Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsLoan apps and Lending Service Providers operate under the RBI Digital Lending Directions 2025, where the regulated lender, not the app, stays liable.
In short
The RBI (Digital Lending) Directions, 2025 govern loan apps and LSPs, with the DPDP Act layered on. The regulated lender stays fully liable for the app data conduct. Under the RBI Digital Lending Directions, 2025, data collection must be need-based, taken with the borrower’s prior consent and an audit trail, and apps are barred from accessing contacts, media or call logs. Those are RBI requirements; the DPDP basis for each lending purpose (Section 6 consent, or a Section 7 legitimate use) must be assessed separately. DPDP penalties can reach ₹250 crore, on top of RBI action.
What changes for this niche, and the specific rule it turns on.
Under the RBI Directions, an outsourcing contract cannot dilute the regulated lender responsibility for the app acts and omissions.
Apps must not access files, media, contacts, call logs or telephony; camera, mic and location are one-time, onboarding or KYC only, with the borrower’s explicit consent (an RBI Digital Lending requirement, distinct from the DPDP basis).
Borrowers must be able to give, refuse, restrict, revoke and erase; the purpose of consent must be shown at each step of the interface.
The RBI Directions require India-only storage; any overseas processing must be deleted abroad and brought back within 24 hours, stricter than the DPDP default.
An LSP may store only basic operational data such as name, address and contact; no raw exports or unapproved sub-processors.
Short, cite-able answers, mirrored in FAQPage schema.
Kill device-permission access and fix staged consent first.
The readiness check flags device-permission, consent, storage and LSP-liability gaps.
Take the readiness check →Consultant-led and partner-backed.