Digital Lending And Data Privacy - Aligning RBI’s 2025 Guidelines With India’s New Data Protection Law
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
DIGITAL LENDING AND DATA PRIVACY: ALIGNING
RBI’S 2025 GUIDELINES WITH INDIA’S NEW DATA PROTECTION LAW Ankit Kumar & Bijendra Shandilya, B.B.A. LL.B., Indian Institute of Management, Rohtak
ABSTRACT
Digital lending has grown very fast in India because of the rise of smartphones and new financial technology. But this rapid growth has also created serious problems related to privacy and the safety of borrowers. Many fake or unfair loan apps started misusing people’s personal data. They collected too much information and even harassed borrowers when they could not repay loans. These issues made the Reserve Bank of India (RBI) take strict action. In May 2025, the RBI released new rules called the Digital Lending Directions, 2025. These rules bring all the earlier guidelines together and add stronger protections for users. They include clear consent rules, requirements to store data only in India, and a public list of approved loan apps. At the same time, India’s Parliament passed the Digital Personal Data Protection (DPDP) Act, 2023.
It is the country’s first full law made to protect people’s personal data. The Act sets clear rules for using data in a fair, legal, and open way. It also creates a Data Protection Board to watch over how these rules are followed. This article studies how the RBI’s digital lending rules match or differ from the DPDP Act. It looks at important ideas like taking consent before collecting data, using data only for a specific purpose, deleting data after use, and making companies responsible for how they handle data. It also points out areas where the two laws may overlap or disagree — for example, the RBI’s rule to keep data within India and the DPDP Act’s rules about sending data abroad. The paper compares India’s approach with other countries, such as the European Union’s GDPR and Singapore’s PDPA, to understand how similar or different they are.
It finally gives suggestions on how both the RBI rules and the DPDP Act can work together better, so that India’s digital finance system stays both safe and privacy-friendly. Keywords: Digital Lending; Data Privacy; RBI Digital Lending Directions 2025; Digital Personal Data Protection Act 2023; Consent; Data Localization
Introduction
Over the past few years, digital lending has experienced rapid growth in India. Many apps and websites have started offering quick loans with minimal paperwork. These services helped individuals who were unable to obtain loans from traditional banks. But some companies misused this system. They employed aggressive advertising tactics, charged extremely high interest rates, and employed illegal and threatening methods to recover outstanding debts. Many apps also collect excessive personal data from people's phones. News reports showed that some borrowers died by suicide because these loan apps harassed them. These serious problems made the RBI take action. In January 2021, the RBI formed a 36-member Working Group on Digital Lending. The group studied the issues and released a detailed report in November 20211. This report served as the basis for stronger rules.
To control unfair practices, the RBI issued advisory guidelines in June 2020 and September
20222. It also released a rule on default-loss guarantees in June 20233. Later, in May 2025, the
RBI introduced the Digital Lending Directions, 2025. These are strict and mandatory rules for banks and NBFCs, known as Regulated Entities (REs). These directions require lenders to follow borrower-friendly steps. They must provide a clear Key Fact Statement, offer a cooling-off period, and ensure that money is transferred directly between the lender and the borrower. The directions also include strong rules to protect user data and privacy in digital lending. At the same time, India passed the Digital Personal Data Protection (DPDP) Act, 2023. This law governs the collection and use of personal data on the internet. It states that companies must obtain explicit consent and be transparent about how they use a person's data. It also requires companies to use data only for legal purposes, keep it secure, and prevent misuse.
The DPDP Act grants individuals’ essential rights, including the right to access, correct, or delete their data. To ensure companies comply with the law, the Act establishes a Data Protection Board. This Board can review complaints and take action against violations. 1 Reserve Bank of India, Report of the Working Group on Digital Lending (Nov. 2021), https://rbidocs. rbi. org. in. 2 Press Release, Reserve Bank of India, Advisory on Online Lending Platforms (June 24, 2020), https://rbi. org. in
3 Reserve Bank of India, Guidelines on Default Loss Guarantee in Digital Lending (June 8, 2023),
https://rbi.org.in.
