What DPDP documents does an NBFC need in India? An NBFC needs a DPDP-compliant privacy policy covering loan-applicant and borrower data, a KYC-data handling procedure aligned to both RBI KYC Master Directions and DPDP consent/purpose-limitation principles, a credit bureau data-sharing notice disclosing what is reported to CICs, outsourcing-vendor DPA clauses for any collections, verification or IT vendor handling borrower data, and a Grievance Officer appointment kit. This pack generates all five as one coordinated set.
A complete DPDP Act 2023 documentation pack for NBFCs — privacy policy, KYC-data handling, credit bureau notice, outsourcing clauses and grievance officer kit.
Where the two frameworks intersect: RBI's KYC Master Directions require NBFCs to collect and retain identity documents (PAN, Aadhaar, address proof) for the loan lifecycle and a defined retention period after closure. The DPDP Act's purpose-limitation principle does not override this — regulatory retention mandates are a recognised basis for continued processing — but it does require that KYC data collected for identity verification is not silently repurposed for, say, marketing or cross-sell without fresh, specific consent.
What the gap review covers: Whether your KYC intake flow captures purpose-specific consent separate from the account-opening 'terms and conditions' checkbox, whether Aadhaar data handling follows the additional restrictions under the Aadhaar Act (masked/redacted storage), and whether your retention schedule for KYC documents post-loan-closure is documented with a deletion trigger — not held indefinitely by default.
What must be disclosed: Every NBFC that reports borrower data to Credit Information Companies (CIBIL, Experian, Equifax, CRIF High Mark) must disclose this sharing to the borrower — as a DPDP-relevant processing purpose, not merely a CIC Regulation Act formality. The notice should specify what fields are reported (payment history, outstanding balance, DPD status), how frequently, and that inaccurate reporting can be disputed via the bureau's correction process.
What the unlocked notice includes: Ready-to-use disclosure language for your loan agreement and privacy policy, a borrower-facing explainer of the CIC dispute/correction process (which doubles as your DPDP correction-rights pathway for bureau-reported data), and guidance on aligning bureau-reporting consent language with your DPDP consent architecture.
Documents selected for your pack:
NBFCs are already among the most heavily regulated entities in India under RBI's Master Directions, Fair Practices Code and KYC norms. It is a common — and incorrect — assumption among NBFC compliance teams that satisfying RBI obligations automatically satisfies DPDP obligations. RBI's rules govern prudential conduct and specific disclosure formats; the DPDP Act separately governs consent validity, purpose limitation, breach notification to the Data Protection Board, and borrower (Data Principal) rights such as correction and erasure — none of which RBI's framework directly addresses.
With DPDP Act enforcement expected around May 2027, NBFCs that have only ever built for RBI compliance will find gaps in consent architecture, bureau-sharing disclosures and vendor DPAs. Niti Bharat runs fixed-price DPDP compliance engagements (₹75,000–₹3.2 lakh) for NBFCs that need this second compliance layer built without disrupting existing RBI-facing processes — contact hello@nitibharat.com.
Third-party collections and recovery agencies are frequently the weakest link in an NBFC's DPDP posture — borrower phone numbers, addresses and outstanding-balance data are shared with agencies that operate with minimal contractual data-handling restriction. Under the DPDP Act, the NBFC as Data Fiduciary remains accountable for how that data is subsequently handled by its collections vendor. A collections-agency data breach or an aggressive recovery practice involving unauthorised data use (e.g. contacting a borrower's employer or family without disclosed basis) exposes the NBFC directly, not just the vendor.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
