Do NBFCs need consent for KYC and credit bureau reporting?

Generally no. KYC, PMLA record keeping and reporting to credit information companies are required by law, and the DPDP Act treats compliance with law as a legitimate use under Section 7. NBFCs still have to give a notice, and they need consent for purposes such as marketing and cross-sell.

What do RBI's Digital Lending Directions say about borrower data?

They require need-based collection with prior explicit consent and an audit trail. Lending apps may not access phone files, contacts or call logs. Camera, microphone or location can be accessed one time, only for onboarding and KYC. Borrowers get granular consent, including the option to ask for deletion.

How does SecureCMS handle consent from DSAs and lending partners?

SecureCMS captures OTP-verified consent on partner or DSA journeys through redirect or embedded consent flows, stores it against the borrower's record, and sends any later change to partners and internal systems through APIs and webhooks.

Can a borrower ask an NBFC to delete data after closing a loan?

Yes, but the NBFC can keep data a law requires, such as KYC and PMLA records held for five years after the relationship ends. The rest must be erased. SecureCMS logs which fields are kept, why, and until when.

How should NBFCs control data used by collection agencies?

Agencies should receive only the data needed to recover the loan from the borrower. SecureCMS applies purpose- and field-level access rules along with role-based access, so collections teams see only what their purpose allows, and every access is logged.

Is SecureCMS a registered Consent Manager?

No. SecureCMS is a consent management platform that NBFCs use as Data Fiduciaries. Registered Consent Managers are separate entities, registered with the Data Protection Board, and those provisions apply from 13 November 2026.

When do DPDP obligations apply to NBFCs?

The DPDP Rules were notified on 13 November 2025. Consent Manager provisions apply from 13 November 2026. The remaining obligations, including notice, consent, rights requests and breach reporting, apply from 13 May 2027.

RBI Digital Lending 2025 & DPDP Act HarmonizedZero Phone Scraping · Co-Lending · DSAs · LMS Connectors

LIVE

Core DPDP Enforcement:13 May 2027

207D

11H

45M

00S

Consent Management Platform for NBFCs in India

Q: What is a consent management platform for NBFCs?

It is software that records, verifies and enforces each borrower's consent for every purpose an NBFC uses their data for. It shares consent changes with lending partners and systems and produces audit evidence. NBFCs use it to meet their DPDP Act 2023 duties alongside RBI's Digital Lending Directions.

SecureCMS records and enforces borrower consent across loan apps, lending partners, DSAs, branches and collections. Built strictly for the DPDP Act 2023, DPDP Rules 2025, and RBI's updated Digital Lending Directions.

Regulatory Quick-Answer: Do NBFCs Need Consent for KYC & Bureaus?

KYC and regulatory reporting to credit bureaus operate under Section 7 Legitimate Use (compliance with Indian law). However, pulling credit scores during underwriting, cross-selling credit life insurance, or sharing data with co-lenders legally mandates unbundled OTP-verified borrower consent.

Lending Compliance Architecture

Mobile Onboarding Policy

Zero Phone Scraping

Contacts & SMS Blocked by Default

DSA & LSP Webhook Sync

< 120ms Real-Time Push

Sub-second Opt-Out Suppression

Closed Loan Protection

Automated 5-Year Legal Hold

PMLA Section 12 Compliant

Incubated & Evaluated By

DSCI Certified Member

CySecK Evaluated

IFSCA FinTech Cohort

IIT Kanpur C3iHub

Dual Regulatory Rulebook

Harmonizing the DPDP Act 2023 & RBI Digital Lending Directions 2025

Lenders cannot simply rely on a generic privacy policy checkbox. Both DPDP and RBI rules mandate strict operational controls.

