The borrower who could not find anyone to ask
A borrower wants to know why collection calls reached her family.
Day 1
A borrower at QuickRupee Finance, a fictional lender, misses one instalment.
Day 4
Her brother and her manager get calls about her loan. She never gave their numbers for that purpose.
Day 5
She looks for a privacy contact on the lender's website. There is only a sales number that puts her on hold.
Day 12
She emails the general inbox asking what data they hold and who they shared it with. No reply comes.
Day 35
She complains to the Data Protection Board. The lender has no record of the consent it relied on.
Day 50
The lender stops contact-list collections, publishes a grievance officer and answers her request, after the damage is done.
The Data Protection Board can impose a penalty up to the maximum the law sets for a breach like this. It weighs each case; nobody can predict the figure. See the penalty categories
What would have prevented it
- Publish a named grievance contact and answer requests within the time the Rules set.
- Use data only for the purpose the borrower agreed to, and keep proof of that consent.
- Give borrowers a simple way to ask what you hold and to correct or erase it.
Find out where your website stands
A free, read-only scan with plain-language findings you can act on.