Fraud Prevention Under the DPDP Act: Where Privacy and Risk Collide in Indian Lending

Indian lenders will run fraud controls under a DPDP Act whose list of legitimate uses does not name fraud prevention. None of the nine legitimate uses in Section 7 uses the words fraud, money laundering, credit or risk. The Act's working tools for fraud teams are elsewhere: the Section 17(1)(c) exemption for processing "in the interest of prevention, detection, investigation or prosecution of any offence", the Section 11(2) carve-out for written requests from a Data Fiduciary authorised by law, and the law-compliance carve-outs in Section 6(6), Section 8(7) and Section 12(3). All of those provisions commence eighteen months after 13 November 2025, which computes to 13 May 2027 (computed).

This paper's central reading, built from the provisions cited below, is that the collision is uneven. Where a fraud control rests on a duty in another law, such as PMLA record-keeping secondary], [RBI fraud reporting or credit-information retention, the other law names the duty, and the DPDP text defers to other law for consent withdrawal and erasure through the carve-outs in s.6(6), s.8(7) and s.12(3). Beyond those carve-outs, whether a given RBI rule is accommodated or overridden under Section 38(2) is a question the cited sources do not settle. Where a control rests on the lender's own judgement, such as device signals beyond what RBI prescribes, participation in shared registries with no mandating paragraph, or collections contact with third parties, the text offers consent or an exemption whose reach is unresolved. The second group is where the open questions, and the evidence burden, concentrate.

The six collision points

What is settled

"Settled" here means settled in the text. Apart from s.38, the DPDP provisions below commence on 13 May 2027 (computed).

• The DPDP Act says it is "in addition to and not in derogation of any other law", and that in a conflict the Act "shall prevail to the extent of such conflict". Section 38 has been in force since 13 November 2025.
• From 13 May 2027 (computed), the erasure duty in s.8(7) yields where "retention is necessary for compliance with any law". The erasure right in s.12(3) yields where retention is necessary "for the specified purpose or for compliance with any law".
• Section 17(1) exemptions, which commence on 13 May 2027 (computed), keep s.8(1) and s.8(5), so the fiduciary stays responsible for its processors and for reasonable security safeguards.
• PMLA keeps transaction records five years from the date of transaction and identity records five years after the relationship ends or the account closes, whichever is later secondary]. The [FIU-IND FAQ states the same two periods.
• The CIC Regulations require credit institutions to retain credit information for a minimum period of seven years.
• The Rule 8(1) automatic-erasure clock, which commences on 13 May 2027 (computed), applies only to the three classes in the Third Schedule (large e-commerce, online gaming and social media intermediaries). No banking, NBFC or lending class is listed.

What is open

• Whether fraud prevention by a private lender fits any Section 7 clause. King Stubb & Kasiva writes [secondary] that it may; the text does not name it.
• Whether routine fraud screening, as distinct from a specific suspected offence, falls within s.17(1)(c).
• The DPDP basis for the DPIP Smart Registry, FRI and Suspect Registry data flows.
• Retention periods for fraud case files and flags, V-CIP recordings, and consent records held by a Data Fiduciary.
• The final text of the DRAFT KYC Amendment Directions, 2026 [secondary], which remain open for comment.
• The primary text of the RBI Responsible Business Conduct Fourth Amendment Directions, 2026 [secondary]. They were issued on 6 August 2026 and take effect on 1 January 2027, but the sources cited report their provisions without reproducing RBI's text, and the two reports differ on call-recording retention.

Before 13 May 2027 (computed)

The dates that shape the runway:

In January 2026 MeitY discussed cutting the eighteen-month window to twelve secondary]. A VARINDIA report of 31 August 2026 [quotes MeitY Secretary S. Krishnan as saying "the notified deadlines would remain unchanged" [secondary]. This paper uses the computed dates above.

Penalties under the Schedule to the Act run up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to give breach intimation, and up to ₹50 crore for breach of any other provision. Under Section 33(2) the Board will weigh, among other factors, the nature, gravity and duration of a breach and the timeliness and effectiveness of mitigation.

Read against those dates, the work this paper points to before 13 May 2027 (computed) is threefold: a legal-basis register that names the provision behind each fraud-related data use (Section 5.1), processor contracts that carry both the DPDP and RBI clauses (Scenario f), and a retention map that separates data held under a legal duty from data held on consent alone (Appendix A). Section 6 lists the sourced items.

The DPDP Act and RBI's fraud framework pull the same customer record in opposite directions on four axes.

Three shared-intelligence layers add to the right-hand column. RBI in June 2025 advised banks to integrate DoT's Financial Fraud Risk Indicator secondary], which rates mobile numbers Medium, High or Very High risk using NCRP data, DoT's Chakshu platform, data shared by banks and financial institutions, and the Mobile Number Revocation List. I4C's [Suspect Registry, launched on 10 September 2024 "in collaboration with Banks/Financial Institutions" according to a reported Lok Sabha reply secondary], holds cyber-criminal identifiers. The [DPIP Smart Registry went live on 1 September 2026 with eight banks sharing data "in the salted and hashed form" [secondary]. The MediaNama report of the launch does not discuss the DPDP Act or a legal basis for the sharing.

The Act's own definitions put all of this activity inside its scope. "Processing" expressly includes collection, storage, retrieval, use, "alignment or combination", sharing, disclosure by transmission, restriction and erasure. A fraud team that matches an applicant against a registry, stores a red flag, or restricts an account is processing personal data on the Act's terms.

