DPDP Act 2023 and your loan app: 5 data rights you can use today

On August 11, 2023, the fundamental power dynamic between Indian borrowers and digital lenders changed permanently. That was the day the Digital Personal Data Protection Act 2023 (DPDP Act) received Presidential assent, marking a historic shift in how consumer information is legally treated in the country. Before this date, digital lending platforms and predatory loan applications operated in a vast regulatory grey area. Their business models often relied on aggressive data harvesting—vacuuming up your contacts, reading your SMS inbox, tracking your location, and storing your device metadata under the guise of "credit underwriting."

The passage of this legislation, which is being implemented in phases through 2024–25, effectively outlaws the "data harvesting as a business model" approach. It replaces the old framework with one where you, the borrower, have absolute, legally enforceable control over your digital footprint. The dpdp act loan app guidelines are not merely suggestions; they are stringent legal requirements backed by massive financial penalties.

Most Indian borrowers do not know these rights exist. Loan apps certainly are not advertising them, preferring to keep users in the dark so they can continue operating business as usual. But the days of lenders making you completely pareshan (harassed) using your own stolen data are numbered.

This guide is a comprehensive, section-by-section legal explainer of the DPDP Act 2023 as it applies specifically to loan apps. We will break down exactly what the law says, how lenders violate it, the penalties they face, and the precise steps you can take to reclaim your data privacy.

The New Vocabulary: Who Are You Under the Law?

Before diving into the specific sections, you must understand the legal terminology the DPDP Act uses to classify the players in the digital lending space.

• Data Principal: This is you. Under the law, the individual to whom the personal data relates is the Data Principal. You are the ultimate owner of your data.
• Data Fiduciary: This is the loan app, the Non-Banking Financial Company (NBFC), or the bank. They are entities that determine the purpose and means of processing your personal data. They hold your data in a "fiduciary" capacity, meaning they owe you a duty of trust and legal compliance.
• Personal Data: Any data about an individual who is identifiable by or in relation to such data. This includes your PAN, Aadhaar, selfies, contact list, SMS logs, device IP address, and banking history.

Section-by-Section Breakdown of the DPDP Act for Borrowers

The DPDP Act establishes strict rules of engagement. Here is how the core sections apply to your interactions with digital lenders.

Breakdown: The Rules of Consent (Section 6)

Plain-language meaning: Section 6 of the DPDP Act dictates that a Data Fiduciary can only process your personal data if you have given clear, specific, informed, unconditional, and unambiguous consent via a clear affirmative action. The request for consent must be accompanied or preceded by a notice explaining exactly what data is being collected and the specific purpose for its processing. Crucially, consent cannot be bundled; you must be able to say "yes" to data needed for the loan, and "no" to data that is not necessary, without being denied the service.

Loan-app example of violation: A user downloads a quick-cash app. Upon opening the app, a single screen appears with a pre-ticked checkbox that says, "I agree to the Terms and Conditions and Privacy Policy." By clicking "Next," the app automatically gains access to the phone's camera, gallery, microphone, and contact list. If the user tries to uncheck the box or deny the contact list permission in their phone settings, the app blocks them from applying for the loan, claiming "contact access is required for risk assessment." This forced, conditional consent via pre-ticked boxes is a direct violation of Section 6.

What the borrower can do: You have the immediate right to withdraw your consent at any time. If an app forced you into a blanket agreement, you can formally revoke it.

Send an email to the lender’s Grievance Officer stating: "Under Section 6 of the DPDP Act 2023, I hereby withdraw my consent for [Lender Name] to access, store, or process my contact list data, location data, and gallery access. This withdrawal of consent is effective immediately. Please confirm that this data will no longer be accessed or used for any purpose."

If you need help wording this legally, you can use the HeyZ AI chat tool available at /heyz to generate a customized consent-withdrawal notice.

Breakdown: Purpose Limitation and Data Minimization (Section 8)

Plain-language meaning: Section 8 establishes the obligations of Data Fiduciaries. It states that a company must only collect the absolute minimum amount of data necessary to fulfill the specific purpose for which consent was granted. Furthermore, they can only use the data for that exact purpose and nothing else. Once the purpose is fulfilled, the data must be deleted.

Loan-app example of violation: Consider a representative borrower scenario: A user takes a personal loan and grants the app access to their contact list under the premise of "verifying identity" or "fraud prevention." Two months later, the borrower misses an EMI payment. The loan app’s recovery agents extract the borrower's contact list and begin calling the borrower's employer, parents, and distant relatives to publicly shame them into paying.

This makes loan app contact scraping illegal under the DPDP Act. The stated purpose of collecting the data was "fraud prevention" or "underwriting," not "third-party harassment for debt recovery." Using data for a completely different, unconsented purpose is a severe breach of Section 8.

What the borrower can do: If a lender uses your data for unauthorized purposes like harassment, document the evidence immediately. Record the calls, save the WhatsApp messages sent to your contacts, and take screenshots. You can run the specific threats through the Harassment Checker at /harassment to categorize the exact RBI and DPDP violations. Then, file a formal grievance with the lender citing a breach of Purpose Limitation under Section 8, demanding an immediate halt to all third-party contact and erasure of the scraped data.

