DPDP Compliance for NBFCs in India

Does the DPDP Act apply to NBFCs?

The Digital Personal Data Protection Act, 2023 regulates the processing of digital personal data. An NBFC that decides the purpose and means of processing borrower or customer data is a Data Fiduciary for that processing, and carries the Act's primary duties: lawful basis, notice, security, retention limits, rights and grievance handling.

Classification is activity-specific, not entity-wide. Third parties involved in lending, KYC, collections, cloud hosting or distribution may be Data Processors acting on the NBFC's instructions, independent Data Fiduciaries determining their own purposes, or separately regulated entities. The Act's role definitions turn on that factual analysis, not on the label used in a contract.

DPDP does not switch off existing obligations: RBI directions on KYC, digital lending, outsourcing and cyber incidents, and the recordkeeping duties under the Prevention of Money Laundering Act, continue to apply alongside it. How the two frameworks interact under Section 38 is set out in the DPDP × RBI crosswalk below.

What is the DPDP compliance deadline for NBFCs?

Plan against the operating model that must be ready by 13 May 2027, notice, lawful basis, rights, grievance, security, breach response, processor contracts, retention and (if notified) SDF duties, while recognising that many privacy-adjacent obligations are already live under sector law.

Where personal data enters an NBFC: the borrower lifecycle

Personal data enters an NBFC at every stage of the loan, and each stage carries a different privacy risk and a different regulatory overlay. Mapping the lifecycle is the fastest way to see where DPDP duties, RBI rules and KYC retention actually bite.

Not every NBFC uses every stage or data category; treat this as a mapping template, not a claim about a specific lender.

DPDP Act vs RBI requirements for NBFCs

DPDP and RBI often regulate the same processing for different reasons: DPDP for personal-data protection, RBI for prudential, conduct and financial-integrity purposes. The crosswalk below maps common issues, and names which regulator creates each obligation. RBI Digital Lending Directions apply to digital-lending activity, not to every NBFC operation.

Which rule applies? An NBFC privacy decision table

A fast reference for the situations NBFC teams meet most often. It shows which framework drives each obligation, so responsibility is assigned to the correct regulator rather than defaulting everything to "DPDP."

When does an NBFC need consent under DPDP?

Under s.4, personal data may be processed for a lawful purpose either with consent (s.6) or for a certain legitimate use (s.7). Analyse three layers separately for any NBFC workflow, and do not collapse them into one "I agree" checkbox.

Consent and notice architecture

Where consent is relied on, keep it unbundled. Different processing has different necessity, legal basis and withdrawal consequences.

Withdrawal consequences

• Where consent is the DPDP basis, withdrawal must be as easy as giving it.
• Withdrawing marketing consent should trigger prompt suppression from campaigns, while regulatory, servicing and collections processing continue on their own basis.
• Withdrawing an optional device permission is not withdrawal of consent for all loan processing; explain whether that permission is necessary to complete KYC/onboarding.
• Withdrawal does not erase statutory retention duties or undo processing lawfully completed before withdrawal.

Can an NBFC delete KYC data when a customer asks?

Who is responsible for personal data handled by an LSP or DSA?

Do not classify every counterparty as a processor. Role follows function: some parties process only on the NBFC's instructions, others determine their own purposes, and some are separately regulated.

Contract controls (permitted purpose, no reuse, India-storage where DLD applies, MFA/logging, sub-processor approval, incident notice, deletion at termination, audit rights) are implementation controls informed by DPDP processor accountability and RBI oversight, not word-for-word DPDP text.

Are large NBFCs automatically Significant Data Fiduciaries?

Section 10 lists the factors the Central Government weighs. It does not say all NBFCs, all large NBFCs, or all entities processing financial data are SDFs. Size and financial-data processing may be relevant to a risk assessment, but neither is an automatic trigger.

Once notified, an SDF must appoint an India-based Data Protection Officer answerable to its board, appoint an independent data auditor, and run periodic Data Protection Impact Assessments and audits (at least once every 12 months under Rule 13). A non-SDF Data Fiduciary does not need a statutory DPO, but must publish the contact of a person able to answer questions about its processing (s.8).

How should an NBFC implement Data Principal rights?

Handle each request as: DPDP requirement, then regulatory limitation, then operational workflow. Keep DPDP personal-data rights distinct from RBI consumer-grievance routes, even if a single portal collects both.

What security safeguards should an NBFC implement for DPDP?

Separate what the law requires from what is good practice. DPDP sets a duty of reasonable security safeguards; the Rules add detail once operative; RBI adds sector controls; and everything else is implementation practice that helps satisfy those duties.

What happens when an NBFC suffers a personal-data breach?

There is no single "RBI breach deadline" for every NBFC. The applicable RBI clock depends on the specific instrument and the class or activity of the NBFC.

Coordinated response chronology

• T+0 — Activate incident commander; preserve evidence; isolate affected systems; classify the incident and its DPDP, RBI, CERT-In, payment and vendor implications. Recommended internal target
• T+1 hour — Obtain preliminary facts from cloud/LSP/DLA/payment/collection vendors; open a regulator-clock tracker; engage legal, security, compliance, operations and communications leads. Recommended internal target
• T+6 hours — Submit the CERT-In report where an Annexure I incident applies; assess whether an RBI six-hour route applies to your category. Regulatory deadline (CERT-In, if covered)
• T+24 hours — Refine the affected-data and affected-person analysis; prepare customer and Board notification drafts; preserve logs and chain of custody. Recommended internal target
• T+72 hours — Provide the detailed DPDP Board report if Rule 7 applies and no extension is granted; submit RBI/CERT-In follow-up material required by the applicable framework. Regulatory deadline (DPDP detailed report)

Does the DPDP Act require NBFC customer data to remain in India?

