Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 21 JANUARY 2026

DPDP Act Compliance For Physical And Digital Lending NBFCs

King, Stubb & Kasiva
King, Stubb & Kasiva
Contributor
King, Stubb & Kasiva

King, Stubb & Kasiva

King Stubb & Kasiva is few of the top corporate law firms in India with offices in Bengaluru,...

View firm profile
Explore more from King, Stubb & Kasiva

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 together create a horizontal compliance regime that materially alters how NBFCs may collect, use, share, retain, secure, and monetise personal data across the NBFC value chain.

IndiaPrivacy
Aurelia Menezes
Aurelia Menezes
Author LinkedIn connections

Introduction

The Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") together create a horizontal compliance regime that materially alters how NBFCs may collect, use, share, retain, secure, and monetise personal data across the NBFC value chain, ranging from sourcing and onboarding to underwriting, disbursal, servicing, collections, litigation, securitisation, and outsourcing.

For NBFCs, the DPDP regime does not operate in isolation; it overlays and intersects with RBI expectations around customer confidentiality, agent conduct, outsourcing governance, and IT/cyber risk and, practically, becomes a Board-level prudential and reputational risk. RBI's NBFC directions expressly require agents to observe strict customer confidentiality and prohibit privacy-intrusive collection conduct (including intrusion into the privacy of family/referees).

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

https://ksandk.com/

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

DPDP Data Breach Notification In India: Timelines, Requirements And Key Compliance Considerations

A personal data breach can create immediate legal, operational, and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Cross-Border Data Transfers Under India’s DPDP Act: Rules, Restrictions And Compliance Roadmap For 2027

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a relatively permissive framework for the cross-border transfer of personal data from India. Unlike the European Union’s GDPR, which relies extensively on adequacy decisions and prescribed transfer safeguards, the DPDP framework adopts a negative-list approach: international transfers are generally permitted, subject to restrictions that may be notified by the Central Government.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Data Retention And Deletion Under The DPDP Act: How Long Can Businesses Retain Personal Data In India?

India’s data protection framework has moved from legislation to implementation. With the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) now notified, organizations processing personal data in India need to reassess how long they retain personal data, why they retain it, and how they ultimately delete or anonymize it.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

DPDP Act And Rules 2025: The 2026 Compliance Milestones Businesses Can’t Afford To Miss

India’s data protection regime has moved well past the discussion stage. With the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) notified by the Ministry of Electronics and Information Technology (“MeitY”) on 13 November 2025, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) now has a defined implementation roadmap, and 2026 is the year businesses should be using to prepare for substantive compliance.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

What Happens To Existing SPDI Rules After Full DPDP Enforcement?

India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

The Digital Personal Data Protection Consent Manager Framework: What Data Fiduciaries Must Do Before The November 2026 Deadline

India's Digital Personal Data Protection Act introduces a mandatory Consent Manager Framework operational from November 2026, requiring organizations processing personal data to integrate with registered intermediary platforms that enable individuals to manage consent across multiple services. With penalties reaching INR 250 crore per violation and implementation timelines spanning 12-18 months, enterprises face critical infrastructure modernization requirements before the May 2027 full compliance deadline.
IndiaPrivacy
Maheshwari & Co. Advocates & Legal Consultants
Maheshwari & Co. Advocates & Legal Consultants
Article

From Consent To Accountability: Japan’s 2026 APPI Amendment Bill And The New Data Strategy For AI-Driven Businesses

AI regulation does not always arrive in the form of a dedicated AI statute. More often, it enters through privacy law. On April 7, 2026, the Japanese Cabinet approved a bill to amend Japan’s Act on the Protection of Personal Information (“APPI”). The Diet passed the amendment on July 10, 2026, and it was promulgated on July 17, 2026 as Act No. 56 of 2026; the amendment is now enacted but not yet in force, with its main provisions taking effect on a date to be fixed by Cabinet order no later than mid-2028.
IndiaPrivacy
Hammurabi & Solomon Partners
Hammurabi & Solomon Partners
Article