This article examines the interaction between the RBI's digital lending rules and the DPDP Act. It asks an important question: How well do these two systems matches, and where are the gaps? Section 4 explains how digital lending rules in India have developed over time. Section
5 gives a simple overview of the DPDP Act and its impact on the financial sector. Section 6
outlines areas of agreement between the two laws, including consent, limited data use, and data storage rules. Section 7 highlights where they may differ, such as authority, control over thirdparty apps, and enforcement issues. Section 8 gives examples and compares India's system with the GDPR in Europe and Singapore's PDPA. Section 9 consolidates all ideas and proposes ways to enhance both frameworks. The conclusion outlines how India can foster fintech growth while safeguarding individuals' personal data in digital lending. Evolution of Digital Lending Regulation in India
2.1 Early RBI Framework and Policy Concerns
In India, digital lending grew very fast, and the RBI had to make new rules to keep up. In June 2020, the RBI released its first notice on loans given through digital lending apps. It told banks and NBFCs to follow fair-practice rules even when they worked with fintech companies. But these rules were soft and not very strict. Soon, many problems began to appear. During the
2020 lockdown, several illegal loan apps started giving quick loans at extremely high interest
rates, sometimes 60% to 100% per year. They did not ask for proper KYC. They took too much personal data from people’s phones, like their contacts and messages. When borrowers could not repay on time, these apps harassed them. They sent abusive messages and publicly shamed them. Some cases were linked to borrower suicides. These incidents forced the government and the RBI to take stronger action. In January 2021, the RBI created a Working Group to study the risks of digital lending. The group gave its report in November 2021. It suggested many steps to protect borrowers. These included not mixing loan funds, giving a clear Key Fact Statement, checking whether consent was taken properly, and limiting how much data apps can access. After this, the RBI issued stricter guidelines in September 2022 for banks and NBFCs4.
In June 2023, it also placed limits on “first loss default guarantee” schemes. The new rules said lenders must take clear consent before collecting any data. They also said apps cannot access sensitive phone features without
4 Reserve Bank of India, Guidelines on Digital Lending (Sept. 2, 2022), https://rbi.org.in.
permission. Even with these rules, many problems continued. Some third-party loan apps that were not linked to banks or NBFCs still did not follow the rules properly.
2.2 RBI’s 2025 Digital Lending Directions and Key Provisions
On May 8, 2025, the RBI released the Digital Lending Directions, 2025. These new rules cancelled all the earlier guidelines on digital lending, including the 2022 rules, the 2020 notice on fair practices, and the 2023 rules on default-loss guarantees. The new Directions bring everything into one clear and complete framework5. These rules apply to all regulated lenders. This includes commercial banks, cooperative banks, NBFCs, housing finance companies, and All-India Financial Institutions. The rules cover every loan that is given through a digital platform or app, even if the final lender is a normal bank or NBFC.
Rules for RE–LSP Arrangements
A major part of the Directions focuses on how regulated lenders (REs) work with Lending Service Providers (LSPs), such as fintech apps. Any digital loan that involves an LSP must now have a written agreement that clearly explains the roles and responsibilities of both sides. REs must check the LSP’s data security and legal compliance. They must also monitor the LSP regularly and remain responsible for everything the LSP does. If an LSP gives loan offers from multiple lenders, it must show all options fairly. It must clearly show the lender’s name, loan amount, interest rate (APR), loan duration, penalties, and a link to each lender’s Key Fact Statement. Borrowers should be able to compare all offers like in a marketplace. If the app uses a ranking system, it must explain how the ranking works. Customer-Friendly Protections The Directions include many safeguards for borrowers.
Lenders must give a Key Fact Statement (KFS) in simple language. This must show the APR, fees, and grievance contact details before the loan is given. All loan papers—such as sanction letters, terms and conditions, and privacy policies—must be digitally signed and sent to the borrower’s verified email.
