Sector guide · Fintech and NBFC
DPDP Act for fintechs and NBFCs
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
A fintech is a Data Fiduciary for every borrower, user and applicant, and the Act sits on top of RBI requirements rather than replacing them. The obligations that bite first are consent for each purpose, processor contracts with every partner in the lending chain, security safeguards under Rule 6, and the seventy-two hour breach report.
From the Gevox Readiness Index: Sixteen of twenty advisor websites run forms through a third party and say nothing about it.
The Act and the RBI, together
Section 38 makes the Act additional to other laws and gives it primacy only where a conflict cannot be reconciled. RBI’s digital lending guidelines, KYC master directions and payment data localisation continue to apply. Section 16(2) expressly preserves a stricter rule in another law, so the localisation requirement survives even though the Act itself takes a blacklist approach to transfers.
Where fintechs fail the consent standard
Lending apps collect contacts, SMS, location and device data. Section 6 requires consent that is specific to a purpose and limited to the data necessary for it, and Section 6(1) prohibits making the service conditional on consent the service does not need. Consent to read SMS for a loan that does not require it is not free or unconditional.
Bundled consent at onboarding, one checkbox for KYC, marketing, credit bureau sharing and partner offers, fails the specificity test. Each purpose needs its own consent, and withdrawal must be as easy as giving it under Section 6(4).
The lending chain is a chain of processors
The lending service provider, the KYC vendor, the credit bureau pull, the collections agency, the cloud host and the analytics tool are each processing on the fintech’s behalf or as a fiduciary in their own right. Section 8(2) requires a valid contract for each processor, Section 8(1) keeps the fintech responsible for what they do, and Rule 6(1)(f) requires the contract to bind the processor to the security safeguards.
Breach: two clocks, no harm threshold
Section 8(6) and Rule 7 require intimation to affected users and to the Board without delay, and a detailed report to the Board within seventy-two hours. The definition in Section 2 covers a lost device, a misdirected statement and an insider looking at records, not only an intrusion. The Schedule assigns the Rs 200 crore band to failures here.
First five actions
- Map every purpose you process data for and give each its own consent line.
- Inventory the partner chain and confirm a Section 8(2) contract exists for each link.
- Run the Rule 6 checklist: encryption, access control, one-year logs, backups, processor terms.
- Write the Rule 7 breach procedure with names and the seventy-two hour clock.
- Publish the Section 8(9) contact inside the app and on the website.
Questions people ask
- We are RBI-regulated. Does the DPDP Act add anything?
- Yes. RBI rules govern conduct and prudence; the Act governs personal data across every purpose, with its own consent standard, breach clocks and penalties. Both apply.
- Can we share borrower data with a collections agency?
- Only on a ground under Section 4: consent for that purpose, or a legitimate use under Section 7. The agency is a Data Processor and needs a Section 8(2) contract.
- Does data localisation still apply?
- RBI’s payment data localisation continues under Section 16(2). The Act itself restricts transfers only to countries the Government notifies.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.