Section 38 governs the overlap in two sentences. The Act applies "in addition to and not in derogation of any other law", and in a conflict it "shall prevail to the extent of such conflict". The carve-outs in s.6(6), s.8(7) and s.12(3), discussed in Section 3, are where the text itself defers to other law. Whether a given RBI rule is accommodated by a carve-out or overridden under s.38(2) is a question the cited sources do not settle, so this paper works through the interaction provision by provision.

Every DPDP provision in this section, except s.38, commences on the eighteen-month date, 13 May 2027 (computed). Where the text below says a provision "provides" or "reads", it describes the enacted text; the duties it describes apply from that date.

Section 4(1) permits processing only "for a lawful purpose,: (a) for which the Data Principal has given her consent; or (b) for certain legitimate uses", and s.4(2) defines "lawful purpose" as "any purpose which is not expressly forbidden by law". Section 17 then takes certain processing outside most of the Act. A lender therefore has three DPDP routes, plus the deference the Act gives to duties under other law.

3.1 Consent

What it covers. Any purpose the customer agrees to, provided the consent is "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and limited to data necessary for the specified purpose (s.6(1)). A notice under s.5(1) must accompany or precede the request, and Rule 3 will require it to give "an itemised description of such personal data" and the specified purpose.

What it does not cover. Data beyond what the purpose needs. The statutory illustration to s.6(1) treats a phone contact list as unnecessary for a telemedicine service, so consent does not extend to it. Consent also cannot switch off RBI's own limits: Digital Lending para 12(i) bars digital lending apps from accessing file and media, contact lists, call logs and telephony functions whatever the borrower agrees to.

Risk to avoid. Consent is revocable. The customer may withdraw it at any time, with comparable ease (s.6(4)), after which the fiduciary must "cease and cause its Data Processors to cease processing" unless other law requires or authorises it (s.6(6)). In a proceeding the fiduciary carries the burden of proving that notice was given and consent obtained (s.6(10)). A fraud control that needs to survive the customer's objection sits uneasily on a basis the customer can withdraw.

3.2 Section 7 "legitimate uses"

Section 7 opens: "A Data Fiduciary may process personal data of a Data Principal for any of following uses, namely:: ". The clauses closest to a lender's work read, verbatim:

• (a) "for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data";
• (d) "for fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force";
• (e) "for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India";
• (i) "for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee."

The remaining clauses cover State subsidies and benefits, State functions, medical emergencies, epidemics and disasters.

No clause names fraud prevention. None of the nine clauses uses the words "fraud", "money laundering", "credit" or "risk". Clause (i)'s "safeguarding the employer from loss or liability" is framed around employment and employees. The s.7(a) illustrations describe a pharmacy sending a receipt to a customer who gave her number, and a broker who "shall cease to process" data once the individual says she no longer needs help; both tie processing to the purpose for which data was volunteered.

Readings that place fraud prevention in s.7 are commentary. King Stubb & Kasiva writes secondary] that activities such as fraud prevention may qualify as legitimate uses, but that NBFCs "should treat this basis as narrow, fact-specific, and litigation-prone, particularly if used to justify intrusive collections or broad third-party disclosures". CMS IndusLaw's [sector FAQ [secondary] lists "fraud monitoring" among bank processing purposes without assigning it a statutory basis. This paper found no statement from RBI, MeitY or the Data Protection Board on DPDP and fraud prevention specifically as at September 2026, and takes no position on whether s.7 covers it.

What it covers. On its words, s.7(d) covers disclosure obligations owed to the State under other law, and s.7(e) covers compliance with judgments, decrees and orders.

What it does not cover. Any use outside the nine listed clauses. The opening words permit processing "for any of following uses", and the uses are those enumerated.

Reading to avoid. Treating "fraud prevention" as a self-evident s.7 use without naming the clause. King Stubb & Kasiva's own example is a lender that collects contact-list permissions "for fraud prevention" at onboarding and later uses them for collections, which the firm calls "purpose drift + unlawful disclosure + privacy intrusion" [secondary].

3.3 Section 17(1)(c), and what it does not exempt

Section 17(1) opens: "The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where: ". Three of its clauses matter to lenders:

• (a) "the processing of personal data is necessary for enforcing any legal right or claim";
• (c) "personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India";
• (f) processing "for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution", subject to the disclosure provisions of other law.

What it covers. Where s.17(1) applies, the text lists as not applying: the s.4 grounds, s.5 notice, s.6 consent, s.7, the rest of s.8 (including s.8(6) breach intimation and s.8(7) erasure), ss.9-10, all of Chapter III (rights, ss.11-15) and s.16.

What it does not exempt. Two duties survive: s.8(1), under which the fiduciary is responsible "irrespective of any agreement to the contrary" for processing done on its behalf by a processor, and s.8(5), the duty to take reasonable security safeguards to prevent a personal data breach. The Government can also switch off further provisions by notification: under s.17(5) the Government may, within five years of commencement, declare by notification that any provision shall not apply to specified fiduciaries for a specified period, and under s.17(3) it may, "having regard to the volume and nature of personal data processed", notify fiduciaries or classes, including startups, to which s.5, s.8(3), s.8(7), s.10 and s.11 shall not apply.

What is open. No authoritative source was found on three questions: whether a lender's routine fraud screening, as distinct from processing tied to a specific suspected offence, is processing "in the interest of prevention, detection" of an offence; how "contravention of any law" is to be read; and whether s.8(6) breach intimation should still be honoured for s.17(1) processing, given that the literal list excludes it.

