The Reserve Bank of India issued comprehensive Digital Lending Guidelines in September 2022 to regulate the entire digital lending ecosystem, including banks, NBFCs, and their Lending Service Providers (LSPs). The framework mandates explicit customer consent for data access, prohibits storage of customer data by LSPs except as explicitly permitted, requires all loan disbursements and repayments to flow only through bank accounts of regulated entities, and establishes accountability for data breaches. These guidelines emerged after widespread complaints about predatory lending apps, unauthorized data harvesting, and customer harassment, creating a robust data protection regime specific to digital lending.

• Establishes clear accountability chain where regulated entities remain responsible for LSP actions, reducing customer grievances from third-party misconduct
• Prohibits LSPs from storing customer data on their systems beyond prescribed purposes, significantly reducing data breach and misuse risks
• Mandates Key Fact Statement (KFS) disclosure before loan disbursal ensuring transparency in pricing and preventing hidden charges that plagued digital lending
• Creates nodal grievance redressal officer requirement at regulated entities for digital lending complaints, improving customer protection mechanisms
• Requires all digital lending apps to be verified and disclosed on RBI and regulated entity websites, eliminating rogue lending applications

• Many fintech LSPs continue storing customer contact data and call recordings beyond permissible limits, claiming operational necessity without proper legal basis
• Weak implementation of consent architecture with several platforms still using pre-ticked consent boxes or bundled consents violating informed consent principles
• Inadequate verification of LSP compliance by regulated entities who rely on self-declarations rather than conducting independent data audits of third-party systems
• Limited enforcement against unauthorized lending apps continuing operations through app stores despite RBI directives, with new rogue apps replacing banned ones
• Absence of specific data localization and cross-border data transfer restrictions for LSPs, creating regulatory arbitrage opportunities for offshore service providers

• In January 2023, RBI imposed penalties on multiple NBFCs including Asirvad Micro Finance (₹1.77 crore) and Arohan Financial Services (₹1.05 crore) for violations related to outsourcing guidelines and inadequate supervision of LSPs handling customer data during digital lending operations.
• Google Play Store removed over 200 instant loan apps in 2022-23 following RBI and police complaints about illegal data harvesting, including accessing user photo galleries, contact lists, and call logs without explicit consent, with some apps morphing into new names to evade detection.
• Paytm Payments Bank faced RBI restrictions in January 2024 partly due to inadequacies in customer data handling and insufficient oversight of third-party service providers in its digital lending partnerships, highlighting systemic data governance failures.

• Implement real-time API-based consent management systems with granular, purpose-specific permissions allowing customers to view and revoke data access for specific LSPs at any time
• Conduct quarterly independent data audits of all LSP systems with forensic examination of data storage, access logs, and deletion protocols, publishing audit summaries for regulatory transparency
• Deploy technical controls including data masking, tokenization, and encryption-at-rest for all customer data shared with LSPs, with cryptographic key management retained by regulated entities only
• Establish automated monitoring systems to detect unauthorized app versions, phishing websites, and clone applications misusing brand names, with immediate takedown protocols coordinated with CERT-In and app stores