Fintechs, NBFCs and lending apps must comply with the DPDP Act by 13 May 2027 on top of RBI rules. KYC kept under anti-money-laundering law is a legal obligation (no consent needed), but marketing, cross-selling and app permissions need clear consent. Breaches must be reported to the Data Protection Board within 72 hours, alongside CERT-In (6 hours) and RBI reporting. Large lenders and payment firms are likely Significant Data Fiduciary candidates.
- Deadline
- 13 May 2027
- KYC retention
- Legal obligation (PMLA)
- Payment data
- Stored only in India (RBI)
- Breach reporting
- Board 72 h · CERT-In 6 h
Where fintech, nbfcs and lending apps face the most DPDP risk
| Area | What to do |
|---|---|
| App permissions (contacts, photos, location) | Collect only what the loan needs, with consent; RBI digital lending rules already restrict this |
| Credit bureau pulls | Specific consent and purpose; keep consent logs |
| Recovery agents and partners | Processor contracts; no misuse of borrowers' contacts |
| Cross-selling insurance and cards | Separate opt-in for each product |
| Account aggregator data | Use within the consented purpose and duration |
Other rules that apply alongside the DPDP Act
- RBI digital lending rules (data minimisation, consent, storage in India)
- RBI directive on storage of payment system data (2018): only in India
- PMLA and RBI KYC directions on record retention
- CERT-In Directions, 2022: 6-hour incident reporting and 180-day log retention
Where another law sets a stricter or longer requirement, follow both: the DPDP Act does not override sector rules on retention or storage.
Six steps to comply
- Map data across onboarding, KYC, underwriting, collections and partners.
- Align DPDP notices with RBI-mandated disclosures in the app.
- Separate legal-obligation data (KYC) from consent-based data (marketing).
- Merge DPDP, CERT-In and RBI incident reporting into one breach runbook.
- Review lending partners, collection agencies and LSPs as processors.
- Prepare for Significant Data Fiduciary duties if you are large.
Most DPDPA duties apply from 13 May 2027, with penalties up to ₹250 crore per breach. See the DPDPA 2027 roadmap and the DPDP compliance checklist.
Want it done for you? Our DPDP compliance service covers data mapping, notices, consent, vendor contracts, breach plans and staff training for fintechs, NBFCs, lending apps and payment companies.
Frequently asked questions
Does the DPDP Act apply to NBFCs regulated by RBI?
Yes. RBI regulation does not exempt NBFCs; the DPDP Act applies alongside RBI rules, and where another law requires something stricter (such as data storage in India), that law also applies.
Do fintechs need consent for KYC under DPDP?
Not where KYC is required by law: compliance with a legal obligation is a legitimate use under Section 7. Using KYC data for marketing or cross-selling needs consent.
DPDP guides for other industries
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- DPDP compliance cost in India
- DPDP compliance for hospitals and healthcare
- DPDP compliance for edtech, schools and coaching
- DPDP compliance for e-commerce and d2c brands
- DPDP compliance for hr, staffing and recruitment firms
- DPDP compliance for real estate developers and brokers
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.