DPDPA Checklist for NBFC Compliance Officers

What must an NBFC compliance officer do for DPDPA compliance?

1. Map the borrower data lifecycle and assign a lawful ground to every step. Application, KYC, bureau pull, underwriting, sanction, disbursal, servicing, collections, closure, and post-closure retention. For each, record what personal data is collected, from whom, by which channel, and on what ground. Do this as a table, not prose — it becomes your evidence artefact and your DPIA skeleton if you are ever notified as an SDF. Owner: you, with the LOS product owner.
2. Accept that lending runs on Section 6 consent and rebuild the notice accordingly. Section 7 legitimate uses are a closed list. None covers commercial lending, credit assessment, cross-sell or collections — Section 7(i) is the employment ground and is available to you only as an employer of your own staff, not in respect of borrowers. So your borrower notice must meet Rule 3: an itemised description of the personal data, the specified purposes and a specific description of the goods or services enabled, in clear plain language, presented independently of your other terms, in English or any Eighth Schedule language. Withdrawal must be as easy as giving. Unbundle lending from cross-sell from marketing from bureau-data reuse — one purpose, one affirmative action, no pre-ticked boxes, and consent cannot be made a condition of the loan for purposes the loan does not need.
3. Reconcile PMLA/RBI retention against DPDPA erasure — as a mapped table, not a policy line. This is the item most often fudged. The erasure duty is qualified where retention is necessary for compliance with a law in force, so your PMLA and RBI KYC master direction retention periods stand even against a withdrawal request. But you must be able to point to the specific obligation per data class, not assert a general business need. Build a three-column map: data class → statutory retention basis and period → what happens at expiry. Then note the floors that cut the other way: Rule 6(1)(e) requires retaining access logs and personal data for one year as a security safeguard, and Rule 8(3) sets a one-year minimum for personal data, associated traffic data and processing logs. Rejected applicants are where this bites hardest — you hold full KYC on people who never became customers.
4. Fix the DSA, LSP, co-lender and recovery-agent paper. Distinguish deliberately, per counterparty, whether they are a Data Processor acting on your instructions or a Data Fiduciary processing for their own purposes — a co-lender is usually the latter, a collections agency usually the former, and an LSP can be both. Processors may process only under a valid written contract; Rule 6(1)(f) requires appropriate security provisions in that contract. Add: purpose limits, an explicit bar on independent reuse of borrower contact data for the counterparty's own marketing or lead resale, sub-processing consent, deletion on exit, and an incident-escalation SLA in hours — because their delay consumes your 6-hour and 72-hour clocks. Liability for a processor's failure stays with you and cannot be contracted away.
5. Pre-wire the four-lane breach clock, then rehearse it. Four obligations run in parallel and are cumulative, not alternatives:

   Obligation	Deadline	Basis
   CERT-In incident report	6 hours of noticing	CERT-In Directions 2022 (s.70B(6), IT Act)
   Intimation to each affected Data Principal	Without delay	Rule 7(1)
   Initial intimation to the Data Protection Board	Without delay	Rule 7(2)(a)
   Detailed report to the Board	72 hours of becoming aware	Rule 7(2)(b)

   Plus your RBI supervisory reporting, which is unaffected. Note the Board gets two filings, not one — most NBFC playbooks have only the 72-hour report. Pre-draft three borrower notice variants (KYC/identity exposure, financial-data exposure, contact-data exposure) in the languages of your borrower base, name an incident owner and an alternate, and run a tabletop on an LSP leaking a collections file on a Friday evening. Rule 7(1) prescribes what the borrower notice must contain — nature, extent and timing, consequences relevant to them, mitigation implemented, safety steps they can take, and business contact information for someone who can respond.
6. Build queryable consent state before you need it. When a breach hits, your notification list is only as precise as your ability to ask which borrowers' data sat in that system, on what consent, as of that date. Without it, the honest answer is "notify everyone," which is expensive and reputationally worse. Timestamped, tamper-evident consent and withdrawal records also answer the Board's real question in an inquiry — not "do you have a policy" but "prove the state of consent on 14 March." Owner: you + CTO.
7. Make withdrawal actually propagate. Test it end to end: a borrower withdraws marketing consent on Tuesday — does it reach the LOS, the CRM, the dialler, the SMS/WhatsApp gateway, the co-lender, and the DSA who sourced them? Most NBFCs can stop the first system and none of the rest. Also confirm the boundary: withdrawal stops the consent-based processing; it does not touch data you retain under a statutory obligation, and processing done before withdrawal remains lawful.
8. Publish the contact person and hold the 90-day grievance ceiling. Rule 9 requires prominently publishing on your website or app the business contact information of the person able to answer processing questions — and repeating it in every response to a rights request. Rule 14(3) requires the grievance system to respond within a period not exceeding ninety days. Name a real person, wire it into your existing RBI grievance machinery rather than building a parallel one, and publish the means by which borrowers exercise access, correction, erasure and nomination rights (Rule 14(1)).
9. Handle employee data on the correct, separate ground. Your own staff, DSAs on rolls, and collections employees sit under Section 7(i) — processing for purposes of employment, or to safeguard the employer from loss or liability, including prevention of corporate espionage and maintenance of confidentiality. No consent needed for the core employment relationship. Say this explicitly in your internal note, because teams that have absorbed "everything needs consent" will over-collect consent from staff and under-collect it from borrowers. It does not stretch to unrelated uses of employee data.
10. Assess SDF exposure, and build the Rule 13 artefacts on your own timetable. Rule 13 binds Significant Data Fiduciaries only — annual DPIA and independent audit, algorithmic due diligence over software used for processing, and the Central Government's localisation restriction on specified data. SDF status is conferred by Central Government notification under Section 10, assessed on volume and sensitivity of data, risk to Data Principals' rights, and impact on sovereignty, security, electoral democracy and public order. It is not automatic on AUM or borrower count. But a large retail lender is a more plausible candidate than most sectors, so build the DPIA and audit artefacts as a matter of course — and separately note Rule 15, which applies to every Data Fiduciary transferring personal data outside India, subject to requirements the Central Government may specify. Rule 13(4) localisation is SDF-only; Rule 15 is not.