Compliance Dimension	DPDP Act 2023 Mandate	RBI Digital Lending Directions	SecureCMS Technical Guardrail
Data Collection Scope	Section 6(1): Limited strictly to necessary personal data for specified purpose.	Strictly need-based collection. Banned access to mobile contacts, call logs, media files.	Zero phone-scraping policy engine; automated sandbox audit rejecting excessive app permissions.
Borrower Consent Standard	Free, specific, informed, unconditional, and unambiguous with clear affirmative action.	Prior explicit consent with verifiable audit trail for every data sharing with REs/LSPs.	Multilingual OTP-verified consent capture in 22 languages with SHA-256 cryptographic receipts.
Credit Bureau Reporting & Pulls	Statutory reporting is Section 7 legitimate use; bureau pull requires explicit opt-in.	Mandatory separate consent before pulling credit information company (CIC) reports.	Dedicated, unbundled OTP gate for bureau pulls separated from loan application terms.
Recovery & Collection Practices	Section 6 purpose limitation; cannot contact unconsented third parties or referees.	Strictly prohibits harassing calls, contacting borrower contacts, or unconsented family outreach.	Dynamic field-level redaction; hides family/referee contacts from recovery agent views.
Data Erasure vs Statutory Retention	Section 12 right to erasure upon purpose fulfillment or consent revocation.	Mandatory 5-year retention of KYC, loan agreement, and ledger records under PMLA §12.	Automated legal hold engine: erases marketing profiles, locks statutory loan ledgers for 5 years.

Statutory Classification

What Needs Borrower Consent vs Statutory/Contractual Duty

Ensure your loan origination workflows never confuse statutory obligations with commercial marketing.

Lending Touchpoint	Legal Basis	Consent Requirement	Data Lifecycle Rule
Borrower identity verification (CKYC / Aadhaar Offline)	Section 7 Legitimate Use + PMLA Statutory Mandate	Statutory Duty (Notice given, no opt-out)	Non-erasable during loan tenure + 5 years post closure
Credit score retrieval from CIBIL / Experian / CRIF	RBI Digital Lending Directions + Section 6 Consent	Mandatory Standalone Consent	Requires explicit borrower opt-in; timestamped record
Cross-selling personal loans / credit cards to existing borrowers	Section 6(1) Explicit Consent	Mandatory Unbundled Opt-In	Must be separate checkbox; revocable at any time
Sharing loan profile with Co-Lending Bank partner	Co-Fiduciary Joint Processing Agreement + Section 6	Mandatory Co-Lender Disclosure	Notice must specify co-lender name and risk share split
Handing over delinquent loan file to external collection agency	Section 7 Legitimate Use (Contractual Debt Recovery)	Permitted for Debt Recovery Only	Restricted strictly to borrower phone & dues; contacts redacted

Live Lending Simulator

Simulate NBFC Consent & Recovery Data Flows

Toggle zero-scraping app permissions, watch recovery agent views dynamically redact family contacts, and trigger closed-loan erasure audits.

Interactive Simulator

NBFC Lending Journey & Recovery Governance Sandbox

Simulate RBI 2025 zero-scraping onboarding, collection agency data limiting, and PMLA legal holds.

NBFC QuickLoan App

RBI 2025 Enforced

BANNED HARDWARE ACCESS (RBI 2025)

Contacts Scraping:BLOCKED

Call Logs / SMS:BLOCKED

Media & Storage:BLOCKED

Live Location:KYC 1-TIME

Credit Bureau Pull (CIBIL/Experian)

Standalone permission to pull credit score for underwriting.

Mandatory Standalone GateOTP Verified

Co-Lending Bank Data Sharing

Share application with partner bank (State Bank / HDFC) under 80:20 risk split.

Section 6 Unbundled ChoiceHeld on Solo Balance Sheet

RBI Digital Lending Compliance Verifier

Under the updated RBI Digital Lending Directions and Section 6 of the DPDP Act, lending apps are strictly prohibited from harvesting phone directories, contact lists, photos, or media files. All underwriting must rely on declared financials, Account Aggregator pulls, and explicit OTP-verified bureau pulls.

Borrower ID:NBFC-BOR-994821

Bureau Pull Hash:sha256:889d...12cb (VALID)

Notice Language:Hindi + English (Sec 5(3))

Downstream LSP Sync:Pushed via mTLS (78ms)

Platform Architecture

Enterprise NBFC Consent Modules

Purpose-built modules engineered specifically for retail NBFCs, microfinance, digital lenders, and housing finance companies.

RBI 2025 Compliant

Zero-Scraping Onboarding SDK

Blocks forbidden device permissions (contacts, SMS, call logs, storage) on Android and iOS while capturing valid OTP-verified consent for KYC and bureau pulls.

Co-Lending Ready

DSA & LSP Real-Time Sync Engine

Captures borrower consent at the DSA front-end and broadcasts revocations or changes to Lending Service Providers and co-lending banks in under 120ms.