Breakdown: Data Principal Rights (Sections 11–14)

The DPDP Act codifies four fundamental dpdp 2023 borrower rights. These sections give you the power to interrogate the lender about what they know about you.

Right to Access (Section 11)

Plain-language meaning: You have the right to ask any loan app to confirm whether they are processing your personal data, to provide a summary of the personal data they hold, and to disclose the identities of all other Data Fiduciaries (like third-party recovery agencies or data brokers) with whom they have shared your data.

Loan-app example of violation: You email a loan app asking what data they have on you, and they reply with a generic automated message stating, "We only collect data as per our privacy policy," refusing to provide the actual summary of your specific file or the names of the recovery agencies they sold your file to.

What the borrower can do: Send a legally binding Right to Access request. "Under Section 11 of the Digital Personal Data Protection Act 2023, I request a comprehensive summary of all personal data [Lender Name] holds regarding my account [PAN/Phone Number]. I also request the names and contact details of all third-party entities, including recovery agencies, with whom my data has been shared. Please provide this within the legally mandated timeframe."

Right to Correction and Erasure (Section 12)

Plain-language meaning: You can demand that a lender correct inaccurate data, complete incomplete data, or update outdated data. More importantly, you have the "Right to be Forgotten." You can demand the erasure of your personal data when it is no longer necessary for the purpose it was collected.

Loan-app example of violation: You fully repay your loan and receive a No Objection Certificate (NOC). You delete the app. Six months later, you start receiving promotional SMS messages from random loan apps, indicating the original lender sold your data. Or worse, the original lender retains your contact list indefinitely despite the loan being closed.

What the borrower can do: Once your loan is closed, immediately exercise your right to erasure. "Under Section 12 of the DPDP Act 2023, I hereby request the complete erasure of all personal data held about me by [Lender Name] related to closed loan account [NUMBER]. The purpose for data collection has been fulfilled. Please confirm the deletion of all non-statutory data, including contact lists and device metadata, within 30 days." (Note: Lenders are required by RBI to retain core financial ledger data for a set period, but they are NOT required to retain your device metadata, contact lists, or app permissions).

Right to Grievance Redressal (Section 13)

Plain-language meaning: Every loan app must provide a readily available mechanism for you to register grievances regarding their data practices. They are legally obligated to respond to and resolve these grievances within a prescribed timeframe before you escalate the matter to the government.

Loan-app example of violation: An illegal loan app lists a fake email address for their Grievance Officer, or the emails bounce back. Alternatively, a registered NBFC app simply ignores your data deletion requests for months, offering no ticket number or resolution timeline.

What the borrower can do: Document the ignored communication. The failure of a Data Fiduciary to provide functional grievance redressal is itself a distinct finable offense under the DPDP Act, separate from the original data breach. Keep a log of all sent emails and bounced messages; this will be your primary evidence when escalating to the Data Protection Board.

Right to Nominate (Section 14)

Plain-language meaning: In the event of your death or incapacity, you have the right to nominate another individual to exercise your data rights on your behalf.

Loan-app example of violation: A borrower passes away. The loan app continues to harass the deceased's family members using data scraped from the deceased's phone. When the family asks the app to delete the data, the app refuses, claiming the family members are not the "account holders."

What the borrower can do: While setting up a loan profile, utilize any nomination facilities provided to designate a trusted family member. If a lender refuses a legitimate data erasure request from a legal heir or nominee, the nominee can file a complaint with the Data Protection Board.

Breakdown: Significant Data Fiduciary Obligations (Section 10)

Plain-language meaning: The central government has the power to classify certain large companies as "Significant Data Fiduciaries" (SDFs) based on the volume and sensitivity of the data they process, or the risk of harm to consumers. Large, well-known digital lending platforms and major NBFCs will likely fall into this category.

SDFs have extra legal burdens. They must appoint a Data Protection Officer (DPO) who is based in India and reports directly to the Board of Directors. They must also appoint an independent Data Auditor to evaluate their compliance and conduct periodic Data Protection Impact Assessments.

Loan-app example of violation: A massive digital lending app processing millions of loans fails to appoint an India-based DPO, or appoints a low-level customer support agent to the role rather than a qualified executive. They fail to conduct audits on how their third-party collection agencies handle borrower data, leading to a massive data leak.

What the borrower can do: When dealing with large lending apps, you shouldn't just email generic support. Look up their legally mandated Data Protection Officer (whose details must be published on their website) and direct all DPDP Act requests directly to them. If a major app cannot produce the contact details of their India-based DPO, they are in severe violation of Section 10, which carries some of the heaviest penalties under the Act. To check if the lender is a registered entity that should be abiding by these rules, you can search for them on the RBI's lists or check our guide on verified apps at /apps.

The Financial Consequences: DPDP Penalty Schedule

The DPDP Act does not rely on minor fines or wrist-slaps. It was designed to hurt companies financially if they abuse consumer data. The Data Protection Board of India has the authority to levy massive financial penalties. There is no provision for criminal imprisonment under this specific act, but the civil penalties are severe enough to bankrupt non-compliant loan apps.

