DPDP Act for Fintech: Consent, Lending Apps and Third-Party Risk
Fintech companies are built on data. Credit scoring, payments, digital lending, wealth platforms and insurance distribution all depend on collecting and analysing personal and financial information at scale. That makes fintech one of the sectors where the DPDP Act will be tested most closely.
Consent must be real, not buried
DPDP requires consent to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action and preceded by a notice. Pre-ticked boxes, bundled consents and long terms hidden behind a single “Agree” button are unlikely to meet this standard. Users must also be able to withdraw consent as easily as they gave it.
Lending apps and device data
RBI’s digital lending framework already restricts lending apps from accessing phone resources such as contacts, files and media, except limited one-time access needed for onboarding with explicit consent. DPDP reinforces this: collect only what is necessary for the stated purpose, and nothing more.
Third parties are the biggest risk
- Lending service providers, collection agencies, KYC vendors, credit bureaus and cloud providers all touch customer data.
- Each relationship needs a clear contract covering purpose limitation, security, breach notification and deletion.
- Regular vendor assessments and system audits should verify that controls work in practice.
Consent Managers and Account Aggregators
The DPDP framework introduces registered Consent Managers who help individuals give, manage and withdraw consent through a single interface. Fintechs already integrated with the Account Aggregator ecosystem will find the concept familiar, and should plan how their consent flows will work with this model.
Priority actions
- Redesign onboarding consent screens in plain language, purpose by purpose.
- Minimise device permissions and document why each one is needed.
- Maintain a vendor register with data flows and contract status.
- Test breach response and customer communication procedures.
- Commission an independent system audit covering DPDP controls.