5 Reserve Bank of India, Digital Lending Directions, 2025 (May 8, 2025) (India).
Money must move only between the lender and the borrower. This means funds must go from the lender’s bank account directly to the borrower’s bank account. Repayments must go back to the lender’s account. Third-party accounts are not allowed. Fintech apps (LSPs) cannot take fees directly from borrowers. Only the regulated lender can pay service fees to the LSP. The Directions also introduce a “cooling-off period. ” Each lender’s board must fix a minimum one-day window in which a borrower can cancel the loan by repaying the principal and interest without paying any penalty. Both REs and LSPs must appoint grievance officers. If a borrower is not happy with the response, they can escalate the complaint to the RBI’s Complaints Management System. These steps make the process more transparent and give borrowers better protection.
Data Protection and Technology Rules Because digital lending involves sensitive personal data, the Directions set strong privacy and security rules. • Limit Data Collection: Lenders and LSPs can collect only the minimum data needed for the loan, mainly basic KYC details. Borrowers must give clear and informed consent at every stage. Lenders cannot access call logs, contact lists, messages, biometrics, or other private mobile data unless the law allows it. • Clear Purpose: Data must be taken and used only for a specific, stated purpose—such as checking loan eligibility, servicing the loan, or recovery. Each time data is used, the borrower must know why. • Data Minimization: LSPs should store only basic details like name, address, and contact information. They must avoid collecting extra device information or any data not required for the loan.
• Data Storage in India: All personal data must be stored on servers inside India. If any data is sent abroad for processing, it must be brought back and deleted from foreign servers within 24 hours. This rule is more flexible than earlier RBI requirements and is closer to the DPDP Act’s rules on cross-border data use.
Privacy Policies and Transparency: REs and LSPs must publish a clear privacy policy on their websites. This must explain how data is collected, used, and shared, and list any third parties who will get the data. Borrowers must also receive a signed copy of the privacy policy. • Cybersecurity and Responsibility: Both REs and LSPs must follow RBI cybersecurity standards. If the LSP suffers a data breach, the regulated lender is fully responsible. Even if the work is outsourced, the RE remains accountable. This forces lenders to properly check and monitor the data-security systems of their partner apps. Digital Lending App Repository To prevent fraud, the RBI now requires all lenders to report every digital lending app they use or own. These apps will appear in a public list on the RBI website with details such as ownership, grievance contacts, and compliance status.
This helps users identify which apps are genuine. Apps that are not listed can be easily flagged as non-compliant. Overview of the Digital Personal Data Protection Act, 2023
3.1 Objectives
and Core Principles The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first full law made only to protect personal data. It became law on 11 August 2023. However, many rules will start later when the government issues detailed guidelines. The Act applies to all digital personal data. It covers data used inside India and also data used outside India if the company is offering goods or services to people in India. The main goal of the Act is to protect a person’s privacy while still allowing data to be used for legal and useful work. The law tries to balance people’s rights with the need for safe data use. Key Principles of the DPDP Act
1. Legal Use and Consent
Companies can use personal data only for a legal reason. In most cases, they must take consent from the person before using their data. This consent must be free, clear, specific, and informed. The Act does not allow broad reasons like “legitimate interest.” Only a few exceptions exist, such as emergencies or when the law requires it.
2. Clear Purpose and Minimum Data
Companies (called data fiduciaries) must collect data only for a clear purpose that they explain to the person. They should collect only the minimum data needed. They must also keep the data correct. After they finish the purpose, they must delete the data or make it anonymous.
3. Transparency and Responsibility
Companies must give a simple and clear privacy notice when collecting data. This notice should explain what data is collected, why it is collected, how long it will be kept, and how it will be used. Some big or important companies must appoint a Data Protection Officer. All companies must create a system where people can file complaints about their data.
4. Rights of Individuals
People (called data principals) get several rights under the Act. They can ask to see their data, correct wrong information, and request deletion of their data. They can also limit or object to some uses of their data. Unlike the GDPR, the final Act does not include a clear “right to be forgotten” or data portability.
5. Consent Managers
The Act introduces a new idea called a “Consent Manager.” This is a trusted third party that helps people give and manage their consent for many services. It stores and manages consent on behalf of companies. This supports India’s growing digital consent system.
6. Enforcement and Penalties
The Act sets up the Data Protection Board of India. This Board will look into complaints and take action against companies that break the law. The fines are very high and can range from ₹50 crore to ₹250 crore, depending on how serious the violation is.