Reading to avoid. Treating s.17(1)(c) as a blanket exemption for the fraud function. The clause is framed around processing "in the interest of" an offence-related purpose, and the processor and security duties travel with it regardless.

3.4 Section 11(2): the written-request carve-out

Section 11(1)(b) gives a Data Principal who consented (including under s.7(a)) the right to obtain "the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared". Section 11(2) reads, verbatim:

"Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences." (s.11(2))

What it covers. Sharing with another Data Fiduciary authorised by law to obtain the data, made on that fiduciary's written request for the prevention, detection or investigation of offences or cyber incidents, or the prosecution or punishment of offences. For that sharing, the customer's s.11(1)(b) and (c) rights do not apply. Its conditions are cumulative: the recipient is authorised by law to obtain the data, the request is in writing, and the purpose is the stated one.

What it does not cover. It lifts only s.11(1)(b) and (c). It does not touch the s.11(1)(a) summary of data processed, and it says nothing about sharing initiated by the lender without a written request.

Reading to avoid. Treating it as a basis for fraud-related sharing. It switches off two disclosure rights for qualifying sharing; the sharing itself needs its own basis. Whether it can operate alongside the s.17(1)(c) exemption, which already lists Chapter III as not applying, is an open question.

3.5 Duties under other law

What it covers. Three DPDP provisions defer to other law, each in different words:

The s.12(3) carve-out includes "necessary for the specified purpose"; the s.8(7) carve-out names only compliance with law. Section 6(6) alone reaches processing that other law "authorised" as well as "required".

The other-law duties this paper relies on are:

• PMLA s.12 secondary]. Every reporting entity must [maintain a record of all transactions so as to enable reconstruction of individual transactions, furnish prescribed information to the Director, and maintain identity records, account files and business correspondence. Transaction records are kept five years from the date of transaction; identity records five years after the relationship ends or the account closes, whichever is later. Information maintained, furnished or verified "shall be kept confidential", subject to law.
• Suspicious transaction reports. FIU-IND's FAQ states that the Principal Officer shall furnish them "promptly and not later than seven working days on being satisfied that the transaction is suspicious".
• RBI's Fraud Risk Management Master Directions (RBI/DOS/2024-25/118, 15 July 2024, for commercial banks and AIFIs; parallel directions for co-operative banks and for NBFCs were issued the same day). They require CFR use, CPFIR reporting, a Fraud Monitoring Return within 14 days of classification, and reporting to law enforcement by amount threshold.
• CIC Regulations, 2006 (G.S.R. 754(E), 14 December 2006). Regulation 9 permits specified users to obtain credit information to, among other things, "deter concurrent borrowers and serial defaulters" and "review and evaluate risk of its customers".
• RBI KYC Directions. The Reserve Bank of India (Commercial Banks - Know Your Customer) Directions, 2025, RBI/DOR/2025-26/169, dated 28 November 2025 and shown as updated on 18 September 2026, replaced the 2016 Master Direction secondary]. A secondary source states that their record-management chapter keeps identity records [at least five years after the relationship ends and transaction records five years from the transaction [secondary].

What it does not cover. The carve-outs reach only as far as the other law does. CMS IndusLaw's FAQ reads the position this way: a bank or NBFC "must always apply the longer retention period" where sectoral law mandates it, and data retained under sectoral legislation "must be used exclusively to fulfil the legal obligation arising out of the same" [secondary].

Reading to avoid. Treating the s.8(7) Illustration as a retention period. It describes a bank that is "required by law applicable to banks to maintain the record of the identity of its clients for a period of ten years beyond closing of accounts". That figure belongs to a statutory illustration. The periods in PMLA s.12(4) secondary] and in the 2025 KYC Directions as reported by [a secondary source [secondary] are five years after the relationship ends. The Illustration is not a source for a ten-year retention period.

3.6 The bases side by side

Each scenario follows the same order: the situation, what DPDP pulls toward, what sectoral rules pull toward, what is settled, what is open, a defensible position, and the evidence to keep. DPDP duties referred to below apply from 13 May 2027 (computed) unless stated otherwise. The defensible positions in each scenario and the analysis in Section 4(g) are this paper's reading of the cited provisions, not statements of settled law, and need counsel review before use. The same applies to the executive summary's central reading and to the "Risk to avoid" and "Reading to avoid" passages and column in Section 3.

4(a) Fraud consortium data, negative lists and shared registries

The situation. A lender both draws on and feeds shared fraud intelligence: RBI's Central Fraud Registry and CPFIR, red-flag reporting through CRILC, credit bureaus, and newer layers such as the FRI secondary], the [Suspect Registry secondary] and the [DPIP Smart Registry [secondary].

What DPDP pulls toward. Transparency about recipients and accuracy of what is shared. A consenting customer may ask for the identities of every fiduciary and processor that received her data (s.11(1)(b)). Where data is likely to be "used to make a decision that affects the Data Principal" or disclosed to another fiduciary, the fiduciary must ensure its "completeness, accuracy and consistency" (s.8(3)).

What sectoral rules pull toward. Mandatory sharing and long memory. Under the FRM Master Directions:

RBI's July 2024 press release says the Directions incorporate the Supreme Court's judgment of 27 March 2023 in State Bank of India v. Rajesh Agarwal and require compliance with natural justice "in a time-bound manner". The CIC Regulations add permitted purposes and duties: credit information may be used to "deter concurrent borrowers and serial defaulters"; it must be kept "accurate and complete"; and a lender that denies credit on a report must, within thirty days, give the borrower written reasons and a copy of the report. Digital Lending para 16(i) requires every loan made through a digital lending app to be reported to CICs "irrespective of its nature/ tenor".

