Archive · 14 Jan 2026
India's Data Protection Law Challenges Digital Lenders
India has a new law called the DPDP Act that says apps must make it easy for users to withdraw their consent to share personal data.
Digital lenders, who give out loans, use a lot of personal data to decide who gets a loan and to keep an eye on borrowers.
Now, they are asking for special permission to keep using this data even if a borrower says they don't want to share it anymore.
The lenders say they need this data to manage risk and make sure borrowers pay back their loans.
But some lawyers say the lenders already have other legal reasons to use this data and don't need special permission.
The lenders also use this data to send marketing messages and make better loan offers.
The law says users must be able to withdraw consent easily, but the lenders want to treat some data use as mandatory.
There are also rules about how lenders can access data from borrowers' phones and bank accounts.
Some lenders are trying to find new ways to monitor borrowers' bank balances without breaking the rules.
India's DPDP Act requires apps to allow users to withdraw consent to share personal data easily.
Digital lenders are seeking exemptions to continue accessing borrower data for the entire loan duration, even if consent is withdrawn.
The industry argues that continuous data access is necessary for managing credit risk and early-warning systems.
Lawyers caution that lenders already have legal grounds to process borrower data for core loan functions and that consent is required for other uses like early-warning analytics.
The conflict highlights the tension between data privacy rights and the operational needs of regulated financial services.
- Who
- Digital lenders and the Fintech Association for Consumer Empowerment (FACE) in India
- What
- Conflict between India's new data protection law and digital lenders' monitoring models
- When
- As the DPDP Act nears full implementation
- Where
- India
- Why
- Digital lenders seek exemptions to continue accessing borrower data for the entire loan duration, even if consent is withdrawn
- Act
- Digital Personal Data Protection (DPDP) Act
- Industry Body
- Fintech Association for Consumer Empowerment (FACE)
- Regulatory Bodies
- Reserve Bank of India (RBI), Ministry of Electronics and Information Technology (MeitY)
- Key Clause
- Section 17 of the DPDP Act
- Data Access
- Bank transaction alerts, statement data, device-intelligence signals
- Account Aggregators
- RBI-regulated system for consent-based financial data sharing
- Consent Requirements
- Free, specific, informed, unconditional, unambiguous, and withdrawable