Here is the penalty schedule mapping the DPDP section to the loan-app obligation and the maximum fine.

Step-by-Step Complaint Route to the Data Protection Board

If a loan app violates your data privacy in India, you cannot simply tweet at the police and expect an immediate resolution. The DPDP Act requires a specific legal escalation matrix. The Data Protection Board of India (DPBI) is the official adjudicating body established under the Act.

Here is the exact step-by-step complaint route you must follow to ensure your grievance is legally valid and actionable.

Step 1: The First Notice to the Fiduciary

The law requires you to attempt to resolve the issue with the loan app first. You cannot bypass the company and go straight to the Board.

• Locate the email address for the app's Privacy Officer or Grievance Officer (usually found at the bottom of their website or in their Privacy Policy).
• Send a formal email clearly stating which section of the DPDP Act they have violated (e.g., Section 8 for unauthorized purpose/contact scraping, Section 12 for failing to erase data).
• State your demand clearly (e.g., "I demand the immediate erasure of my contact list metadata").
• Give them a deadline to respond (typically 7 to 30 days, as will be prescribed by the final procedural rules).

Step 2: Documenting the Failure

If the loan app ignores your email, replies with a generic rejection, or fails to take the requested action within the timeframe, document everything. Save the email thread as a PDF. If they are actively harassing your contacts, take screenshots of those WhatsApp messages and record the call logs. This establishes that you exhausted the Tier-1 grievance mechanism.

Step 3: Filing with the Data Protection Board of India

Once the DPBI's digital portal is fully operational for public complaints (phased rollout 2024–25), you will take your documented evidence and file a formal complaint.

• Access the official DPBI portal.
• Upload your initial notice to the lender and proof of their failure to resolve it.
• Upload evidence of the data breach or privacy violation.
• Submit the complaint. The Board functions digitally, meaning you will not have to travel to a physical court to file this.

Step 4: Adjudication and Directions

The DPBI will review the complaint. If they find sufficient grounds, they will initiate an inquiry into the loan app. The Board has the power of a civil court to summon documents, inspect the app's servers, and demand explanations from the company's directors.

• If the app is found guilty, the Board will issue binding directions to the app (e.g., "Delete this borrower's data immediately and cease all third-party contact").
• The Board will also levy financial penalties against the app based on the schedule outlined above.

Taking Back Control of Your Financial Data

The era of digital lenders operating like unregulated data brokers is coming to an end. But laws only work if citizens enforce them. If you suspect your loan app is overcharging you or hiding behind predatory terms to force data consent, first check if their interest rates are even legal using the Sahi Rate calculator at /sahi-rate. If you are applying for a new loan, always check your actual credit standing at /cibil before letting a random app scrape your phone under the guise of "checking your eligibility."

Your data is your property. The DPDP Act gives you the legal weaponry to protect it. Do not let pre-ticked boxes and aggressive recovery agents convince you otherwise. Exercise your rights today.

Frequently Asked Questions

Does the DPDP Act apply to unregistered or fake loan apps?

Yes, the law applies to any entity processing digital personal data within India, regardless of whether they are registered with the RBI as an NBFC. However, enforcing the law against illegal, fly-by-night apps hosted on foreign servers is practically difficult for the Data Protection Board. For fake apps, your best immediate action is to uninstall the app, revoke all device permissions, and file a cybercrime complaint, rather than waiting for a DPDP grievance resolution.

Can a loan app deny me a loan if I refuse to give them access to my contacts?

Under Section 6 (Consent) of the DPDP Act, consent must be free and conditional only upon data that is strictly necessary for the service. Accessing your entire phonebook is not technically necessary to disburse a loan. If an app forces you to provide contact access to proceed, they are violating the principle of free consent. You can file a grievance regarding forced bundled consent.

How long can a loan app legally keep my data after I close the loan?

They can only keep it as long as is necessary to fulfill the original purpose or to comply with other laws. The RBI requires lenders to maintain core financial transaction records (ledgers, KYC documents) for audit and anti-money laundering purposes for several years. However, this retention mandate does NOT apply to auxiliary data like your scraped contact list, device location history, or photo gallery. You can demand the immediate erasure of this non-financial metadata the moment your loan is closed.

What should I do if a recovery agent is already calling my relatives?

If a recovery agent is contacting people in your phonebook, it means the lender has violated Section 8 (Purpose Limitation) by using your data for unauthorized third-party harassment. Tell the agent clearly that their actions violate the DPDP Act 2023 and RBI Fair Practices Code. Immediately send a written grievance to the lender's Nodal Officer demanding they cease all unauthorized data processing, and prepare to escalate the complaint to both the RBI Ombudsman and the Data Protection Board.

Need help drafting a legal notice to your loan app? Use our free HeyZ AI assistant at /heyz to generate a customized DPDP Act data access or erasure request in seconds.

Related on SahiSujhav:

• Cancel a loan inside the 3-day cooling-off
• Recovery call before 8am is illegal
• How to check if a loan app is RBI registered