3.2 Financial Sector Implications
The DPDP Act applies widely in the financial sector. Banks, NBFCs, fintech companies, and all digital lenders are treated as “data fiduciaries” when they handle personal data. The Act does not give any general exemption for financial data. Most data used by regulated financial companies will fall under this law. There is only one small exception: the government may allow special rules for checking the financial records of a borrower who has defaulted. But normal lending activities are still covered. For banks and fintech companies, the DPDP Act adds extra work. Every digital loan must follow the rules of the Act. Lenders must take proper consent from customers, as the Act defines it. They must also update their privacy notices so that people know how their data is used. Some large financial companies may have to do regular data audits and appoint a Data Protection Officer.
The Act also applies outside India. If an Indian lender sends personal data to another country for processing, it must follow the DPDP Act’s rules on cross-border data transfer. The Act allows sending data abroad only to countries that are not blocked by the Indian government. This is a “negative list” approach. This is different from the RBI’s older, stricter rule, which did not allow storing financial data outside India at all. The DPDP Act also interacts with other financial regulations. Experts note that some parts of the Act may clash with older RBI rules, such as strict data localization. So, financial companies must follow both sets of rules: RBI guidelines for safety and security, and DPDP rules for legal compliance. At the same time, the DPDP Act supports many good practices already suggested by the RBI Working Group, such as keeping audit trails and allowing data deletion.
It also creates a common system for people to file complaints. However, financial regulators must now work together. A customer can complain to the RBI for banking issues, or to the Data Protection Board for privacy issues. This raises questions about which authority should handle which complaints and how both systems will stay consistent. Alignment Between RBI’s 2025 Guidelines and DPDP Act The RBI’s Digital Lending Rules and the DPDP Act follow similar ideas about privacy. Both agree that borrower data is sensitive and must be protected. They also stress that a person’s consent and control over their own data are very important. The points below explain how both rules match and support each other.
4.1 Consent-Based Data Collection
One major similarity between the two laws is the idea of free and clear consent. The RBI’s rules say that lenders must take the borrower’s clear permission before collecting any personal data. This consent must be active, meaning the borrower must say “yes,” and the lender must record it properly. Borrowers also have rights. They can refuse to share certain data. They can control how their data is used. They can also take back their consent at any time. For example, a lending app cannot access a borrower’s contacts or photos unless the borrower gives direct permission. The DPDP Act follows the same idea. It says that companies can use personal data only when the person has given proper consent6. The Act sets a very strict standard: consent must be free, informed, specific, and clear7. The RBI’s rules match this standard.
The rights that borrowers get under RBI rules—like stopping or withdrawing consent—are similar to the rights people get under the DPDP Act, such as objecting to data use or asking for data to be deleted. In short, both laws put borrower consent at the centre of data collection.
4.2 Purpose Limitation and Data Minimization
Both laws stress that lenders should collect only the data that is truly necessary. The RBI’s rules clearly say that data collection must be linked to a specific purpose, based on consent, and kept to the minimum. Lenders can ask for basic details like name, age, income, and contact information. But they cannot take extra information that is not needed for the loan. This protects the borrower’s privacy and stops apps from collecting unwanted data. The DPDP Act also follows the same idea. It says that personal data should be collected only for a clear and lawful purpose8. Companies should use only the amount of data needed for that purpose. A digital lending app cannot collect extra data “just in case” it may be useful later. In real practice, the RBI’s short list of essential loan data matches the DPDP Act’s rule of using only necessary information.
Both laws also insist on transparency. Under the RBI rules, lenders
6 Digital Personal Data Protection Act, 2023, s 4(1).
7 Digital Personal Data Protection Act, 2023, s 6.
8 Digital Personal Data Protection Act, 2023, s 7.
must tell borrowers why they are collecting each piece of data. Similarly, the DPDP Act requires companies to give a clear notice explaining how the data will be used. Together, both frameworks push for simple, limited, and honest data collection.
