When Banks Share Customer Data With Fintechs: Who Is Legally Responsible When Things Go Wrong?

A customer applies for a personal loan through a fintech app. The fintech collects her details and passes them to the partner bank, which approves the loan. The data then moves to a cloud provider that hosts the bank's systems, to a credit analytics vendor that scores the application and, eventually, to a collection agency. If that data leaks at any point in the chain, the customer is unlikely to know which of these entities was at fault. Indian law, however, will expect someone to answer for it.

The short answer is that the bank or NBFC which decides why and how the customer's data is processed will usually bear primary legal responsibility, both under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and under the Reserve Bank of India's expectations for outsourcing. A fintech, cloud provider or vendor acting purely on the bank's instructions is a data processor whose obligations arise mainly through contract. However, a fintech which uses the same data for its own