability apply just as for loan apps.

Split the consents

Underwriting consent is not marketing consent; keep purposes separate and revocable.

Watch the age line

BNPL skews young; anyone under 18 is a child, triggering verifiable parental consent and the tracking and ad ban.

No device harvesting

The RBI ban on contacts, media and call logs applies to BNPL apps too.

Common questions

Short, cite-able answers, mirrored in FAQPage schema.

Is BNPL covered by the RBI Digital Lending Directions?
Yes, where it is structured as credit; the Directions and lender liability apply, and PPI rules apply where a prepaid instrument is used.
Do children rules affect BNPL?
If under-18s can use it, yes: verifiable parental consent and the ban on tracking and targeted ads apply.
What data can a BNPL app collect?
Only what the credit decision needs, with explicit consent; it cannot harvest contacts, media or call logs.

Where to start with BNPL

Fix consent-splitting and the age line first.

Stage 1

Learn

Understand the rules for your niche.

Stage 2

Assess

See where you stand and find gaps.

Stage 3

Prepare

Map data, notices and consent.

Stage 4

Implement

Put safeguards in place.

Stage 5

Monitor

Review and stay compliant.

Check your BNPL flow.

The readiness check flags consent, device-data and age-assurance gaps.

Take the readiness check →