4.3 Data Retention, Erasure, and Accountability
The RBI’s rules and the DPDP Act also match when it comes to how long data can be kept and what rights people have over their data. Under the DPDP Act, companies must delete or anonymize personal data once they finish the purpose for which they collected it. The Act also gives people the right to ask for their data to be erased. The RBI rules say the same thing. Borrowers can withdraw their consent and ask the lender to delete their data. For example, if a borrower decides to cancel a loan before the money is given, the lender must delete all data already collected. Both laws give borrowers strong control over how long their data stays with a company. Both laws also make the main company responsible for how the data is handled. Under the DPDP Act, the “data fiduciary” (such as a bank or fintech) is fully responsible for following the law.
The RBI rules also make the bank or NBFC responsible for any privacy violations done by the digital lending service it hires. Even if work is given to another company, the main lender cannot escape responsibility. This approach follows international best practices and ensures clear accountability. Both laws also require companies to make internal policies, appoint grievance officers, and set up systems to handle complaints. Overall, in the areas of consent, limited data use, data storage, and borrower rights, the RBI’s
2025 rules strongly support the DPDP Act. They turn the DPDP Act’s general ideas into
practical rules for the lending sector. For example, the RBI requires all borrower data to be stored only in India. If any data goes outside India, it must be brought back within 24 hours. The DPDP Act also controls sending data to other countries and allows it only when the government approves the destination. Both frameworks also require encryption, quick reporting of data breaches, and clear privacy policies. Many experts point out that the RBI’s rules closely follow the DPDP Act’s basic principles. Together, they create a strong and borrower-friendly system for data protection. Potential Conflicts and Legal Ambiguities Even though both laws match in many areas, some conflicts and doubts still remain. These problems come up because the two laws overlap in some parts and differ in their scope.
5.1 Jurisdictional Overlap Between RBI and Data Protection Board
One major area of confusion is deciding who controls what. The RBI issues rules for banks, NBFCs, and digital lenders. The DPDP Act creates a separate Data Protection Board to handle data-privacy complaints. When a digital lending activity breaks both RBI rules and the DPDP Act—for example, when data is sent without permission—it is not clear which authority should act first. The DPDP Act is a central law and generally applies even if other laws say something different. It also has an overriding clause that gives it strong power over older laws9. But the RBI also has legal authority to regulate banking and credit. Because both bodies have strong powers, there is a chance of double regulation. There are also differences in how each framework treats data. For example: • RBI allows some foreign data processing but requires the data to be brought back to India within 24 hours.
• The DPDP Act is expected to allow sending data abroad only to countries that are not on a “prohibited” list. These two rules do not fully match, and this may confuse banks and lenders. Another problem is enforcement. The RBI requires strict consent and audit systems. These may satisfy DPDP rules, but if a data breach happens, it is unclear who will investigate—the RBI or the Data Protection Board. The DPDP Board can act like a civil court and impose heavy fines. The RBI can also punish lenders by issuing penalties or even restricting licenses.
9 Banking Regulation Act, 1949, s 35A.
This means a digital lender may face two sets of penalties for the same issue. This makes compliance harder. Experts have pointed out that differences between RBI rules and the DPDP Act may create legal challenges for financial companies. Because of all this, many believe that the RBI and the Data Protection Board should issue clearer guidance or sign an agreement on how they will share responsibilities. This would help prevent confusion and avoid conflicting decisions.
5.2 Gaps in Regulating Third-Party Lending Apps
Another area of confusion is about digital lending apps that do not come under the RBI’s direct control. The RBI’s rules apply only to loans issued by banks or NBFCs, even if those loans are given through an app. But the RBI does not regulate fintech apps that work alone and are not linked with any bank or NBFC. Many famous lending apps are either owned by NBFCs, and therefore covered, or they are run by independent companies. Many of these independent apps still collect a lot of personal data, such as messages, contacts, and social media information—but there is very little oversight on how they use it. If an app is not tied to a regulated lender, the RBI cannot act against it. In theory, these apps are covered under the DPDP Act because they process personal data and thus become “data fiduciaries.