What is settled. The RBI reporting and CFR-use duties are written into the FRM MD. The CIC permitted purposes and accuracy duties are in regulations 9 and 10. The s.11(2) text lifts the recipient-disclosure right only for sharing with a Data Fiduciary authorised by law, on its written request, for an offence or cyber-incident purpose.

What is open. No public statement was found on the DPDP legal basis for the DPIP, FRI or Suspect Registry flows, and the MediaNama report on the DPIP launch secondary] does not discuss one. This paper does not infer that these flows rely on s.17(1)(c) or s.7. The reach of [s.17(1)(c) over routine screening against a negative list is also open. The FRI integration rests on an RBI advisory of 30 June 2025 whose instrument number is not recorded in the sources cited [secondary].

A defensible position. One position consistent with the cited text is to split shared-intelligence flows into two groups. Flows that an RBI paragraph mandates (CFR use, CPFIR and FMR reporting, CRILC red-flag reporting, CIC reporting) can be recorded against that paragraph as a duty under other law. Flows with no mandating paragraph, such as participation in a registry on commercial terms, can be recorded with their basis marked open until a regulator or the Board speaks. The FRM MD's show-cause, response and reasoned-order steps also appear to serve the s.8(3) accuracy duty for a fraud classification that will be shared, though s.8(3) is among the provisions s.17(1) lists as not applying where that exemption is relied on.

Evidence to keep.

• The show cause notice, the date the response window opened and closed, and the reasoned order for each fraud classification.
• FMR submission dates against the 14-day clock and CRILC red-flag reporting dates against the seven-day clock.
• A recipient log per customer: which registry, bureau or authority received what, and under which paragraph, to answer an s.11(1)(b) request.
• Written requests received from a Data Fiduciary authorised by law, to evidence the s.11(2) conditions.
• CIC adverse-action intimations sent within thirty days.

4(b) Device, behavioural and location signals at onboarding

The situation. A lender collects signals at onboarding to check that the applicant is real, present and in India: camera, microphone and location through a digital lending app, and video KYC.

What DPDP pulls toward. Minimum necessary data, itemised in advance. Consent is limited to data "necessary for such specified purpose", and the Rule 3 notice must be understandable independently of other information and give "an itemised description of such personal data".

What sectoral rules pull toward. RBI both restricts and requires signals. Digital Lending para 12(i), verbatim:

Paras 12(ii)-(iv) give the borrower an option to give or deny consent for specific data, restrict third-party disclosure, revoke consent and have data deleted, and require the purpose to be disclosed "at each stage of interface". Para 13(iii) provides that "No biometric data is stored/ collected by the RE and LSP, unless allowed under extant statutory guidelines". On the requiring side, the KYC Directions 2025, para 27 (Commercial Banks version), require V-CIP recordings to carry "the live GPS co-ordinates (geo-tagging) of the customer", block connections "from IP addresses outside India or from spoofed IP addresses", and use "face liveness / spoof detection as well as face matching technology". Para 24 (Commercial Banks version) requires the digital KYC image to carry a watermark with GPS coordinates, the official's name and code, and a time stamp.

What is settled. The para 12(i) device-resource prohibition and one-time access rule; the V-CIP geo-tagging, IP-origin and liveness requirements; the s.6(1) necessity limit.

What is open. This paper found no RBI provision addressing behavioural biometrics, device fingerprinting or SIM or device binding at onboarding beyond DL para 12 and the V-CIP rules, and does not state that RBI permits or prohibits behavioural analytics generally. Whether signals collected for routine screening fall within s.17(1)(c) is the same open question as in 4(a).

A defensible position. Read together, DL para 12(i) and the KYC Directions paras 24 and 27 (Commercial Banks version) suggest a three-way sort. Signals the KYC Directions require (V-CIP geo-tag, IP origin, liveness) can be recorded as KYC-direction requirements. Resources para 12(i) bars (file and media, contacts, call logs, telephony) stay off, whatever basis is claimed. Everything else, including any behavioural or device signal, needs its own recorded basis, and for a consent basis the Rule 3 itemised notice will have to name it. Keeping the fraud purpose separate in the notice guards against the purpose-drift pattern King Stubb & Kasiva describes [secondary].

Evidence to keep.

• The DLA consent audit trail required by para 12(i).
• Notice versions itemising each signal and purpose, per Rule 3.
• V-CIP recordings and the activity log with the official's credentials, stored in India.
• The privacy policy disclosing third parties allowed to collect data through the app (DL para 14).

4(c) Mule accounts and RBI's proposed 60-day temporary debit hold (DRAFT)

The situation. On 4 August 2026, as reported by Bar & Bench, a Supreme Court bench directed RBI "to prepare a standard operating procedure (SOP) within four weeks for dealing with mule accounts" secondary]. RBI then released the DRAFT Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 ([press release 2026-2027/1109, 12 September 2026, per TaxGuru's reproduction) secondary]. AK & Partners [confirms the draft was issued pursuant to that order [secondary].

The DRAFT, as reproduced by TaxGuru [secondary]:

What DPDP pulls toward. Accuracy and transparency for a decision that affects the customer: the s.8(3) duty for data used in such a decision, and the s.11(1)(b) right to learn which fiduciaries received the data, subject to s.11(2) for written requests from a Data Fiduciary authorised by law. Where s.17(1)(c) applies, both are listed as not applying.

