What should a loan app privacy policy in India cover under DPDP? A digital lending app's privacy policy must comply with both the RBI Digital Lending Guidelines 2022 and the DPDP Act 2023. It must disclose exactly which data categories are collected (no blanket access to contacts, gallery, call logs or SMS beyond what is need-based and disclosed), name every Lending Service Provider (LSP) and Digital Lending App (DLA) in the data-sharing chain, explain consent capture and withdrawal, and set out recovery-agent data-handling limits. This kit generates the policy, consent screens, and LSP/DLA data-sharing schedule together.
Generate a privacy policy, in-app consent screens and LSP/DLA data-sharing clauses built for India's digital lending rules and the DPDP Act 2023.
The need-based test: The RBI Digital Lending Guidelines 2022 prohibit access to a borrower's contact list, call logs, SMS logs, photo gallery, or file storage unless the data point is strictly necessary for a specific, disclosed lending purpose (e.g. document upload for KYC, not blanket gallery access). Each requested permission must be justified individually in the consent screen — a single bundled 'Allow all permissions to continue' pattern is a Guidelines violation and, where the data collected is personal data, also fails the DPDP Act's purpose-limitation and data-minimisation principles.
What this means in practice: Camera access for a live selfie during KYC is defensible; contact list access to build a 'recovery graph' is not. This kit reviews the permissions you selected above against the need-based test and flags each one that requires either removal or a specific, granular consent prompt — this becomes Section 1 of your generated privacy policy.
DPDP consent requirements (Section 6) layered onto RBI form requirements: Consent for a lending app must be free, specific, informed, unconditional, unambiguous, and withdrawable. In practice for a loan app this means: a separate toggle per data category (not one master checkbox), plain-language purpose text next to each toggle, a visible 'Withdraw Consent' path inside app settings, and a record of consent (timestamp, version, IP/device) retained for audit.
What the unlocked kit includes: Ready-to-implement consent-screen copy for each permission category you selected, a withdrawal-flow specification, and a consent-record schema your engineering team can implement directly — mapped line-by-line to both the RBI Guidelines and DPDP Section 6.
Documents selected for generation:
Digital lending apps sit at the intersection of two enforcement regimes: the RBI's Digital Lending Guidelines 2022, which restrict device-data access and mandate borrower-facing disclosures, and the DPDP Act 2023, which governs how any personal data collected is processed, stored and shared. A lending app that satisfies RBI's permission restrictions but has no DPDP-compliant consent architecture is still exposed to DPB penalties of up to ₹250 crore for security-safeguard failures — and vice versa.
With DPDP Act full enforcement expected around May 2027, and RBI already actively delisting non-compliant lending apps from app stores, the window to fix permission over-reach and consent gaps is now. Niti Bharat builds fixed-price DPDP compliance programmes (₹75,000–₹3.2 lakh) for lending platforms that need both regulatory tracks covered — contact hello@nitibharat.com.
The single most frequent gap NitiBharat finds when reviewing lending-app privacy policies is a blanket permissions clause — 'we may collect contacts, location, SMS and gallery data to assess your creditworthiness' — with no purpose-specific breakdown. RBI's Guidelines and the DPDP Act both require the opposite: each data category tied to one disclosed purpose, one specific consent toggle, and one retention period. Bundled consent of this kind is now a leading cause of app-store delisting complaints and Data Principal grievances filed against lending platforms.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