” But many of them are not even properly registered as companies, which makes it hard for the government to take action. The Data Protection Board can act against any entity handling Indian users' data, including shady lenders. However, catching these “dark apps” is difficult because many operate secretly or from outside India10. The RBI has created a public list of approved digital lending apps, but this list only includes apps linked to regulated lenders. This still leaves a gap. Apps that operate illegally or without an NBFC partner remain outside the RBI’s control, and the DPDP Act will work only if enforcement is strong. Experts say India needs clear rules for all lending apps. These rules should specify what data apps can collect, how long they can keep it, and what recovery methods they can use. If the
10 The Digital Personal Data Protection Act, No. 22 of 2023 (India).
DPDP Act is expected to cover these apps, then strong implementation and public awareness will be very important.
5.3 Enforcement and Penalty Challenges
Making sure that companies follow privacy rules is not always simple. The DPDP Act has very high fines. A single mistake—such as not handling a borrower’s request correctly—can cost a small fintech ₹50–250 crore. This amount is far higher than normal RBI penalties, which are usually much smaller. Because of this, some punishments may feel too harsh unless authorities apply them with care11. Another problem is timing. The DPDP Act is not fully active yet. Many important parts, like rules on data storage and data transfer, will start only after the government notifies them. On the other hand, the RBI’s Digital Lending Directions are already in force, with full compliance expected by November 2025. This mismatch may create confusion for lenders who must follow two different timelines. Penalties also work differently under each law.
If an NBFC breaks RBI’s data rules, the RBI will take action. If a company breaks DPDP rules, the case goes to the Data Protection Board. Because of this, both regulators must coordinate so that the same mistake—like not taking proper consent—goes to the correct authority. There is another gap. The DPDP Board, which will handle privacy complaints, is not fully functional yet. Until it becomes active, people have no special place to file data privacy complaints. They may go to the RBI (if it concerns financial services) or to consumer courts. This creates legal confusion. In short, while the RBI rules and the DPDP Act share similar goals, their combined effect creates certain problems. These include overlapping powers between RBI and the DPDP Board, gaps in regulating independent apps, and the risk of double penalties.
To avoid confusion and fear in the industry, the government may need to issue clearer guidelines or even update the law.
11 Anahad Narain, Penalties Under the DPDP Act, Leegality (Mar. 12, 2024),
https://www.leegality.com/consent-blog/penalties.
Case Studies and Comparative Perspective Indian Context In India, recent events show the importance of strong rules in digital lending. The RBI created a working group after many news reports showed how some lending apps were harassing and threatening borrowers. Many people lost control over their personal data and had no way to complain. The RBI’s 2025 Directions now focus on consent, privacy, and quick grievance redress. These rules came from real problems faced by borrowers. Many users even said that the new consent rules were long overdue and gave them a sense of safety. The RBI is also building a list of approved lending apps. According to reports, at least 100 unsafe apps have already been removed. This shows that the formal rules are now starting to protect people better. Comparison with GDPR (EU) India’s DPDP Act has some similarities with the European Union’s GDPR.
Both laws require clear consent, limited use of data, accuracy, and the right to delete data. Both have heavy penalties for violations. But there are differences. GDPR covers all personal data, not only digital data. It also allows many legal grounds to process data, like “legitimate interest” or “contract. ” India’s DPDP Act mostly depends on explicit consent from the user. GDPR’s fines can be up to 4% of a company’s global income, which is even higher than India’s law. GDPR also controls how data can be sent outside the EU. It allows transfer only to safe countries or through special agreements. India’s DPDP draft rules plan to allow data transfer to all countries except those on a restricted list. The RBI’s new 24-hour data-return rule is stricter than GDPR but more flexible than the old full-localisation policy. It is somewhat similar to Singapore’s negative-list model12.
Singapore’s PDPA Singapore’s data law, the PDPA, is also close to India’s law. It includes rules on consent, notice, 12 Sonali Srivastava, India: Decrypting Critical Concepts Under India’s Digital Personal Data Protection Act, 2023 and Comparison with GDPR and PIPL, IJLT Blog (Mar. 21, 2024), https://forum. nls. ac. in/ijlt-blogpost/india-decrypting-critical-concepts-under-indias-digital-personal-data-protection-act-2023-and-comparisonwith-gdpr-and-pipl/. purpose, and breach reporting. But Singapore allows “deemed consent” in some cases, such as when a person gives data for a contract. India’s DPDP Act does not allow such automatic consent. It mostly requires active, clear consent from the borrower. Singapore also follows a negative-list model for data transfer. Data can be sent abroad unless the country is on a banned list. Earlier, the RBI did not allow foreign storage at all.