What sectoral rules pull toward. Speed and sharing. Beyond the DRAFT, the FRM MD already requires CFR use and CPFIR reporting, and the Suspect Registry secondary] and [FRI secondary] already circulate mule-linked identifiers. According to [Business Today [secondary], institutions can use the FRI to block suspicious transactions, issue customer alerts, or delay transactions pending verification.

What is settled. The Supreme Court's direction (as reported) [secondary]; the FRM MD reporting duties; the existence of the DRAFT and its comment date [secondary].

What is open. The final text of the DRAFT KYC Amendment Directions, 2026. RBI's own text of the press release and the DRAFT was not retrieved; the details above rest on TaxGuru's reproduction and AK & Partners [secondary]. Every element in the table above may change after comments close on 2 October 2026. The DPDP basis for the Suspect Registry and FRI flows is open, as in 4(a).

A defensible position. The DRAFT, as reported, builds a hearing into the hold: notice to the account holder, 20 days to explain, and a decision by day 30. The FRM MD builds a comparable sequence into fraud classification: show cause notice, at least 21 days, reasoned order. This suggests that a bank preparing for the DRAFT can reuse the record-keeping discipline it already runs for fraud classification, and that the same records would also answer an s.8(3) accuracy question where s.17(1)(c) is not relied on. Any design work done before the final text is issued prepares for a DRAFT that is not in force and may change.

Evidence to keep (if the DRAFT is finalised in its reported form).

• The flag that triggered the hold and the transaction value against the reported ₹1,000 threshold.
• The date the hold was notified, the customer's explanation, and the day-30 decision.
• The NCRP-CFCFRMS reference for any report to police.
• The date any hold ended, against the reported 60-day maximum.

4(d) An erasure or consent-withdrawal request from a customer under a fraud flag

The situation. A customer whose account is red-flagged, or who has been through fraud classification, withdraws consent or asks for erasure.

What DPDP pulls toward. Stopping and deleting. On withdrawal, the fiduciary must cease processing and cause its processors to cease (s.6(6)). The s.8(7) duty is to erase on withdrawal or once the purpose is no longer served, whichever is earlier, and to cause processors to erase. On a request, s.12(3) requires erasure. The fiduciary must publish a grievance response period "not exceeding ninety days" (Rule 14(3)), and the customer must exhaust that grievance route before approaching the Board (s.13(3)). For digital loans, RBI already lets a borrower go to the RB-Integrated Ombudsman if a complaint is rejected or unanswered within 30 days (DL para 11(iv)).

What sectoral rules pull toward. Keeping the record, on several clocks at once:

What is settled. The wording of the three carve-outs: s.8(7) yields to compliance with any law; s.12(3) yields to the specified purpose or compliance with any law; s.6(6) yields where processing is "required or authorised" by other law. Where s.17(1)(a) or (c) applies, Chapter III, including s.12, is listed as not applying. The Rule 8(1) automatic-erasure clock does not reach lenders, because the Third Schedule lists no banking, NBFC or lending class. Rule 8(3) will require personal data, traffic data and processing logs to be retained "for a minimum period of one year from the date of such processing, for the purposes as specified in the Seventh Schedule".

What is open. The FRM text sets no retention period for fraud case files or flags, and this paper found no DPDP provision addressing fraud-flag retention specifically. The reach of s.17(1)(c) is open, as in 4(a). No source was found applying the s.17(1)(a) legal-claims exemption to SARFAESI or DRT proceedings. Whether Rule 8(3)'s one-year floor is a general minimum or limited to the Seventh Schedule purposes (State uses and SDF assessment) is interpretive. How a response to the customer is framed alongside PMLA's requirement that information be "kept confidential" [secondary] is a question for counsel.

A defensible position. One reading consistent with the carve-out texts is to answer the request data category by data category. Records under a named retention duty (PMLA records, credit information under the CIC Regulations, fraud-case details kept for auditors) can be retained with the provision recorded against each category. On this reading, data held on consent alone, with no duty behind it, would fall to be erased or stopped, subject to two qualifications: s.12(3) also permits retention "necessary for the specified purpose", and where s.17(1)(c) applies, s.8(7) is listed as not applying. Under CMS IndusLaw's reading [secondary], retained data is then used only for the legal obligation it is retained for. The practical implication is that each retained record needs a named paragraph behind it, because the FRM text sets no period for the flag itself.

Evidence to keep.

• The request, the Rule 14(5) identifier used to match it (for example a customer identification file number or application reference number), and the response date against the published period.
• For each category retained, the provision relied on (from Appendix A).
• For each category erased, the instruction sent to processors under s.8(7)(b).
• The FRM classification file, including the date of full repayment where the debarment clock runs from it.

4(e) Collections: third-party contacts, references, guarantors and skip tracing

The situation. A borrower defaults and the lender, or its recovery agent, tries to reach the borrower through references, guarantors, relatives or alternate numbers.

What DPDP pulls toward. A narrow exemption for the defaulter only. Section 17(1)(f) covers processing to ascertain "the financial information and assets and liabilities of any person who has defaulted", subject to the disclosure provisions of other law. Its text does not mention references, relatives or other third parties. On a literal reading, data about those third parties falls back on the ordinary grounds in s.4, including the s.6(1) necessity limit where consent is relied on.

