What DPDP compliance means for lending platforms

Lending platforms process some of the most sensitive personal data in the financial system — income, credit history, identity documents and repayment behavior. The Digital Personal Data Protection Act changes how that data can be collected, used and retained.

For most lenders, the first gap is consent. Consent captured for onboarding is often reused for collections, marketing and credit bureau reporting without a clear record of what the customer actually agreed to. A governance platform needs to track consent per purpose, not per customer.

The second gap is data mapping. Few lending platforms have a current map of where personal data lives — across the LOS, LMS, collections tools and data warehouse. Building that map is a prerequisite for responding to access and erasure requests within regulatory timelines.

Institutions that treat DPDP as a one-time audit exercise tend to fall behind. Compliance needs to be built into the onboarding and servicing workflow itself, not bolted on afterward.