But the new 24-hour repatriation rule shows India is moving toward a more practical approach, similar to Singapore. Other Global Approaches The United States does not have one single privacy law. Instead, it has many sector-wise rules, such as the GLBA and guidelines from the FTC13. These focus on keeping financial data safe and giving users notice. India is also moving in the same direction. The RBI has sector rules for fintech companies, and now the DPDP Act brings a national standard that works with these rules. Indian Judicial View Indian courts have not yet decided any cases that directly compare DPDP with financial rules, as the law is new. But in the 2017 Puttaswamy case, the Supreme Court said privacy is a fundamental right14. This supports the DPDP Act’s purpose. Courts usually give RBI freedom in matters of banking and consumer protection.
But if a conflict arises between RBI rules and a person’s privacy rights under DPDP, courts will have to balance both interests. This situation has not happened yet15. In many countries, privacy agencies and financial regulators work together. For example, the European Banking Authority issues privacy guidance along with GDPR rules. India could also set up a similar coordination system between the RBI and the DPDP Board. Critical Analysis and Recommendations Both the RBI’s 2025 lending rules and the DPDP Act try to build trust in India’s digital
13 Federal Trade Commission Act, 15 U.S.C. § 45.
14 Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (India)
15 Narendra Kumar v. Union of India, (1960) SCR 375 (India).
economy. They do this by protecting people’s data. Many of their ideas match, like taking clear consent, using only the minimum data needed, and keeping data safe. This is helpful because banks and fintechs can follow one set of rules and feel more confident that they meet the other. But some gaps and confusion still remain. Below are a few simple suggestions.
1. Clear Rules on Storing Data Abroad
RBI now allows lenders to send data outside India for only 24 hours and then bring it back. The DPDP Act also plans to allow transfers except to banned countries. Both sides should clearly explain this in their detailed rules. They can either list the allowed countries or write the 24-hour rule in the DPDP regulations. Clear rules will help digital lenders plan better and avoid mistakes.
2. Clear Roles for RBI and the DPDP Board
RBI handles banking issues. The Ministry of Electronics and the DPDP Board handle privacy issues. Sometimes, a complaint—like an illegal data transfer—can fall into both areas. To avoid confusion, both regulators should sign an MoU or issue a joint notice. This can decide who will handle which type of complaint. For example, the DPDP Board could focus on privacy harm, while RBI could handle financial harm. This will prevent double punishment.
3. Stronger App Regulation
RBI’s new public list of approved lending apps is very helpful. But many unsafe apps still operate without any rules. The DPDP Act can require all apps that take Indian users’ data to register with the DPDP Board. Another option is: RBI and the government can work together and use IT Act powers to control these rogue apps. They can also ask such apps to tie up with a registered NBFC, so they fall under RBI rules. Regulators may also consider a licence for digital lending platforms, making data protection mandatory.
4. Better Consent System
RBI wants clear and trackable consent. The DPDP Act plans a national system with “Consent Managers” so users can manage consent in one place. It would help if both systems connect with each other. For example, if a borrower gives consent inside a lending app, the same consent can also appear in the national consent portal. This will save time and reduce repeated consent requests.
5. Balanced Penalties
The DPDP Act has very heavy fines. Many RBI-regulated companies may not be fully ready for these penalties. Both regulators should issue joint guidance on how penalties will work if the same issue comes under both laws. For example, if a company breaks RBI’s data rules once and fixes it quickly, the DPDP Board may avoid the highest penalties at the first instance. Over time, RBI checks can help DPDP audits. Regulators can also share simple case studies so companies understand what to do
6. Sector-Specific Standards
Because the rules overlap, both regulators should work together and create simple and common standards for digital lending. These can include model consent forms, sample privacy notices, and minimum security rules. This is common in Europe and will help Indian lenders follow best practices without confusion.