What sectoral rules pull toward. Tight conduct limits. RBI's circular RBI/2022-23/108, DOR.ORG.REC.65/21.04.158/2022-23 of 12 August 2022, para 2, verbatim:

The same circular places "the ultimate responsibility for their outsourced activities" on the regulated entity. Digital Lending para 8(v) requires the recovery agent's particulars to be sent to the borrower by email or SMS before the agent makes contact, and para 12(i) already bars apps from contact lists and call logs. Under the Managing Risks in Outsourcing Directions, 2025, para 17 [secondary], the bank is responsible for its recovery agents' actions and for "the confidentiality of information pertaining to the customers that is available with the service provider".

From 1 January 2027, the RBI Responsible Business Conduct Fourth Amendment Directions, 2026 secondary], issued as nine circulars dated 6 August 2026 whose reference numbers are not recorded in the sources cited, add the following as [reported by TaxUpdate India and Agrud Partners:

What is settled. The 2022 circular's conduct rules and responsibility allocation; DL paras 8(v) and 12(i); the text of s.17(1)(f).

What is open. The primary text of the Fourth Amendment Directions is not reproduced in the sources cited. The two secondary reports differ on whether call-recording retention runs to the end of litigation, and the final wording on relatives and referees is unconfirmed. This paper found no DPDP or Digital Lending provision setting a retention period for collections call recordings.

A defensible position. Taking s.17(1)(f) at its words, it reaches the defaulter's own financial information, assets and liabilities, and no further. A reading consistent with the text is that each reference, guarantor or alternate contact needs a recorded basis of its own, and that device-sourced contact data is already off-limits for apps under DL para 12(i) and, from 1 January 2027 per the secondary reports, for recovery under the Fourth Amendment Directions. This suggests that skip tracing through data on a borrower's device finds no support in the RBI texts cited.

Evidence to keep.

• The email or SMS sending the agent's particulars before first contact.
• Call logs showing contact times within the 8:00 a.m. to 7:00 p.m. window.
• Call recordings, kept for at least six months from 1 January 2027 on the secondary reports [secondary].
• For each third-party number held, where it came from and the basis recorded for it.

4(f) Fraud and KYC vendors as data processors

The situation. A lender uses vendors for KYC checks, fraud scoring, video KYC and collections technology. Under the Act a Data Processor processes "on behalf of a Data Fiduciary", and the lender remains the fiduciary.

What DPDP pulls toward. Fiduciary liability that no contract can shift. Section 8(1) makes the fiduciary responsible "irrespective of any agreement to the contrary" for processing by its processors. Section 8(2) permits engaging a processor "only under a valid contract". Section 8(5) extends security safeguards to processor processing. Rule 6(1)(f) will require "appropriate provision in the contract" for reasonable security safeguards, and the Rule 8(3) illustration says a fiduciary using a cloud processor must ensure the processor "also retains the data and associated logs for at least one year before erasure". A customer can learn the identity of every processor her data went to (s.11(1)(b)).

What sectoral rules pull toward. Detailed contracts, audit and inspection rights, and fast incident reporting:

The Outsourcing Directions (RBI/DOR/2025-26/171, DOR.ORG.REC.No.90/21-04-158/2025-26, 28 November 2025) [secondary] state that outsourcing "does not diminish" the bank's obligations. Their Chapter IV covers IT outsourcing and para 95 repeals the earlier guidelines.

Incident clocks run in parallel:

What is settled. The DPDP processor provisions and the RBI and CERT-In texts above. Fiduciary liability for processors and the security duty are the two duties s.17(1) keeps even when an exemption applies.

What is open. Only the Commercial Banks version of the Outsourcing Directions is cited here; NBFC and other versions are not compared. Whether the Digital Lending Directions have been folded into entity-wise directions after 28 November 2025 is unconfirmed. Whether s.8(6) breach intimation applies to processing done under s.17(1) is open, as noted in Section 3.3. RBI's Advisory No. 3/2026 of 25 March 2026 is reported to cover third-party risk management and data retention and destruction, but it is described as non-binding and its primary text is not reproduced in the source cited [secondary].

A defensible position. Read together, the DPDP and RBI texts point to one contract per vendor carrying both sets of clauses: the s.8(2) valid contract and Rule 6(1)(f) security clause; the para 34 audit, inspection and subcontracting clauses; an erasure and cease-processing instruction path for s.8(7)(b) and s.6(6); the Rule 8(3) one-year log retention; and incident notice fast enough for the six-hour RBI and CERT-In routes. Because s.8(1) survives every s.17(1) exemption, the vendor contract carries weight whichever legal basis the underlying fraud processing rests on.

Evidence to keep.

• Executed contracts with the clause map above.
• The enhanced due diligence record for each LSP.
• Subcontractor approvals under para 34(iv) [secondary].
• Incident timelines showing detection, RBI, CERT-In, Board and customer notification times.
• ICT logs kept for a rolling 180 days in India and processing logs kept for at least one year.

4(g) Reading the six scenarios together

This subsection is analysis. Each point rearranges provisions cited in scenarios (a) to (f); none adds a new fact.

