Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsBuy-now-pay-later blends lending and payments, often with younger users, under the RBI Digital Lending Directions and PPI rules.
In short
BNPL is digital lending: the RBI (Digital Lending) Directions, 2025 apply, and where a PPI is involved so do the PPI rules. Consent must be granular and the lender stays liable for the app. With younger user bases, watch the under-18 line. Penalties reach ₹250 crore.
What changes for this niche, and the specific rule it turns on.
BNPL is treated as digital lending; the RBI Directions and lender liability apply just as for loan apps.
Underwriting consent is not marketing consent; keep purposes separate and revocable.
BNPL skews young; anyone under 18 is a child, triggering verifiable parental consent and the tracking and ad ban.
The RBI ban on contacts, media and call logs applies to BNPL apps too.
Short, cite-able answers, mirrored in FAQPage schema.
Fix consent-splitting and the age line first.
The readiness check flags consent, device-data and age-assurance gaps.
Take the readiness check →Consultant-led and partner-backed.