DPDP for Fintechs and NBFCs: Where the Obligations Stack
Fintechs already carry sector obligations. DPDP does not replace them, it sits alongside, and the seams between the regimes are where most gaps appear.
Three regimes, one data set
A lending fintech processing KYC and repayment data is simultaneously subject to DPDP, to RBI's IT and cyber security expectations for its entity class, and to the CERT-In directions for cyber incidents. The data is the same; the obligations differ.
Where fintechs are usually exposed
- Retention. Rejected loan applications, abandoned onboarding journeys and expired leads are held indefinitely with no legal basis for retention.
- Purpose creep. KYC data collected for onboarding used later for cross-sell modelling. Section 6(1) limits consent to what is necessary for the specified purpose.
- Processor sprawl. Credit bureaus, KYC vendors, collections agencies and communication providers all process on your behalf. Rule 6(1)(f) requires the safeguards clause in each contract.
- Access breadth. Collections and support teams frequently have far wider read access than Rule 6(1)(b) would justify.
Breach reporting is the sharpest overlap
A single incident can require intimation to affected Data Principals without delay under Rule 7(1), an initial and then a detailed report to the Data Protection Board under Rule 7(2), a CERT-In report under its directions, and a report to your sector regulator. Four obligations, different formats, different clocks.
Build one declaration event that fans out, rather than four procedures owned by different teams.
Fintechs rarely fail on the concepts. They fail because the same customer record exists in nine systems and nobody can say which of them a deletion request has to reach.
Infosek Team
Where to start
- Map personal data across the lending or payment lifecycle, including the systems it is copied into.
- Set a retention period per data set and name the law that justifies it where you keep it longer.
- Get the Rule 6(1)(f) clause into every processor contract, starting with KYC and collections.
- Merge your DPDP, CERT-In and sector breach procedures into one runbook with a single trigger.
Common questions
Does DPDP apply to NBFCs already regulated by RBI?
Yes. DPDP applies to the processing of digital personal data regardless of sector regulation. RBI obligations under the IT Framework and cyber security directions continue to apply separately, so a regulated entity carries both.
What is the biggest DPDP gap for fintechs?
Usually retention. Lending and KYC data accumulates against regulatory retention requirements, while Rule 8 requires erasure once the specified purpose is no longer served. Reconciling the two deliberately, and recording the reasoning, is the work.
Stacking DPDP onto RBI obligations?
Infosek handles the whole of DPDP: data mapping, consent and notices, security controls, vendor contracts, breach readiness and the audit itself. We do the work, not just the gap report.
Book Free 30-Min Assessment