The collision is uneven, and it follows the source of the duty. In scenarios (a), (d) and (f), the cited texts name a duty behind the core data flows: RBI paragraphs mandate CFR use, CPFIR and FMR reporting, PMLA and the CIC Regulations set retention floors, and s.6(6), s.8(7) and s.12(3) defer to other law on consent withdrawal and erasure. Those carve-outs reach only withdrawal and erasure. Beyond them, whether a given RBI rule is accommodated or overridden under s.38(2) is the open question noted in Section 2. In scenarios (b) and (e), and in the registry flows of (a) that no RBI paragraph mandates, the control rests on the lender's own choice. There the DPDP routes are consent, which the customer can withdraw, or s.17(1)(c), whose reach over routine screening is unresolved. Read together, these suggest that a lender's DPDP questions in fraud work are most open in the discretionary layer. In the mandated layer the other-law duty is written down, but its interaction with the DPDP Act outside the carve-outs is not settled in the sources cited, so each flow needs the paragraph relied on recorded and the s.38(2) question put to counsel.

Two duties survive every route. Whatever basis a lender records, s.8(1) responsibility for processors and s.8(5) security safeguards remain in place under s.17(1), and the Schedule attaches the largest penalty, up to ₹250 crore, to the security safeguard. The practical implication is that the vendor contract and security work in scenario (f) is the one workstream whose value does not depend on how the open legal-basis questions are eventually answered.

RBI's process records already do part of the DPDP evidence job. The FRM MD's show cause notice, 21-day window and reasoned order, and the DRAFT debit hold's notice, 20-day explanation and day-30 decision secondary], both produce a record of what the institution knew and when it decided. Section 8(3) asks for completeness and accuracy where data drives a decision affecting the customer, and s.33(2) lists [mitigation and its timeliness among the factors the Board will weigh. This suggests the same files can serve both regimes if they are kept with that dual use in mind.

Three changes share the runway. The RBI Responsible Business Conduct Fourth Amendment Directions take effect on 1 January 2027 secondary]; the DRAFT debit hold is proposed for 1 April 2027 [secondary]; the eighteen-month DPDP tranche commences on 13 May 2027 (computed). As this paper's forecast, and only if the DRAFT is finalised on its proposed date, an institution that sequences the three together could work through overlapping files once rather than separately: customer notices, which both the [DRAFT debit hold secondary] and the DPDP [Rule 3 notice touch; call recordings and borrower device data, which the Fourth Amendment reportedly covers secondary], and for which Appendix A maps [Rule 8(3) in its own words, retention "for a minimum period of one year from the date of such processing, for the purposes as specified in the Seventh Schedule", although whether that floor reaches beyond the Seventh Schedule purposes is still unsettled (see 4(d)); and processor contracts, which DPDP s.8(2) requires to be a valid contract and for which the Outsourcing Directions, para 17 (Commercial Banks version) [secondary] make the bank responsible for its recovery agents and for "the confidentiality of information pertaining to the customers that is available with the service provider".

Where the open questions may close. Section 17(5) lets the Government exempt specified fiduciaries by notification for a specified period within five years of commencement, and the Board will decide inquiries once it is staffed and its inquiry powers commence on 13 May 2027 (computed). As a hypothesis only: the s.7 and s.17(1)(c) questions are the kind a notification or an early Board decision could settle.

5.1 The legal-basis register

A register records, for each fraud-related data use, the basis relied on and the text behind it. The rows below are illustrative, built only from the provisions cited in this paper; the "status" column is this paper's reading. The DPDP provisions in the register commence on 13 May 2027 (computed); the RBI, PMLA and CIC texts are cited as they stand. "Duty under other law" is not one of the two s.4(1) grounds (consent and legitimate uses). Rows using it record the other-law mandate, and their status separates that mandate from how the DPDP Act characterises the processing, on which no regulator statement was found as at September 2026.

5.2 Questions for the DPO or the board

A DPO is a statutory appointment for a Significant Data Fiduciary. Under s.10(2), from 13 May 2027 (computed), an SDF will appoint a DPO based in India who is "responsible to the Board of Directors or similar governing body", appoint an independent data auditor, and carry out periodic DPIAs; Rule 13 requires a DPIA and audit once in every twelve months and adds a due-diligence duty on "algorithmic software". No official list of designated SDFs was found in the sources reviewed as at September 2026. Every fiduciary will need to publish the contact details of a DPO or of a person able to answer processing questions (s.8(9), Rule 9).

Questions that trace to the provisions above:

1. For each row of the legal-basis register, which paragraph or section is recorded, and which rows are marked open?
2. Where the institution relies on s.17(1)(c), is the processing tied to a specific suspected offence or to routine screening, and has counsel given a view on that distinction?
3. Does every fraud and KYC vendor contract carry the s.8(2) and Rule 6(1)(f) clauses alongside the para 34 [secondary] clauses of the Outsourcing Directions (Commercial Banks version), or the equivalent clauses in the version that applies to the institution?
4. Can the institution answer an s.11(1)(b) request naming every fiduciary and processor that received a customer's data?
5. For an erasure request from a red-flagged customer, is there a written route that decides category by category which data is retained and under which provision?
6. Is the published grievance period within the ninety-day ceiling, and how does it sit next to RBI's 30-day ombudsman trigger for digital loans?
7. Can incident response meet the six-hour RBI secondary] (Outsourcing Directions, Commercial Banks version) and [CERT-In routes and the Rule 7 Board and customer intimations from one incident record?
8. Who tracks the DRAFT KYC Amendment Directions, 2026 [secondary] after comments close on 2 October 2026, and the Fourth Amendment Directions [secondary] before 1 January 2027?

5.3 What to keep for a Data Protection Board inquiry

The Board is established in law and, as at LiveLaw's report of 1 August 2026 [secondary], not yet staffed with a Chairperson or Members. Its inquiry powers commence at eighteen months, 13 May 2027 (computed).