7. Awareness for Users and Training for Lenders
Borrowers must know their rights. They should know how to withdraw consent under DPDP and how RBI protects them through tools like cooling-off periods and Key Fact Statements. Lenders must train staff to understand both laws. For example, they must know that a borrower asking for deletion under DPDP may still require the lender to keep some data because RBI needs certain records for a minimum time. FAQs published by both regulators can help avoid misunderstandings.
8. Regular Review and Feedback
While drafting DPDP rules, the government should take feedback from banks, NBFCs, and fintechs. RBI can share comments so that important processes like credit checks are not affected. DPDP experts can also help RBI design privacy-friendly systems. A two-way feedback process will help both laws grow smoothly side by side. The RBI’s 2025 rules and the DPDP Act both support a safer and more trusted digital financial system. If regulators work together—through joint rules, shared guidance, and regular communication—then following one law will naturally help companies follow the other. This will create a stronger and clearer digital regulatory system for India. Conclusion India is moving fast in digital finance and data privacy. The RBI’s 2025 digital lending rules have made lending safer. These rules protect borrowers and set clear data-privacy duties for banks and fintech companies.
At the same time, the DPDP Act 2023 creates a national system for handling personal data. It focuses on consent, transparency, and data security. This study shows that both frameworks match well in many areas. Both ask lenders to take clear consent, collect only the data they need, stay responsible for how they use data, and give people rights over their own information. However, some problems still exist. Earlier, RBI’s rule on keeping data inside India was stricter than DPDP’s plan for data transfers, though this is now becoming more flexible. RBI’s powers may also overlap with the future Data Protection Board, whose role is not yet fully clear. Many lending apps that do not work with banks or NBFCs are also outside RBI’s control, so DPDP will have to deal with them. To solve these issues, regulators need to define who handles what.
They must match their technical rules, such as consent systems, and make sure enforcement is smooth and not repeated. In the future, working together will make digital lending both safe and privacy-friendly. Borrowers will trust digital lenders more and will have better ways to raise complaints. Lenders will get clearer rules that satisfy both banking laws and data-privacy laws. As new tools like AI-based credit scoring grow, this cooperation will become even more important. India is following global best practices: a strong privacy law supported by specific rules for each sector. With careful and coordinated work, India can keep its digital finance system innovative while still protecting people’s privacy.
References / Bibliography • Reserve Bank of India (Digital Lending) Directions, 2025 (8 May 2025) (India). • The Digital Personal Data Protection Act, No. 22 of 2023 (India). • Press Information Bureau (India), “Digital Personal Data Protection Bill, 2023 – Salient Features,” (Aug. 2023). • PRS Legislative Research, The Digital Personal Data Protection Bill, 2023 (Parliamentary Brief). • Nishith Desai Associates, India’s New Digital Lending Law: Building Trust, Transparency and Accountability (Regulatory Hotline, 28 May 2025). • Vrinda Patodia & Aparna Amnerkar, Rewriting the Rules of Digital Lending: RBI Digital Lending Directions, 2025, Lexology (28 May 2025). • Lily Vadera et al. , FIG Paper (No. 44, Series 3): RBI Consolidates Directions on Digital Lending (Cyril Amarchand Mangaldas, 20 May 2025).
• Kaustubh Shakkarwar, India’s Unified Digital Consent Framework: RBI, TRAI & BRDCMS, Econ. Times (CISO) (23 Oct. 2025). • DLA Piper, Data Protection Laws of the World – India (Jan. 2025). • Latham & Watkins LLP, India’s Digital Personal Data Protection Act, 2023 vs. the GDPR (Sept. 2023). • Internet Freedom Foundation, “#PrivacyOfThePeople: Small borrowers and digital lending apps” (8 Nov. 2021). • Internet Freedom Foundation, “Digital lending and small borrowers” (Blog). • IAPP (Ankita Kaw), The impact of India’s DPDPA on existing laws and regulations (Dec. 12, 2024). • Leegality Blog (Anahad Narain), “Penalties under the DPDP Act” (Mar. 12, 2024).
Economic Times CISO (Kaustubh Shakkarwar), India’s unified digital consent framework: RBI, TRAI & BRDCMS (23 Oct. 2025).