Recovery Shield

Recovery Agency Field Redactor

Purpose-based field limiting for collections teams. Hides family contacts, workplace details, and unconsented referee numbers automatically.

PMLA / KYC Safe

Closed Loan Legal-Hold Engine

Enforces Section 12 borrower erasure rights while preserving 5-year statutory KYC, sanction letter, and repayment ledgers mandated by PMLA Section 12.

Turnkey APIs

LOS & LMS Platform Connectors

Turnkey API and webhook integration for Nucleus FinnOne Neo, Pennant, Lentra, and custom NBFC Loan Origination & Management Systems.

Multilingual Sec 5(3)

22 Indian Languages Notice Portal

Displays statutory loan data notices in all 22 Eighth Schedule languages, matching the borrower's preferred regional language during digital onboarding.

Collections Governance

Recovery Agency Data Limiting & RBI Ombudsman Defense

Harassing borrower family members or scraping emergency contacts is the single fastest trigger for RBI supervisory action and heavy penalties under the DPDP Act.

Strict Field-Level Redaction: External recovery agents only see the borrower's registered contact number, outstanding principal, and payment schedule. Family and employer contacts are cryptographically masked.

Immutable Access Audit Trails: Every collection agent lookup is logged with employee ID, timestamp, and purpose hash to prove statutory compliance during RBI audits.

Automated Revocation Dispatch: When an overdue loan is settled and No Due Certificate (NDC) is generated, collection agency access is terminated in under 60 seconds.

Lending Technology Stack Integrations

LOS Integration (Loan Origination)

Connectors for Nucleus FinnOne Neo, Pennant, Lentra, and custom digital origination engines.

LMS Integration (Loan Management)

Bi-directional sync with loan ledgers to automatically trigger 5-year PMLA legal holds on loan closure.

Credit Bureau Connectors

Pre-integrated consent gates for CIBIL, Experian, Equifax, and CRIF High Mark credit pulls.

Statutory Timeline

6-Phase NBFC Implementation Roadmap

Structured deployment path to achieve complete compliance before the mandatory 13 May 2027 enforcement deadline.

Weeks 1–2Phase 01

Phase 1: Loan Journey & DSA Data Audit

Map borrower touchpoints across digital apps, DSAs, LSPs, and physical branches into DPDP/RBI matrix.

Weeks 3–4Phase 02

Phase 2: Mobile SDK Zero-Scraping Hardening

Embed SecureCMS mobile SDK; eliminate contact/call-log scraping; configure OTP bureau consent gates.

Weeks 5–6Phase 03

Phase 3: Multilingual Notice & DSA Portal

Deploy borrower notice portal in English + 22 Indian languages across website, app, and DSA portals.

Weeks 7–8Phase 04

Phase 4: LOS / LMS & Co-Lender Webhook Sync

Integrate mTLS webhooks with core loan management systems, co-lending banks, and recovery agencies.

Weeks 9–10Phase 05

Phase 5: Automated DSR & PMLA Legal Hold

Deploy self-service borrower consent management portal; configure automated 5-year retention hold for closed loans.

Weeks 11–12Phase 06

Phase 6: CISO Certification & Audit Sign-Off

Complete CERT-In empaneled VAPT audit and establish board-ready evidentiary compliance records.

Related DPDP Compliance Modules

DPDP Platform for Fintech Companies

UPI payments, card tokenization, and multi-product consent governance.

DPDP Platform for Banks

Core banking system connectors, CBS integration, and RBI guidelines.

SecureCookie CookieHub

Cookie consent and banner automation for NBFC portals and lending apps.

DPDP Readiness Assessment

Diagnostic toolkit and gap analysis for non-banking financial entities.

Official Statutory Sources

Digital Personal Data Protection Act 2023 (Official Gazette)RBI Guidelines on Digital Lending (Updated Directions 2025)Prevention of Money Laundering (Maintenance of Records) Rules RBI Master Direction – Non-Banking Financial Company

Legal & Operational Clarity

Frequently Asked Questions for NBFC Leadership

It is software that records, verifies and enforces each borrower's consent for every purpose an NBFC uses their data for. It shares consent changes with lending partners and systems and produces audit evidence. NBFCs use it to meet their DPDP Act 2023 duties alongside RBI's Digital Lending Directions.

Book a Meeting