DPDP Consent Flows for Digital Lending Apps
RBI's Digital Lending Directions, 2025 now require lending apps to obtain valid consent under the Digital Personal Data Protection Act, 2023 before collecting, processing, or sharing borrower data. This tutorial walks product, engineering, and compliance teams through a deployable consent architecture.
Why consent is now a lending gate
Previously, broad privacy policy acceptance often sufficed at onboarding. Today, each data collection purpose needs a specific, informed consent with withdrawal mechanics. Non-compliance can trigger DPA penalties, RBI inspection findings, and app store delisting on CIMS grounds.
Step 1, Data inventory
1 Map every data element collected: device IDs, SMS parsing, bureau pulls, alternate data, location, contacts. Tag each with legal basis, retention period, and third-party recipients.
Step 2, Notice design
2 Publish a concise notice in English plus scheduled languages for target states. The notice must state: data fiduciary identity, DPO contact, purposes, retention, grievance rights, and cross-border transfers if any.
Avoid bundling unrelated purposes. Credit underwriting, marketing, and fraud analytics should be separate toggles defaulting to off where not essential.
Step 3, Consent capture UX
3 Implement granular consent screens before data flows activate. Log: timestamp, notice version, purpose IDs, channel, and user identifier. Store logs immutably for audit.
- Use clear affirmative action (no pre-ticked boxes)
- Link to purpose-specific summaries, not a 40-page policy
- Block SMS/bureau APIs until consent bitmap confirms purpose
Step 4, Purpose limitation in APIs
4 Encode purposes in your authorization layer. Microservices should reject calls when consent bitmap lacks the required purpose bit.
Step 5, Withdrawal flows
5 Provide in-app withdrawal equal to signup friction. On withdrawal: stop processing, notify processors, and delete data within statutory timelines unless retention is legally required.
Step 6, Offshore deletion (24-hour rule)
RBI Directions require deletion on offshore analytics or backup systems within 24 hours of receiving a deletion request or loan closure where retention no longer applies. Engineering must:
- Enumerate all cross-border replicas and SaaS subprocessors
- Automate deletion webhooks to CRM, LOS, and warehouse layers
- Verify deletion with signed confirmations stored in compliance vault
Checklist before launch: Notice version control · Consent logs · Purpose-tagged APIs · Withdrawal UI · Offshore deletion runbook · Grievance SLA under 30 days
Common failure modes
- Bureau pulls triggered at app install before KYC consent
- Marketing retargeting using loan rejection signals without separate consent
- Backup tapes retaining deleted borrower records beyond permitted windows
Need a DPDP gap review on your lending stack? Contact our data protection team.
This publication is for general information only and does not constitute legal advice. Regulatory positions evolve; verify current notifications and obtain counsel before acting. © 2026 SB Tech Associates.