The Digital Personal Data Protection Act, 2023 becomes enforceable from May 2027. For NBFCs, the most immediate impact is on borrower outreach — WhatsApp programmes, call campaigns, and any AI that processes personal data. Here is a deadline-driven checklist.
1. Audit your consent basis
Under DPDP, processing personal data requires consent for each specific purpose. For an NBFC, this means:
- The consent you collected at onboarding covers loan processing — it may not cover AI-driven collections outreach - WhatsApp and SMS programmes may need separate, explicit consent - Consent must be granular: a borrower can consent to EMI reminders but not to marketing
Before May 2027, audit every outreach programme against the consent you actually collected. Where you don't have adequate consent, you need to collect it.
2. Purpose limitation applies to AI
Data collected for loan processing cannot be used for a different purpose without additional consent. If your AI is trained on loan performance data, that training must be within the purpose for which the data was collected.
Practically: - Your AI vendor's use of your borrower data for training must be covered by your DPA with them - Any use of borrower data to train a general model (not just your own model) is almost certainly a purpose violation - Training on anonymised data is safer but the anonymisation must be genuine
3. Data-principal rights require a response process
Under DPDP, borrowers have the right to:
- Access the personal data you hold - Correct inaccurate data - Request erasure (subject to legitimate processing grounds) - Withdraw consent
For each of these rights, you need a documented process with a defined response time. AI systems that process borrower data must be able to support these requests — particularly erasure, which requires identifying all places where a borrower's data exists.
4. Data must stay in India
DPDP restricts cross-border transfer of personal data except to notified countries. At the time of writing, that list hasn't been published — which means the safe position is to keep all borrower data in India.
For AI systems: - The model must be hosted in India or on your own infrastructure - API calls that send borrower data to offshore AI systems may constitute a cross-border transfer - Your AI vendor's infrastructure location must be documented in your contract
If your current AI vendor processes any borrower data outside India, this needs to be fixed before May 2027.
5. What changes for WhatsApp outreach
WhatsApp is the primary collection channel for most NBFCs. Under DPDP:
- Consent for WhatsApp contact must be explicit and purpose-specific - A borrower who withdraws consent for WhatsApp contact must be immediately removed from all WhatsApp outreach — your systems must be able to do this in real time - Call recordings of borrowers are personal data under DPDP; retention and access controls apply
The May 2027 deadline is real. The audit, consent collection, and system changes needed to meet it take longer than most NBFCs expect. Start now.