How the DPDP Act Applies to Debt Collection and Skip Tracing

Skip tracing is the process of locating a defaulted borrower whose contact details are missing, outdated, or deliberately concealed.

Lenders and collection agencies rely on skip tracing to re-establish contact when loan payments stop. They check public records, credit bureau databases, and address lists to find working phone numbers or physical addresses. For the wider recovery workflow across delinquency stages, read our guide on the debt collection process.

Finding missing borrowers is vital for recovering overdue debt. However, tracing involves personal data like phone numbers, jobs, and home addresses. To understand India’s broader privacy framework, review our guide on the DPDP Act.

Section 17(1)(f) of the DPDP Act creates a specific statutory exemption for processing personal data to recover defaulted loans.

Section 17 of the DPDP Act sits in Chapter IV of the law. Sub-clause (f) permits checking financial records, assets, and liabilities of any person who defaults on a loan from a financial institution.

The statute defines key terms by cross-referencing Section 3 of the Insolvency and Bankruptcy Code:

Under the Act’s illustration, a bank may process a borrower’s asset data once she misses a loan payment on its due date.

This cross-reference is significant. Central bank rules classify bad debt after 90 days of missed payments. In contrast, the insolvency code triggers on any unpaid instalment. This indicates that the privacy exemption applies earlier than formal bad-debt classification.

The clause also requires processing to follow disclosure rules under other laws in force, described generally without naming specific acts.

The statutory exemption lifts consent rules and individual privacy rights, but security safeguards remain mandatory.

The carve-out removes debt recovery from notice and consent rules, as well as data principal rights of access, correction, and erasure. Defaulters cannot demand that a lender delete contact details during active recovery. In addition, cross-border transfer limits do not apply.

However, key duties remain in force:

One statutory question remains open. The law requires breach reporting to the Data Protection Board and affected individuals. While the exemption preserves security safeguards, it omits breach reporting. A literal reading suggests breach reporting may not apply to exempt recovery data. However, official guidance has not clarified this point. Prudent lenders should treat breach reporting as active.

In debt collection workflows, the lending bank or NBFC acts as the data fiduciary, while the recovery agency typically functions as a data processor.

A data fiduciary decides why and how personal data is processed, while a data processor acts on its instructions. For more details, read our guide on the data fiduciary under the DPDP Act.

In debt collection, lenders set recovery goals and direct processing. Compliance guidance confirms that recovery agencies are typically classified as data processors acting under lender mandates. However, if an agency makes its own choices on how to process debtor data, it risks being treated as a fiduciary.

When lenders hire collection agencies or tracing vendors, Section 8(2) requires a valid data processing agreement. Lenders often deploy debt collection management software to track audit logs and control vendor access. Lenders cannot contract out of legal responsibility for vendor non-compliance.

A separate carve-out covers public records. The Act does not apply to personal data made publicly available by the individual or under a legal requirement. This covers public records like court notices, but does not exempt private databases.

The DPDP Act exemption does not alter Reserve Bank of India conduct rules that govern debt collection practices.

The Reserve Bank of India has long regulated debt collection. An August 2022 central bank circular outlines the responsibilities of regulated entities employing recovery agents, applying to banks and NBFCs.

In November 2025, the central bank issued consolidated Responsible Business Conduct Directions for commercial banks, alongside parallel rules for NBFCs. Companion outsourcing rules mandate vendor vetting, need-to-know data access, and separation of client records.

Through 2026, the Reserve Bank has drafted tighter recovery standards. Proposed rules require agent certification by the Indian Institute of Banking and Finance. The draft norms also restrict contact to the borrower or guarantor, and bar lenders from accessing mobile phone contacts and photos. Expected start dates span mid-2026 to January 2027 depending on the instrument.

India provides a direct statutory carve-out for debt recovery, whereas the European Union relies on a case-by-case balancing test.

Under the European Union’s General Data Protection Regulation, debt recovery has no statutory exemption. Instead, creditors rely on legitimate interests under Article 6(1)(f). A creditor must pass a three-part test: proving a real purpose, showing necessity, and balancing creditor needs against borrower rights.

Furthermore, European consumers hold a direct right to object under Article 21. If an individual objects, recovery must halt unless the creditor proves compelling grounds. In contrast, India’s DPDP Act lifts individual privacy rights for qualifying recovery. Defaulters in India cannot invoke data-principal rights to halt legitimate skip tracing.

Read together, the statutory exemption and central bank conduct rules establish two distinct compliance layers that lenders must manage.

This structure indicates that holding a privacy exemption does not grant a license to bypass conduct rules. Section 17(1)(f) resolves the privacy question: a lender does not need consent to process defaulter data. However, central bank rules govern debtor contact. A lender can follow privacy law fully and still face fines for calling late or contacting relatives.

In practice, lenders must separate privacy compliance from recovery operations. Compliance programs focused only on privacy miss conduct controls that central bank audits check. Furthermore, because lenders remain legally responsible for agency actions, contracts cannot shield them from fines.

To maintain defensible operations, lending teams should check these key controls:

Lenders can use collections intelligence solutions to verify borrower records while maintaining audit trails.