India DPDP Act: AI Credit Assessment Implications

Your NBFC team is drafting a consent notice, deciding which borrower data to store, and watching the retention clock start. The DPDP Act sets requirements for that workflow. India's Digital Personal Data Protection Act 2023 is in force, although its implementing rules are still being developed.

This is a technical and product view of the Act's impact on alternative-data credit platforms and the NBFCs that use them, not a legal opinion. Consult qualified legal counsel familiar with DPDP Act obligations for specific compliance decisions. The focus here is how to meet requirements through system design rather than retrofit.

DPDP Act Duties for Credit Assessment

The DPDP Act sets obligations for Data Fiduciaries, meaning entities that decide why and how personal data is processed. For NBFCs and credit technology platforms, the key areas are consent, purpose limitation, data minimization, and storage limitation.

Consent must be free, specific, informed, unconditional, and unambiguous. Borrowers must know what data is shared, with whom, why, and for how long. One bundled click-through for several purposes does not meet the Act's specificity standard. Each purpose needs separate, clear consent.

Purpose limitation bars using data collected for one purpose for another without additional consent. Data gathered for credit assessment cannot support marketing analysis or third-party sales without separate authorization. For alternative-data platforms, this requires the pipeline to enforce purpose boundaries, not merely describe them in a privacy policy.

Data minimization requires only necessary data. A credit assessment should not request twelve months of bank statements when ninety days supplies the needed signal, or collect fields the model does not use. Each collected field needs a documented justification.

Storage limitation requires deletion when data is no longer needed for its original purpose. Once the assessment and loan decision are complete, transaction records have a finite legitimate retention window. Audit and regulatory needs, including RBI record retention requirements, set a floor, but indefinite retention without justification is incompatible with the Act.

Account Aggregator Architecture Benefits

The Account Aggregator framework, regulated by RBI under the Non-Banking Financial Company Account Aggregator (Reserve Bank) Directions, 2016, aligns more closely with DPDP Act requirements than many other financial data collection methods.

In the AA framework, sharing begins with an explicit borrower consent request. The borrower sees the data, financial institution, Financial Information User, purpose, and duration involved. The AA stores time-stamped consent and supports withdrawal. This is closer to the DPDP Act standard than passive consent in terms of service.

The AA framework applies purpose limitation during transfer. The FIP shares data with the AA only for the granted consent, and the AA passes it to the FIU, the credit platform or NBFC, for that purpose. Data exchange is consent-scoped at the infrastructure layer, not just the application layer, making repurposing harder.

Using AA does not make a credit platform automatically DPDP Act compliant. The Act covers more than data collection. Still, AA infrastructure provides a more compatible starting point than PDF bank statement uploads or screen-scraped data.

Consent Design for Credit Applications

DPDP Act-compatible consent design extends beyond the consent screen. The workflow should identify data categories, explain the purpose, state the retention period, and provide a way to withdraw consent or request deletion.

For NBFCs and credit platforms, consent-flow choices can have direct DPDP Act consequences.

Specific purpose description: the notice should name the actual use, not generic "credit assessment purposes." If bank transaction data assesses cash-flow patterns for a working capital loan, the notice should say so. Vague wording fails the "informed" requirement.

Data retention disclosure: state how long data will remain stored. Credit assessment data may also fall under RBI record retention requirements, typically a minimum of eight years for loan records. Data protection policy and regulatory retention must therefore be coordinated.

Withdrawal mechanism: borrowers need a practical way to withdraw consent or request deletion. Active loan accounts remain subject to regulatory retention. For declined applications with no loan made, the legitimate retention window is shorter and withdrawal is less restricted.

Building Privacy into Data Architecture

The DPDP Act requires privacy to be built into credit architecture, not bolted on. A single borrower-data pool without labels for purpose, consent basis, and retention period cannot enforce requirements at scale. It can only handle requests case by case, at greater cost and risk of error.

Purpose-scoped storage attaches metadata to ingested credit data: consent basis, stated purpose, and applicable retention period. Expiry triggers automated deletion. If consent is withdrawn, the system can locate all data collected under it and process deletion systematically.

This is not a novel architecture. It is standard practice in mature data governance. The DPDP Act makes a legal requirement of practices that good data hygiene already supports. Building with DPDP Act compliance in mind from the start avoids technical debt when the implementing rules take full effect.

What Is Still Uncertain

The DPDP Act's implementing rules remain in development and will specify aspects of consent managers, consent frameworks, and technical standards. The Data Protection Board of India, responsible for complaints and enforcement, has not yet reached its full operational form at the time of writing.

That uncertainty is not a reason to wait. The statute's core duties are clear enough to design for. Platforms and NBFCs that align collection systems with the Act now should face lower adjustment costs when rules are finalized. Continuing pre-Act practices means higher costs and potentially greater enforcement risk later.