Once in force, an inquiry can start from a breach intimation under s.8(6), a Data Principal's complaint, or a Government or court reference (s.27(1)). The Board will have civil-court powers including summoning, discovery, and "inspecting any data, book, document, register, books of account or any other document" (s.28(7)), and may issue interim orders. Rule 19(9), in force since publication, sets six months to complete an inquiry, extendable by up to three months at a time for recorded reasons.

From 13 May 2027 (computed), the Act and Rules will place specific evidence on the fiduciary:

To these, the scenario evidence lists above add the legal-basis register, the FRM classification files, the vendor contracts and the retention schedule mapped in Appendix A.

Every item below traces to a cited provision. The DPDP items are what the text will require when the eighteen-month tranche and Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027 (computed). The RBI and CERT-In items are already in force for the entities they cover unless marked DRAFT or dated. The Outsourcing Directions items are cited in their Commercial Banks version only; the NBFC and other versions are not compared in this paper.

DPDP Act and Rules (from 13 May 2027, computed)

• check_box_outline_blankNotices meeting Rule 3: itemised data, specified purpose, and the means to withdraw consent, exercise rights and complain to the Board.
• check_box_outline_blankReasonable security safeguards under Rule 6(1), including access logs and one-year retention of logs and personal data for breach detection.
• check_box_outline_blankBreach intimation routes to affected Data Principals and to the Board, "without delay" and within seventy-two hours, under Rule 7.
• check_box_outline_blankProcessing logs kept at least one year from processing under Rule 8(3), including for processor processing.
• check_box_outline_blankPublished contact details of a DPO or responsible person under Rule 9 and s.8(9).
• check_box_outline_blankA published grievance response period not exceeding ninety days under Rule 14(3), and a redress mechanism under s.8(10).
• check_box_outline_blankProcessor contracts that are a "valid contract" under s.8(2) with a security clause under Rule 6(1)(f).
• check_box_outline_blankIf notified as an SDF: DPO, independent data auditor and annual DPIA and audit under s.10(2) and Rule 13.
• check_box_outline_blankA recorded basis for each fraud-related data use, including any reliance on s.17(1) exemptions, which commence on the same date.

RBI and CERT-In (in force unless marked)

• check_box_outline_blankDLA data collection that is need-based with explicit consent and an audit trail (DL para 12(i)).
• check_box_outline_blankPublished policy on data stored, storage period, use restrictions, destruction protocol and breach handling (DL para 13(ii)).
• check_box_outline_blankPrivacy policy naming third parties allowed to collect data through the app (DL para 14).
• check_box_outline_blankOutsourcing agreements carrying the para 34 clauses [secondary] (Commercial Banks version).
• check_box_outline_blankSix-hour incident routes to RBI secondary] (Outsourcing Directions, Commercial Banks version) and [CERT-In, and ICT logs kept for a rolling 180 days in India.
• check_box_outline_blankCollections conduct changes for 1 January 2027 under the Fourth Amendment Directions [secondary], including call recording and preservation.
• check_box_outline_blankMonitoring of the DRAFT KYC Amendment Directions, 2026 secondary] through the [2 October 2026 comment close to a final text, ahead of the proposed 1 April 2027 date (DRAFT).

Earlier date

• check_box_outline_blank13 November 2026 (computed): Rule 4 Consent Manager registration and s.6(9) commence. A Consent Manager must keep consent records for at least seven years; that period applies to Consent Managers, and the Act and Rules text reviewed prescribes no consent-record period for Data Fiduciaries generally.

How to read this map. Each filled cell is hyperlinked to its source. "No provision found" means this paper found no provision in that regime setting a period for that category; no period is inferred. "Not mapped" means the regime was not mapped against that category in this appendix. [secondary] marks a cell resting on a secondary source. DPDP entries apply from 13 May 2027 (computed). The Rule 8(3) cells state the rule's text, a one-year minimum "for the purposes as specified in the Seventh Schedule"; whether it reaches beyond those purposes is unsettled (see 4(d)). Insurer entries are included for reference; the paper's audience is lenders, and RBI rules are not assumed to apply to insurers.

Notes to the map.

• The PMLA periods rest on a bare-act reproduction secondary], and the [FIU-IND FAQ states the same two periods.
• The KYC Directions 2025 retention periods rest on one secondary source, which gives the record-management paragraph as 50 for Commercial Banks, 47 for NBFCs and AIFIs, 49 for co-operative banks, RRBs, LABs and Payments Banks, and 51 for Small Finance Banks [secondary]. Verify against RBI's text before quoting paragraph numbers.
• The IRDAI 2025 Regulations (F. No. IRDAI/Reg/4/211/2025) repeal the 2015 Records Regulations and count the ten years "from the date of last transaction on the respective records, or from the date of expiry of the policy". The same report describes tiered claim-document retention of 3 to 12 years by claim amount [secondary].
• The SEBI master circular is dated 6 June 2024; its circular number is not recorded in the sources cited [secondary].
• The Income-tax Act, 2025 came into force on 1 April 2026, replacing the 1961 Act [secondary]; whether Rule 46(9) applies to all companies or only those within the s.62 thresholds is not confirmed.
• The s.8(7) Illustration's "ten years" is a statutory illustration and does not appear in this map as a retention period.

Bhanujeet Choudhary is Head of Compliance at KYCKART. This paper is analysis for information only and is not legal, regulatory, tax or compliance advice. It is current as at September 2026, and any position in it needs review by the institution's own counsel before it is relied on.