DPDP and Cyber Duties for Fintech and Lending Apps
How data protection and incident reporting apply to borrower data.
Borrower data under DPDP
A lending app collects identity, contact, bank and repayment data, and often device information. Under the DPDP Act the lender is usually the Data Fiduciary and partners act as processors under contract. The DPDP Rules, 2025, notified on 13 November 2025, set phased timelines for notices, security safeguards, breach reporting and retention. Collect only what the loan needs, explain each purpose in the notice, and give borrowers a clear way to withdraw consent and complain.
Security safeguards and logs
The Rules list safeguards such as encryption, masking or tokenisation, access control, logging and monitoring, and backups, and require logs and related personal data to be kept for at least one year unless a law needs longer. CERT-In's 2022 directions separately require specified incidents to be reported within 6 hours and ICT logs to be kept for 180 days within India.
- Encrypt and tokenise sensitive fields.
- Least-privilege access with reviews.
- Logs kept for the periods the rules require.
- Incident plan covering CERT-In and DPDP reporting.
When something goes wrong
Personal data breaches must be reported to the Data Protection Board and affected people without delay, with a detailed report within 72 hours. Rehearse the plan: who decides, who writes the notices, where the logs are, and who talks to partners and lenders.
- Collect only what the loan needs and explain each purpose.
- Know both CERT-In's 6-hour rule and DPDP's 72-hour report.
- Rehearse incident response before you need it.
Draft the borrower data section of your privacy notice: each data item, its purpose and how long you keep it.
Check your understanding
1. What is the CERT-In reporting window for specified incidents?
2. Under the DPDP Rules, a detailed breach report goes to the Board within:
3. Which is a security safeguard named in the DPDP Rules?
From USD 49 or INR 2,999 a month. A person approves every step.