DPDP penalties and parallel regulatory exposure

The DPDP Schedule sets different maximum penalties for different failures. A flat "250 crore" figure is wrong: that is the maximum for a security-safeguards failure resulting in a breach, decided by the Board (s.33) after a process, not an automatic fine for any lapse.

An incident can create parallel exposure under DPDP enforcement, RBI outsourcing/digital-lending/cyber supervision, CERT-In directions, PMLA/KYC duties, payment-system requirements where applicable, and contractual or consumer claims. Compliance with one regulator does not resolve another's requirements.

NBFC DPDP compliance checklist

An operating checklist in eight phases. Each control is labelled by its source so responsibility is assigned to the right framework, and nothing good-practice is mistaken for statutory text.

1. Governance & accountability

• Assign a privacy owner and board-level reporting line. Implementation
• Assess SDF exposure against the s.10 factors; do not assume designation. DPDP Act
• Publish a contact able to answer processing queries. DPDP s.8
• Appoint an India-based DPO and independent auditor only if notified as an SDF. DPDP s.10

2. Data discovery & mapping

• Inventory processing across the borrower lifecycle. Implementation
• Record the lawful basis per activity (s.4 / s.6 / s.7). DPDP Act
• Map storage and cross-border locations, including backups and support. DPDP s.16 RBI DLD

3. Notice & consent

• Provide a clear notice, separate from the loan agreement and KFS. DPDP Rule 3
• Unbundle consent; keep consent records where consent is the basis. DPDP s.6
• Align app consent and permission flows for digital lending. RBI DLD

4. Rights & grievance

• Build access, correction, erasure and nomination workflows. DPDP Act
• Operate an effective grievance mechanism with escalation. DPDP s.8, s.13
• Route credit-report disputes to the CIC process. CICRA/CIC

5. Retention & erasure

• Maintain a retention schedule by authority (five-year KYC/PMLA baseline). RBI KYC/PMLA
• Apply the s.8(7) legal-retention override to erasure requests. DPDP s.8(7)
• Delete or de-identify non-required data when the purpose ends. DPDP Act

6. Vendors & processors

• Run a DPDP role assessment for each counterparty. DPDP Act
• Put processor contracts in place (purpose, security, sub-processors, deletion, audit). DPDP s.8 RBI outsourcing
• Enforce LSP minimal storage and India storage where DLD applies. RBI DLD

7. Security

• Implement reasonable security safeguards. DPDP s.8(5)
• Apply Rule 6 prescribed controls once operative. DPDP Rule 6
• Meet RBI IT/cyber standards; retain logs and keep six-hour readiness. RBI CERT-In

8. Evidence & breach readiness

• Maintain a multi-regulator breach runbook with a separate clock per regulator. DPDP Rule 7 CERT-In RBI
• Run periodic DPIA and audit if notified as an SDF. DPDP Rule 13
• Keep records and evidence of compliance. Implementation

NBFC DPDP compliance: frequently asked questions

About this guide

This guide is written for compliance, legal, risk, technology and product teams at NBFCs preparing for the DPDP Act alongside their existing RBI, PMLA/KYC and CERT-In obligations. The editorial approach is to label every requirement by source, separate statutory duties from good practice, and name the specific regulator behind each obligation rather than blending them.

Methodology

Last updated: 31 August 2026. Primary authorities reviewed: DPDP Act, 2023; DPDP Rules, 2025; RBI directions (KYC, digital lending, outsourcing, payment-system data); PMLA and PML (Maintenance of Records) Rules; and CERT-In Directions. Each material statement is classified as a DPDP Act requirement, a DPDP Rules requirement, another regulator's requirement (RBI, PMLA/KYC or CERT-In), or an implementation recommendation.

Sources & primary authorities

• DPDP Act, 2023 — sections referenced on this site: DPDP Act (s.8, s.10, s.16, s.38). Official text: MeitY.
• DPDP Rules, 2025 — DPDP Rules overview: notice, security (Rule 6), breach (Rule 7), SDF DPIA/audit (Rule 13).
• RBI — Master Direction on Know Your Customer; Digital Lending Directions; outsourcing directions; payment-system data requirements; Account Aggregator framework. Official: rbi.org.in.
• PMLA / KYC recordkeeping — Prevention of Money Laundering Act and PML (Maintenance of Records) Rules; five-year retention baselines reflected in the RBI KYC Directions.
• CERT-In — Directions dated 28 April 2022: six-hour incident reporting and log retention. Official: cert-in.org.in.
• Credit information — Credit Information Companies (Regulation) Act and the RBI CIC framework, for credit-report accuracy and disputes.

Validation required before publication

Confirm the following against current official texts before this page is published or relied upon:

• The exact DPDP commencement instrument (Gazette G.S.R. 843(E)) and Rule 1(2) phasing.
• PMLA and PML (Maintenance of Records) Rules retention wording, and any five- versus ten-year nuances by record type.
• RBI six-hour or immediate reporting applicability by NBFC category and instrument.
• RBI Digital Lending Directions current text on permissions, India storage and LSP controls.
• RBI Account Aggregator and payment-system data scope for the specific entity.
• Any RBI, MeitY or CERT-In change after 31 August 2026.