DPDP Data Breach Notification In India: Timelines, Requirements And Key Compliance Considerations

A personal data breach can create immediate legal, operational, and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Cross-Border Data Transfers Under India’s DPDP Act: Rules, Restrictions And Compliance Roadmap For 2027

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a relatively permissive framework for the cross-border transfer of personal data from India. Unlike the European Union’s GDPR, which relies extensively on adequacy decisions and prescribed transfer safeguards, the DPDP framework adopts a negative-list approach: international transfers are generally permitted, subject to restrictions that may be notified by the Central Government.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Data Retention And Deletion Under The DPDP Act: How Long Can Businesses Retain Personal Data In India?

India’s data protection framework has moved from legislation to implementation. With the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) now notified, organizations processing personal data in India need to reassess how long they retain personal data, why they retain it, and how they ultimately delete or anonymize it.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

DPDP Act And Rules 2025: The 2026 Compliance Milestones Businesses Can’t Afford To Miss

India’s data protection regime has moved well past the discussion stage. With the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) notified by the Ministry of Electronics and Information Technology (“MeitY”) on 13 November 2025, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) now has a defined implementation roadmap, and 2026 is the year businesses should be using to prepare for substantive compliance.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

CCPS In India: Why Compulsorily Convertible Preference Shares Remain Central To Venture Capital And M&A Transactions

Compulsorily Convertible Preference Shares (CCPS) remain one of the most widely used instruments for venture capital and private equity investments in Indian companies. Their appeal lies in the ability to combine equity classification with negotiated economic and governance protections. But CCPS are not governed by a single, standalone statutory framework. Their legal treatment is instead shaped by the Companies Act, FEMA and foreign investment rules, tax law, and, where applicable, SEBI regulations.
IndiaCorporate/Commercial Law
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

What Happens To Existing SPDI Rules After Full DPDP Enforcement?

India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Direct Tax Newsletter - Sep - Oct 2026

The CBDT, through its press release dated 28 September 2026, has extended the due date for furnishing the Return of Income for Assessment Year 2026-27 in the case of persons covered under the specified category in the table to Explanation 2 to section 139(1) of the Income-tax Act, 1961, i.e. persons whose accounts are subject to audit under the Act. The original due date for furnishing the return was 31 October 2026. The CBDT has extended this date by 21 days, and the revised due date is 21 November 2026.
IndiaTax
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Banking & Finance Updates September 2026

In August 2026, the Reserve Bank of India (RBI) released the draft Reserve Bank of India (Interest Rates on Loans and Advances) Directions, 2026, proposing a comprehensive framework for the way regulated entities determine and apply interest rates on loans. While the Indian banking sector has long operated under a patchwork of institution specific instructions, the draft Directions seek to bring much-needed consistency to interest rate regulation across banks, cooperative banks, regional rural banks (RRBs), all-India financial institutions and NBFCs. If finalised in their present form, the Directions will come into effect from 1 April 2027.
IndiaFinance and Banking
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

DPDP Act Compliance For Startups And MSMEs: A Minimum Viable Data Protection Framework

The Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) were notified on 13 November 2025, more than two years after the Digital Personal Data Protection Act, 2023 (“DPDP Act” or “Act”) received Presidential assent. The Government has adopted a phased implementation approach, with most of the substantive obligations under the Act and Rules becoming operative 18 months from the date of notification, i.e., on 13 May 2027.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

How Does The DPDP Act Regulate AI Training And Automated Decision-Making In India

The rapid adoption of artificial intelligence (“AI”) has brought data protection considerations into the design, training and deployment of AI systems. AI models may be trained using datasets containing names, images, text, identifiers, behavioural information or other data that can relate to identifiable individuals. AI systems may also process personal data when they are deployed for purposes such as recruitment, credit assessment, insurance, healthcare, customer profiling or content moderation.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva