KYC data is a liability until you guard it
Loan apps and lenders hold ID numbers, bank statements and contact lists. Borrowers now have rights over all of it, and a clear way to complain.
Scan your website
Read-only and free. Nothing on your site is changed.
The personal data you hold
- PAN, Aadhaar and other KYC documents
- Bank statements, salary slips and credit scores
- Phone numbers, addresses and references
- Device and location data from apps
- Repayment and collection records
Where businesses like yours slip
Trackers wait for consent
Marketing pixels on loan pages that fire before the visitor agrees.
Privacy notice covers the required items
A notice that does not say which partners, bureaus or collection agents receive borrower data.
A way for people to exercise their rights
No simple way for a borrower to ask for their data, correct it or ask for it to be erased.
Grievance officer contact published
No named contact or email for privacy complaints, separate from the general helpline.
A day without consent
Fictional scenario
The borrower who could not find anyone to ask
A borrower wants to know why collection calls reached her family.
Read the storyCommon questions
We already follow RBI rules. Is that enough?
RBI rules and the DPDP Act overlap but are not the same. The Act adds a plain notice, purpose-limited consent, borrower rights and breach reporting to the Data Protection Board.
Can we still use a borrower's contacts for collection?
Only for a purpose the borrower clearly agreed to or the law allows. Reaching contacts who never agreed creates real risk under the Act.
Who handles complaints?
You need a published contact for privacy questions and must answer complaints within the time the Rules set. If you do not, the borrower can go to the Board.
This page is general information, not legal advice.
Find out where your website stands
A free, read-only scan with plain-language findings you can act on.